FAA seeks industry input on post-quantum cryptography transition for air traffic control and IT systems

WASHINGTON - The Federal Aviation Administration (FAA) is requesting information from industry on its readiness to support the transition of both the National Airspace System (NAS) and FAA business systems to post-quantum cryptography (PQC), a new type of encryption designed to remain secure against future quantum computers.

The FAA said the move is part of a generational transformation of the NAS to a modern, resilient, and globally leading air traffic control (ATC) system capable of integrating new entrants such as drones, advanced air mobility, and commercial space operations. Quantum-resistant, crypto‑agile security is viewed as a foundational enabler rather than a compliance exercise, the agency said.

PQC is particularly urgent for FAA systems because NAS infrastructure is safety-critical, highly complex, and has long lifespans. Operational technology (OT) systems directly monitor or control aircraft, runways, and air traffic, so any cryptography failure could compromise flight safety. NAS systems operate 24/7 with minimal tolerance for downtime, and they must maintain secure, authenticated communications with international air traffic networks and commercial airlines. Integrating PQC ensures that FAA systems remain secure and reliable even as quantum computers capable of breaking current encryption become available.

Related: Exploring quantum-safe networking: Honeywell, Colt, and Nokia trial satellite-based encryption

The RFI seeks industry insight on the technical, operational, and strategic challenges of migrating FAA enterprise IT and NAS OT systems to PQC. Responses will help the FAA estimate costs, plan resources, and evaluate potential impacts on ongoing modernization initiatives, including Trajectory Based Operations (TBO), Automatic Dependent Surveillance-Broadcast (ADS-B), Data Communications (Data Comm), and System Wide Information Management (SWIM).

Dual approaches

FAA said the transition must account for federal mandates, complex recertification, and operational disruption while maintaining system performance and interoperability. The agency is considering two approaches:

"One-Stop Shop" integrated solution: A single vendor provides a comprehensive, pre-validated PQC suite including algorithm implementation, key management, and hardware integration. This approach may simplify deployment and auditing, but could carry risks of vendor lock-in.

Modular or "best-of-breed" approach: Individual PQC components such as NIST-standardized key encapsulation mechanisms, digital signature algorithms, and PQC-ready hardware security modules are sourced from specialized vendors. This approach emphasizes flexibility and multi-vendor interoperability but may be more complex to integrate.

Related: Quality matters - advances in digital quantum simulation

The RFI applies to both OT systems that control physical aviation assets and enterprise IT systems that manage administrative tasks, personnel, and financial data. FAA stressed that PQC adoption must support real-time NAS operations, enterprise scalability, and long-term adaptability to evolving standards and threats. Vendors are encouraged to describe strategies for certification, supply chain security, workforce readiness, and global interoperability.

Responses must be submitted electronically by 4 p.m. Eastern on 10 April 2026. The FAA named Jackson LeMay as the primary point of contact for this RFI. They can be reached via email at [email protected]. More information is available at https://sam.gov/workspace/contract/opp/92f0c4cc679d4aecb86f8547a954987c/view.