Why is post-quantum cryptography a deployment problem for vehicles specifically?

Because vehicles have unusually long lives. A car sold today can be on the road for fifteen years or more, so a vehicle shipped with only classical cryptography is still operating well into the window when a large quantum computer may exist. The security decision made at the factory has to hold for the whole service life, which turns post-quantum readiness from a research question into a build-date planning question.

What is harvest-now-decrypt-later?

An adversary records encrypted or signed traffic today and stores it, waiting until a quantum computer can break the underlying cryptography. For V2X it matters because credentials and messages captured now could be forged or de-anonymised years later, so the exposure begins the moment a vehicle transmits, years before quantum computers arrive.

Is the problem that post-quantum algorithms are too slow for a vehicle's processor?

Mostly no. The processing cost of the standardised algorithms is manageable on automotive hardware. The harder constraint is size: a post-quantum signature is far larger than the classical one it replaces, and the awareness messages vehicles broadcast have a tight frame budget at high rates. The migration is less about compute and more about fitting a much bigger signature into a channel that is already close to full.

How much bigger are post-quantum signatures?

An ECDSA P-256 signature is around 64 bytes. A lattice-based ML-DSA signature is a few kilobytes, and a hash-based SLH-DSA signature is larger still, from about 8 kilobytes up to nearly 50, depending on the parameter set. Against a cooperative awareness message with a practical frame budget near 1.4 kilobytes broadcast up to ten times a second, that difference is the whole engineering problem.

Do the current C-ITS security standards support post-quantum yet?

Not in their current published form. The ETSI security and trust standards that underpin European C-ITS, and the credential-management system built on them, were specified around classical elliptic-curve cryptography and do not yet include a post-quantum provision. Support is expected to arrive through a future revision of the credential-management framework, with no bolt-on in sight.

What are the industry bodies doing about it?

Treating it as a roadmap item. 5GAA's 2025 annual report lists post-quantum readiness among the obstacles to full rollout, describes a PQC4Auto initiative and work with the GSMA Post-Quantum Telco Network task force, and notes that 5GAA advised the European Commission on an EU roadmap for post-quantum cryptography. These are planning activities with dates attached.

The post-quantum deadline is set by the oldest car on the road

For connected vehicles, post-quantum cryptography has a deployment date. The industry bodies already treat it as a roadmap item.

Post-quantum cryptography is usually filed under research: a thing that matters eventually, once quantum computers get real, handled by cryptographers in the meantime. For most software that filing is fine, because most software can be patched the week the threat becomes concrete. Vehicles cannot, and that single difference moves the subject from the lab bench onto a delivery schedule.

A car is one of the longest-lived connected devices anyone ships. Sold today, it is plausibly on the road in fifteen years, running the cryptography it left the factory with. So the security choice made on a 2030 production line is a bet that the maths holds until 2045, and that bet is being placed now, on every vehicle that rolls off the line without a post-quantum path.

Why the date is real, and already ticking

Two facts point at each other and set the clock.

The first is the vehicle lifetime above. The second is harvest-now-decrypt-later: an adversary does not need a quantum computer today to benefit from one tomorrow. They can record signed and encrypted V2X traffic now, store it, and break it once the hardware exists. A CAM is broadcast in clear and worthless to an attacker seconds later, so the exposure sits in the certificate hierarchy behind it, where root and enrolment credentials issued today are meant to still be trusted in the 2040s.

Put those together and the planning question is not “when will quantum computers arrive.” It is the comparison a cryptographer named Michele Mosca made into a rule of thumb: add the years your data must stay secure to the years it takes you to migrate, and if that sum lands past the arrival of a capable quantum computer, you are already behind. For a fifteen-year vehicle and a multi-year standards migration, the sum is large enough that the answer is to start from the deadline and work backward.

The market already treats it as a schedule

The clearest sign this has left the research column is that the industry bodies are managing it like a roadmap item, with owners and dates.

5GAA’s 2025 annual report lists post-quantum readiness among the obstacles to a full rollout of connected-vehicle services, alongside its other cybersecurity and credential-management work. It describes a PQC4Auto initiative, work with the GSMA’s Post-Quantum Telco Network task force, and advice to the European Commission on an EU roadmap for post-quantum cryptography. Advising a government on a migration roadmap is not what an industry does with a problem it considers hypothetical. It is what an industry does with a deadline it can see.

Signature size is the real wall

The common assumption is that post-quantum crypto is too heavy for an in-vehicle processor. It is the wrong thing to worry about. The standardised algorithms run acceptably on automotive-grade hardware; the processing cost is a solvable engineering line item.

The binding constraint is size. A classical ECDSA signature is tiny. Its post-quantum replacements are not:

A post-quantum signature dwarfs the classical one and overruns the entire frame budget of the message it has to fit inside. Sizes are for the ML-DSA-65 and SLH-DSA-128s parameter sets.

Weigh that against the message it has to fit inside. A cooperative awareness message, the beacon a vehicle sends up to ten times a second, has a practical frame budget on the order of 1.4 kilobytes. A signature that jumps from tens of bytes to thousands does not just add overhead; a CAM of 400 bytes at 10 Hz is 32 kbit/s of air time, and adding an ML-DSA signature takes that past 290. The frame size is what you notice first, and the air time is what costs. The migration is a packaging problem before it is a cryptography problem, and packaging problems in a shared radio band are the kind that ripple into congestion control and message rates.

The standards are not ready either

None of the security machinery European C-ITS runs on was built with this in mind. The ETSI standards that define how V2X messages are signed and how vehicles obtain their credentials assume elliptic-curve cryptography throughout, and the credential-management system layered on top inherits that assumption. There is no post-quantum provision to switch on today. The realistic path is a future revision of the credential-management framework that defines how post-quantum and classical credentials coexist during a transition measured in years.

That, more than the algorithms, is where the deadline pressure lands. Changing an algorithm is bounded work. Changing the trust framework that millions of vehicles and every roadside operator depend on, without a flag day, is the part that has to start early because it cannot be rushed at the end.

Plan from the deadline

Stop asking whether post-quantum matters yet, and ask instead what date the oldest vehicle you ship this year will still be on the road, and whether its credentials will still be trustworthy then. The product fixes that date, and the research calendar does not, and it is close enough that the vehicles answering it are being built now.

For how the credential system that all of this has to migrate works today, see the credential lifecycle in IEEE 1609.2.1. For why connected-vehicle safety is turning into product at all, see the business model V2X was missing.