Post-quantum cryptography adoption

(a) In general The Secretary of Defense shall ensure the cryptographic solutions of the Department of Defense use asymmetric post-quantum cryptography algorithms approved by the National Institute of Standards and Technology— (1) for key establishment by not later than December 31, 2030; and (2) for digital signatures by not later than December 31, 2031. (b) Phase out and replacement In carrying out subsection (a), the Secretary of Defense shall phase out and replace— (1) except as provided in paragraph (2), symmetric key establishment protocols, symmetric key agreement protocols, and symmetric key distribution protocols by not later than December 31, 2030; and (2) any solution certified as a classified commercial solution by the National Security Agency by not later than December 31, 2031. (c) Exception Subsections (a) and (b) shall not apply to a key that is generated and distributed by the National Security Agency for use in a cryptographic device for the protection of classified and sensitive national security information or with respect to symmetric key distribution protocols in use prior to January 1, 2010.