Change:
even if a quantum computer of sufficient size and power to exploit elliptic curve cryptography will exist.  Deployments that need to consider risks decades into the future should transition to Post- <del> Quantum Cryptography (PQC) in the not-too-distant future.  Many other systems should take a slower wait-and-see approach where PQC is phased in when the quantum threat is more imminent.  Current PQC algorithms have limitations compared to Elliptic Curve Cryptography (ECC) and the data sizes would be problematic in many constrained IoT systems.  If a Cryptographically Relevant Quantum Computer (CRQC) is built it could recover the SHARED_SECRET from the ECDHE public keys in a matter of hours. </del> <ins> Quantum Cryptography (PQC) in the not-too-distant future.  Other systems may employ PQC when the quantum threat is more imminent. Current PQC algorithms have limitations compared to Elliptic Curve Cryptography (ECC) and the data sizes could be problematic for some constrained systems.  If a Cryptographically Relevant Quantum Computer (CRQC) is built it could recover the SHARED_SECRET from the ECDHE public keys. This would not affect the ability of EAP-AKA' (with or without this extension) to authenticate properly, however.  As symmetric key cryptography is safe even if CRQCs are built, an adversary still will not be able to disrupt authentication as it requires computing a correct AT_MAC value.  This computation requires the K_aut key which is based on MK and, ultimately, CK' and IK', but not SHARED_SECRET. Other output keys do include SHARED_SECRET via MK_ECDHE, but still include also CK' and IK' which are entirely based on symmetricy cryptography.  As a result, an adversary with a quantum computer still cannot compute the other output keys either. However, if the adversary has also obtained knowledge of the secrets associated with the SIM card, they could then compute CK', IK', and SHARED_SECRET, and any derived output keys.  This means that the the introduction of a powerful enough quantum computer would enable subverting this protocol extension, making it necessary to update the current ECC algorithms in this specification to PQC algorithms.  This specification does not add such algorithms, but a future specification may do that. </ins> Symmetric algorithms used in EAP-AKA' FS such as HMAC-SHA-256 and the algorithms use to generate AT_AUTN and AT_RES are practically secure

Discussion:
Karl: The PQ considerations are quite generic and does not really say anything about the security properties of this specific protocol (it even mentions constrained IoT). For example, it could instead talk about specifics of this protocol, e.g., Secrecy: the CK'/IK' goes into the derivation of the output keys, so even if a PQ adversary can compute the joint DH-key, then I assume only the FS property gets broken (possibly). The adversary would still not be able to break the symmetric key parts, so the established key would still be secret, right? Authentication: By the same argument: if symmetric key crypto would still be safe PQ, then the adversary won't be able to disrupt authentication and do impersonation attacks, I assume.
I like your angle on PQ. We need exact text though.
This sounds like good changes