Post-quantum cryptography, explainedPost-quantumcryptography,explained

Public-key cryptography rests on maths problems that are hard for ordinary computers: factoring large numbers (RSA) and discrete logarithms (Diffie-Hellman and elliptic curves). In 1994 Peter Shor showed that a quantum computer could solve both efficiently. A machine large and reliable enough to do it against real key sizes is called a cryptographically relevant quantum computer, or CRQC.

Symmetric cryptography is in better shape. Grover's algorithm gives at most a square-root speed-up against keys and hashes, which longer keys absorb. That is why national guidance such as the NSA's CNSA 2.0 suite requires AES-256 and SHA-384 or SHA-512.

An adversary does not need a quantum computer today to benefit from one tomorrow. Encrypted traffic and stolen archives can be stored now and decrypted once a CRQC exists. For data that must stay confidential for ten or twenty years, such as health records, trade secrets, payment and identity data, or diplomatic traffic, the exposure has already begun.

Signatures are different. A forged signature only matters once a CRQC exists, but systems that must still verify signatures in the 2030s, such as firmware, roots of trust and long-lived certificates, have to be designed for it now.

Michele Mosca's rule of thumb compares three numbers. X is how long the data must stay secret. Y is how long migrating the systems that protect it will take. Z is how long until a CRQC exists. If X + Y is greater than Z, that data is already exposed.

Z is uncertain, which is the point: X and Y are numbers you control and can measure. Large migrations of cryptography have historically taken a decade or more, so for long-lived data the inequality is failing today for most banks, insurers and public bodies.

Post-quantum cryptography (PQC) uses new maths problems, mainly structured lattices and hash functions, that run on ordinary computers and that no known quantum algorithm breaks. NIST published the first three standards in August 2024: ML-KEM for key establishment, and ML-DSA and SLH-DSA for signatures. They are designed as drop-in replacements in protocols such as TLS, SSH, IPsec and PKI, though keys and signatures are larger.

Most early deployments are hybrid: a classical algorithm and a post-quantum one combined, so the connection stays secure if either holds. Hybrid ML-KEM key exchange is already the default in major browsers and in OpenSSL 3.5, so a large share of web traffic is quantum-safe in transit today.

Quantum key distribution (QKD) is a different technology: it uses physics and special hardware to share keys over dedicated links. Agencies including the NSA, the UK's NCSC and France's ANSSI favour PQC for almost all uses, because QKD needs new infrastructure, covers only point-to-point links and does not provide authentication on its own.