A Federal Deadline Satellites Weren't Designed For
On June 22, 2026, President Trump signed Executive Order 14412, titled Securing the Nation Against Advanced Cryptographic Attacks, setting the first dated federal deadlines for post-quantum cryptography migration: key-establishment systems must move to quantum-resistant algorithms by December 31, 2030, and digital-signature systems by December 31, 2031. The order covers high-value assets and high-impact federal systems, as reported by HSToday, and excludes National Security Systems, which already answer to an earlier 2030 deadline under the NSA's CNSA 2.0 suite. Trump signed a companion order the same day, Executive Order 14413, aimed at broader quantum-technology innovation, but it is EO 14412 that carries the binding migration dates.
A White House memo, OMB M-26-15, breaks the migration into phases: strategy, planning and discovery through 2027, then prioritized migration from 2028 through 2030. For most federal IT, that timeline is tight but workable. For satellites, it runs into a harder physical constraint. A spacecraft launched this year that its operator expects to fly for 15 years will still be carrying live government and commercial traffic in the 2040s, running whatever cryptography was built into its flight computer at launch.
Why Orbit Makes the Problem Worse
Ground systems can usually take a software patch or a new certificate overnight. A satellite's command and telemetry link, and often its payload encryption, is fixed by hardware selected years before launch and frozen once the bus is integrated and shipped to the pad. Updating a satellite already in orbit means either an onboard software-defined radio capable of a firmware upload, or no path forward at all.
That gap matters because of an attack pattern known as harvest now, decrypt later: an adversary records encrypted satellite traffic today, stores it, and waits for a cryptographically relevant quantum computer to break the key exchange retroactively. The exposure window is not how long it takes to build such a machine. It is how long the intercepted traffic needs to stay secret, a concern that any satellite designed to operate past 2030 carries from the moment it launches.
The Algorithms Themselves
NIST finalized its first post-quantum standards in August 2024: FIPS 203, specifying the ML-KEM key-encapsulation mechanism derived from CRYSTALS-Kyber, and FIPS 204, specifying the ML-DSA signature scheme derived from CRYSTALS-Dilithium. Both now form the baseline CISA points federal agencies and critical-infrastructure operators toward under its post-quantum cryptography initiative.
Fitting them into satellite hardware is not trivial. An ML-KEM-768 public key runs to 1,184 bytes, far larger than the 32- to 64-byte elliptic-curve keys most existing hardware security modules and radiation-tolerant cryptographic chips were sized around. Most migration guidance recommends hybrid schemes during the transition, pairing a classical algorithm like ECDH with ML-KEM so an attacker has to break both, rather than stripping out flight-proven cryptography outright.
CISA's post-quantum cryptography initiative works with Sector Risk Management Agencies to help critical-infrastructure operators build migration roadmaps, but the agency has not published guidance specific to the space sector. That leaves satellite operators to interpret the same federal timeline written for enterprise IT, without product categories built around spacecraft constraints like mass, power budget and radiation tolerance.
One Operator Moving Early
WISeSat.Space, a Nasdaq-listed satellite IoT operator, said on October 12 that it is building a post-quantum architecture across its network, citing Executive Order 14412 as the policy driver, as The Quantum Insider reported. The approach leans on hardware from partner SEALSQ, specifically the QS7001 secure microcontroller and QVault trusted-platform-module line, both built to support ML-KEM and ML-DSA natively rather than through a software layer bolted on after the fact. WISeSat currently operates nine active low-Earth-orbit satellites and says the new architecture will roll out through successive missions rather than as a single retrofit.
The company's next opportunity to do that came days earlier. On October 8, WISeSat and Spanish nanosatellite builder FOSSA Systems confirmed an October 2026 launch, the first in a series supporting what they call the Quantum Spatial Orbital Cloud, or QSOC, according to the companies' joint announcement. WISeSat has set a longer-term goal of a 100-satellite constellation by 2033, a figure the company itself describes as dependent on financing, regulatory approval and launch availability.
A Narrow Case, a Wider Warning
WISeSat's announcements are company statements, not independent audits, and its current fleet is modest next to the SATCOM networks run by Viasat, SES or Iridium, none of which has published a public post-quantum migration timeline as of this writing. Executive Order 14412's deadlines bind federal systems and, through a pending FAR Council rulemaking, federal contractors. They do not by themselves compel commercial satellite operators serving non-government customers. But any operator carrying federal high-value traffic, from weather data to military SATCOM-as-a-service contracts, inherits the same 2030 and 2031 dates as the agencies it serves, on hardware with launch cycles measured in years rather than sprint cycles measured in weeks.
First reported on Executive Order 14412's cryptographic deadlines by HSToday, and on WISeSat.Space's post-quantum migration by The Quantum Insider.
