What is post-quantum cryptography?
Post-quantum cryptography protects data and communications against future quantum computers. This guide explains the threat, the NIST standards and how organizations should prepare.
Definition
Post-quantum cryptography (PQC) is the family of public-key algorithms designed to remain secure against attackers with access to large quantum computers. Unlike quantum key distribution, PQC runs on existing hardware, software and networks.
Why quantum computers are a threat
Most of today's digital trust relies on RSA and elliptic-curve cryptography: TLS, VPNs, digital signatures, PKI and code signing. A sufficiently powerful quantum computer running Shor's algorithm could break both. Symmetric algorithms are affected less; Grover's algorithm reduces their effective strength, which is why AES-256 is recommended for long-term protection.
Harvest now, decrypt later
An adversary does not need a quantum computer today to benefit from one tomorrow. Encrypted traffic can be captured and stored now and decrypted later. Any information that must remain confidential for many years, such as government, defense, health or financial data, is therefore already at risk.
The NIST standards
- ML-KEM (FIPS 203): key establishment, derived from CRYSTALS-Kyber.
- ML-DSA (FIPS 204): digital signatures, derived from CRYSTALS-Dilithium.
- SLH-DSA (FIPS 205): hash-based digital signatures, derived from SPHINCS+.
ML-KEM and ML-DSA are based on structured lattices and the Module Learning With Errors problem.
Hybrid cryptography
During the transition, most deployments combine a classical algorithm with a post-quantum one, for example X25519 with ML-KEM in TLS 1.3. An attacker would need to break both, and compatibility with existing systems is preserved.
Timelines
NIST IR 8547 plans to deprecate RSA and ECC during the 2030s. The NSA's CNSA 2.0 sets 2035 as the target for national security systems. Mosca's theorem helps decide urgency: if the years data must remain confidential plus the years the migration will take exceed the years until a quantum adversary exists, the data is already exposed.
How to start
- Build an inventory of where public-key cryptography is used.
- Prioritize systems that protect long-lived data.
- Deploy hybrid schemes on the most exposed flows first.
- Train the teams that will run the migration.
See our PQC migration services, the Q-CIPHER gateway and the Q-LAB-314 training platform.
Frequently asked questions
Will quantum computers break all encryption?
No. Shor's algorithm breaks public-key schemes such as RSA and elliptic-curve cryptography. Symmetric encryption is affected less: Grover's algorithm reduces its effective strength, which is why AES-256 is recommended.
Which post-quantum algorithms should we use?
The NIST standards: ML-KEM (FIPS 203) for key establishment, and ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for digital signatures, typically deployed in hybrid mode with classical algorithms.
What does quantum-safe mean?
A system is quantum-safe when the cryptography protecting it is expected to resist attacks by both classical and quantum computers.
Assess your quantum exposure
I-314 helps organizations identify which systems require post-quantum protection first.