Is today’s V2X crypto already at quantum risk?
Yes. Two of six certificate cohorts already fall inside the risk window, years before any quantum computer exists.
Harvest-Now-Decrypt-Later Risk Cohorts Across ETSI CCMS Certificate Validity Periods: A Quantitative Roadmap for Post-Quantum Migration of EU V2X PKI
Blackcycle Lab · IEEE Access, 2026
CCMS cohorts in the harvest-now-decrypt-later window
2 / 6Root CA
Trust-list mgr
X = time to migrate. Y = how long the data must stay secret. Z = years until a quantum computer can break it. If migration plus retention outlasts the clock, you’re already at risk.
Abstract
The EU Cooperative Intelligent Transport Systems (C-ITS) Certificate Management System (CCMS) issues certificates whose validity ranges from 168 h authorization tickets to five-year root certificate authorities. In a signature-centric V2X public-key infrastructure, the harvest-now-decrypt-later analogue is not ciphertext decryption but future private-key recovery for long-lived trust anchors: a compromised root key can enable unauthorized subordinate-certificate issuance and, where audit evidence is insufficient, backdated forgery claims. We apply Mosca’s X + Y > Z risk inequality to six CCMS certificate cohorts under three quantum-arrival scenarios and find that root and trust-list-manager cohorts already fall inside the optimistic risk window. We then benchmark ten signature variants and three ML-KEM variants on a homogeneous OpenSSL 3.5 / liboqs stack across an Intel i7, a Cortex-A78AE automotive platform and a Raspberry Pi 4 Cortex-A72. An ECDSA+ML-DSA-44 composite-signature path on an operator-isolated shadow CCMS enrolment endpoint shows modest compute overhead but large envelope growth, motivating a backend-first migration roadmap and illustrative planning milestones for ETSI WG5.
Faster signing
Post-quantum signatures sign faster than today’s method, on ordinary laptop-class hardware.
Bigger keys and signatures
The real migration cost isn’t speed — it’s size. Public keys and signatures both grow roughly 40-fold.
Certificate types already at risk
Root and trust-list certificates fall inside the risk window today, before any quantum computer exists.
Cite
@article{blackcyclelab2026hndl,
title = {Harvest-Now-Decrypt-Later Risk Cohorts Across ETSI CCMS Certificate Validity Periods:
A Quantitative Roadmap for Post-Quantum Migration of EU V2X PKI},
author = {{Blackcycle Lab}},
journal = {IEEE Access},
year = {2026},
doi = {10.1109/ACCESS.2026.3746463}
}