The Department of Defense is seeking commercially available, software-only encryption technology to protect military data without requiring changes to existing hardware as the department moves toward post-quantum cryptography (PQC).
According to a request for information (RFI) posted to Sam.gov on Aug. 27, the DOD wants “to identify potential sources and solutions that can meet the department’s requirements for interim data protection measures, which are designed to be consistent with and advance the DOW’s migration to post-quantum cryptography.”
Under the Trump administration, the DOD was rebranded as the Department of War (DOW).
“The desired solution should provide utility-based, data packet-level cryptographic protection that aligns with the government’s PQC migration strategy and implementation plan, scheduled for on or before December 31, 2029,” the RFI reads.
The software encryption effort is part of a broader DOD push to prepare military systems for quantum-era threats. The department published its PQC strategy in June, the day after the White House issued new quantum policies. The DOD PQC strategy outlines a plan to prepare “for a future battle space enabled by Cryptographically Relevant Quantum Computers.” The strategy directs personnel to ensure all systems support PQC by 2030, and that every DOD system uses PQC, unless otherwise specified, no later than 2031.
Applicable solutions
The RFI states that applicable solutions must ensure cryptographic protection of data and protect encryption and decryption keys during establishment through asymmetric key encapsulation mechanisms and digital signatures.
Authentication integration must be provided through an authorized PQC digital signature or through message authentication codes established through PQC asymmetric cryptographic approaches. Solutions must also be capable of integrating with PQC public key infrastructure.
The department’s requirements further call for protections against unknown key access, including third-party storage, management, or access to cryptographic keys.
The RFI also specifies that applicable solutions must not use symmetric key distribution mechanisms or protocols, pre-shared or pre-placed secret keys or private keys, or symmetric encryption to protect cryptographic keys.
They also must not use policy-based control of cryptography for automated upgrades or downgrades of cryptographic components.
The technology must be capable of advancing data protection capabilities while ensuring the DOD retains full control and sovereignty over its data and cryptographic keys.
Responses to the RFI are due by 12 p.m. Eastern time Sept. 27, 2026.