TSA pipeline security directive encryption post-quantum

Post-quantum encryption for pipeline SCADA means protecting data that travels between compressor stations, pump stations, metering sites and control centres. The key exchange used has to resist future quantum computers. In practice this usually means combining a classical algorithm with a NIST-standardised post-quantum algorithm such as ML-KEM (FIPS 203).

For US pipeline operators, the question sits where two policy tracks meet. One is the cybersecurity regime TSA has built since 2021. The other is the federal timetable for retiring quantum-vulnerable cryptography. This article explains what each one requires, where they leave gaps, and how to close those gaps on live SCADA links.

Does the TSA pipeline security directive require encryption of SCADA communications?

Not as a standalone, algorithm-specific mandate. The TSA Security Directive Pipeline-2021-02 series is performance-based. It requires operators to protect critical cyber systems, but it leaves the choice of controls, including encryption, to each operator’s own implementation plan.

TSA’s first directive after the Colonial Pipeline incident was procedural. It required critical pipeline owners and operators to report confirmed and potential cybersecurity incidents to CISA and to designate a Cybersecurity Coordinator, available 24 hours a day, seven days a week. The Pipeline-2021-02 series then added technical expectations. In its public form, these centre on segmenting IT from OT, controlling access, continuous monitoring and detection, and timely patching. Each one is documented in a Cybersecurity Implementation Plan that TSA approves.

The series has been revised and reissued every year. With the 2021-02D revision, companies are now required to annually submit an updated Cybersecurity Assessment Plan to the TSA, and test at least two Cybersecurity Incident Response Plan (CIRP) objectives in annual exercises. Encryption shows up indirectly. When SCADA traffic crosses a carrier network, the public internet, cellular or satellite links, encrypting it is one of the most direct ways to meet the directive’s segmentation and access-control goals.

How does API 1164 address encryption of pipeline SCADA communications?

API Standard 1164 treats encryption as a risk-based control. It is not universal. The standard expects operators to protect control system communications, but it accepts that some legacy and timing-sensitive segments need alternatives or compensating controls.

The standard has a long history in the sector. It first appeared as API STD 1164, “Pipeline SCADA Security,” September 1, 2004. The third edition, retitled for pipeline control systems cybersecurity, aligns its requirements with the NIST Cybersecurity Framework. That makes it easier to map onto TSA implementation plans.

The American Petroleum Institute has been open about how far encryption can go in OT. In comments submitted to NIST in 2013, API argued that certain technologies, encryption among them, should not be used on all process control system environments. That caution still applies to serial polling and to devices with very limited processing power. It does not apply to the IP backbone between sites. There, encryption at the network edge places no load on field devices.

API 1164 does not set a date for moving to post-quantum algorithms. Operators who follow it should read its cryptographic expectations together with NIST guidance. The standard tells you to protect data in transit. NIST tells you which algorithms will still count as protection after 2030.

How should pipeline operators protect SCADA links between compressor stations and control centres against harvest now, decrypt later?

Start with the links where data is both long-lived and exposed to third-party networks. Move those to hybrid key exchange that pairs a classical algorithm with ML-KEM. Keep strong symmetric encryption for the payload.

The risk is about timing. Although large-scale quantum computers do not yet exist, adversaries can already record encrypted traffic today and decrypt it once quantum capabilities mature. A live pressure reading has little value a week later. Network addressing plans, engineering uploads, historian exports, authentication exchanges and operating patterns can stay useful to an adversary for a decade.

A practical sequence for SCADA wide-area links

1. Inventory paths, not just assets. List every route between field sites and control centres, including backup paths. Note the carrier, the medium and the current key-exchange method.
2. Rank by exposure and data lifetime. Links over the public internet, cellular or satellite, and remote engineering access, come before private leased circuits.
3. Use hybrid key agreement. Combining classical and post-quantum key exchange into one session key means the link stays protected even if one of the two components is later weakened.
4. Keep symmetric strength high. NIST-approved symmetric primitives providing at least 128 bits of classical security continue to be approved, so the migration effort belongs in key establishment.
5. Require crypto agility. Make sure the post-quantum algorithm can be swapped without replacing hardware at remote stations.

