Key Industry Scenarios

Post-quantum demand is not uniform — it is shaped by what each sector protects, how long that data must stay secret, and how hard its systems are to change. This page walks sector by sector through the priority PQC scenarios, synthesized and rewritten from the key-demand chapter of 安全牛《后量子密码安全能力构建技术指南（2025版）》, and ends with a mapping of sector to primary need to recommended approach.

Identity & access (身份认证)

Authentication is the first thing an adversary subverts and therefore an early PQC priority.

• Zero-trust re-architecture — continuous verification depends on signatures and key exchange that must become quantum-resistant.
• PKI overhaul — the certificate authorities, formats, and trust stores that underpin identity need PQC-capable signing (see PKI impact).
• Access-control mechanisms — tokens, session keys, and federation assertions move to ML-KEM for key establishment and ML-DSA for signing.

Data protection (数据安全)

Data with a long confidentiality horizon is the textbook harvest-now, decrypt-later target.

• Data at rest — re-encrypt long-lived archives and back up keys under PQC-wrapped key hierarchies.
• Data in transit — adopt hybrid key exchange so captured traffic resists future decryption.
• Data-lifecycle management — classify by sensitivity and shelf-life, then prioritize the records whose secrecy must outlast the arrival of a quantum computer.

Government (政务)

• E-government security — citizen-facing services and inter-agency systems carry long-lived, high-sensitivity records.
• Critical information infrastructure (CII) — state systems are designated CII and face the strictest mandates.
• Secure data sharing and collaboration — cross-department exchange needs PQC-protected channels and signed, attributable records.

Finance (金融)

Finance combines long data lifetimes, heavy regulation, and dense use of digital signatures, making it one of the most demanding sectors.

Payment systems

• Transaction encryption end to end across acquiring and clearing.
• Financial HSM key management upgraded for larger PQC keys.
• Risk-control pipelines that authenticate and sign event data.

Blockchain

• PQC consensus and signing to replace ECDSA on-chain.
• Smart-contract and cross-chain bridge security against forged signatures.

Digital currency / CBDC

• Issuance and redemption signing, quantum-resistant wallets, and cross-border payment channels.

IoT & industrial control (物联网与工控)

Constrained devices and long-lived field equipment make this the hardest sector to migrate.

• Lightweight PQC for resource-constrained devices, leaning on hardware acceleration such as ARM TrustZone.
• Industrial protocol security for Modbus and OPC UA, which were not designed with strong cryptography.
• Device authentication and network isolation to contain compromise.
• Device-lifecycle and remote-operations security, including signed firmware updates over equipment lifespans measured in decades.

Power & energy (电力) — a highlighted CII example

The power sector is a flagship CII case: grid control, dispatch, and metering combine industrial-control constraints with national-security stakes. It demands lightweight PQC at the edge, hybrid-protected control channels, and a phased rollout that never interrupts supply. Telecom shares this CII profile across signaling and subscriber data (see telecom).

Sector summary

Standards & references

• 安全牛《后量子密码安全能力构建技术指南（2025版）》 — industry report; the sector scenarios above are synthesized and rewritten from its key-demand chapter, not reproduced. It uses the former names CRYSTALS-Kyber, CRYSTALS-Dilithium, and SPHINCS+ for what NIST now standardizes as ML-KEM, ML-DSA, and SLH-DSA.
• NIST Post-Quantum Cryptography project — the standardized algorithm suite.
• CISA / NSA / NIST — Quantum-Readiness: Migration to PQC — sector-agnostic readiness guidance.
• Resources — full standards register