This order matches long-standing joint guidance. CISA and TSA advise operators to “Leverage encryption such as VPN when using untrusted networks or require remote access.” Post-quantum migration builds on that baseline. It does not replace it.

Can quantum-safe encryption gateways be added to pipeline SCADA networks without affecting operations?

Yes, when the gateway works at the network layer, sits at the edge of each site, and is tested against the polling behaviour of the SCADA system before cutover. Gateways that leave RTUs, PLCs and HMIs untouched avoid the biggest operational risk: changing firmware on field devices.

Design points that decide whether operations notice

• Layer and placement. A Layer 3 gateway encrypts everything above IP. Protocols such as DNP3 or Modbus TCP pass through unchanged. If an OT monitoring sensor or firewall needs to inspect that traffic, place the gateway on the WAN side of it so inspection happens before encryption.
• Routing, not re-architecture. Integration should mean adding or adjusting a few routes. Firewalls, routers and the existing addressing scheme stay in place.
• Timing and packet size. Record poll response times and timeouts before installation. Then confirm that encryption overhead does not push packets past the path MTU on narrowband links.
• Failure behaviour. Decide ahead of time what should happen when a tunnel drops, and write it into the incident response plan that the directive already requires you to exercise.
• No external dependencies. For isolated or air-gapped control networks, confirm the gateway needs no cloud service and sends no telemetry.

As an example of this architecture, Quantum Network’s QPN gateway sits at each end of a connection, as hardware or as software. It encrypts at Layer 3 without installing software on the equipment behind it. It combines a classical and an ML-KEM key exchange into one session key, and both handshakes renew every two minutes. Payload is encrypted with ChaCha20-Poly1305, and every packet is authenticated.

Know what a gateway does not do. It protects data in transit, not the devices behind it. It does not replace a central firewall, malware scanning or denial-of-service protection. The segmentation, monitoring and patching controls in your TSA implementation plan still apply.

How do TSA directives fit with US federal post-quantum migration timelines?

They run in parallel without being formally connected. TSA sets cybersecurity outcomes for pipelines. Federal post-quantum deadlines bind federal systems, but they shape the algorithms vendors support and the expectations auditors apply across critical infrastructure.

The federal anchor is National Security Memorandum 10, which sets the national goal of mitigating as much of the quantum risk as is feasible by 2035. NIST IR 8547 turns that goal into algorithm-level dates. NIST will deprecate and ultimately remove quantum-vulnerable algorithms from its standards by 2035, with high-risk systems transitioning much earlier. The timeline has since been tightened for the federal government’s most sensitive systems.

Two more items complete the picture. The TSA Enhancing Surface Cyber Risk Management proposed rule, published in November 2024, would turn much of the directive regime into permanent regulation for pipelines and rail. As proposed, it focuses on cyber risk management programs rather than particular cryptographic algorithms. The CISA Pipeline Cybersecurity Initiative, created in October 2018, built much of the technical evidence behind these rules:

• In FY 21, the PCI team supported Validated Architecture Design Review assessments to 53 pipelines, more than five times as many as the past 3 years combined (CISA, 2021).
• CISA and TSA brought together more than 25 major pipeline operators and industrial control systems partners to strengthen OT security practices (CISA, 2023).

The initiative’s work is now transitioning to enduring programs in TSA and CISA, which means pipeline cybersecurity oversight is becoming permanent rather than a temporary response.

What should pipeline operators plan for between now and 2030?

Treat 2030 as the working deadline for key establishment on exposed SCADA links. That is the date federal high-impact systems must meet, and NIST deprecation begins after it. Data harvested before then is already at risk.

In practice, add a cryptographic inventory to the annual Cybersecurity Assessment Plan the directive already requires. Record which links still depend on RSA or elliptic-curve key exchange. Schedule gateway pilots on one compressor-station path during a planned maintenance window. Measure poll timing before and after cutover, then roll out in priority order. NIST’s own advice is direct: “organizations should begin migrating their systems to quantum-resistant cryptography.” For pipelines, that work fits inside the change-management, assessment and incident-response processes that the TSA directives already require.