What Is Post-Quantum Cryptography? A Practical Explanation for Security Engineers
Post-quantum cryptography (PQC) is the set of cryptographic algorithms designed to remain secure against attacks from quantum computers. The term does not refer to cryptography that uses quantum mechanics (that is quantum key distribution, a different thing). PQC uses classical computing but relies on mathematical problems that quantum computers cannot efficiently solve.
The reason this matters right now, not in some theoretical future, is a concept called “harvest now, decrypt later.” Adversaries can collect encrypted data today and store it. When quantum computers become powerful enough to break current encryption (estimated 2030-2035 by most credible projections), they decrypt it. If the data is still sensitive at that point (trade secrets, state intelligence, medical records, financial data), the original encryption was worthless.
This is not speculative. Multiple governments have acknowledged this threat and set migration deadlines. Google moved its internal PQC migration deadline to 2029 in early 2026, accelerating from a previous 2030 target. The urgency is real.
What quantum computers break
Not all cryptography is vulnerable. The threat is specific:
Broken by quantum computers:
- RSA (key exchange and signatures)
- Elliptic Curve Cryptography (ECDSA, ECDH, Ed25519)
- Diffie-Hellman key exchange
- DSA signatures
These are the algorithms that protect TLS connections (HTTPS), email encryption (S/MIME, PGP), VPNs, SSH, code signing, and blockchain signatures. They are everywhere.
Not broken by quantum computers:
- AES-256 (symmetric encryption, security reduced but not broken, 128 effective bits with Grover’s algorithm)
- SHA-256, SHA-3 (hash functions, security reduced but not broken)
- HMAC (authentication codes)
The critical insight: symmetric cryptography (AES) survives quantum computers with adequate key sizes. Asymmetric cryptography (RSA, ECC) does not survive. Since nearly every system uses asymmetric cryptography for key exchange or signatures, nearly every system needs migration.
The NIST standards (finalized August 2024)
In August 2024, NIST released the first three finalized post-quantum cryptography standards after an eight-year evaluation process:
FIPS 203: ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism)
Previously known as: CRYSTALS-Kyber What it does: Key encapsulation (two parties agree on a shared secret key) Replaces: RSA key exchange, ECDH, Diffie-Hellman Parameter sets: ML-KEM-512, ML-KEM-768, ML-KEM-1024 (increasing security, decreasing performance) Use case: TLS handshakes, VPN key establishment, any scenario where two parties need to establish a shared secret
ML-KEM is the algorithm you will encounter most frequently because key exchange happens in every TLS connection. When your browser connects to a website over HTTPS, the handshake that establishes the encrypted channel currently uses ECDH or RSA. ML-KEM replaces that step.
FIPS 204: ML-DSA (Module-Lattice-Based Digital Signature Algorithm)
Previously known as: CRYSTALS-Dilithium What it does: Digital signatures (proving a message came from a specific sender and was not modified) Replaces: RSA signatures, ECDSA, Ed25519 Parameter sets: ML-DSA-44, ML-DSA-65, ML-DSA-87 Use case: Code signing, certificate signatures, document signing, authentication tokens
ML-DSA is what certificate authorities will use to sign TLS certificates, what operating systems will use to verify software updates, and what authentication systems will use to verify identity.
FIPS 205: SLH-DSA (Stateless Hash-Based Digital Signature Algorithm)
Previously known as: SPHINCS+ What it does: Digital signatures (same purpose as ML-DSA, different mathematical approach) Replaces: Same as ML-DSA Security basis: Hash functions only (no lattice assumptions) Use case: High-assurance environments that want signatures based purely on the security of hash functions, with no dependency on lattice problems
SLH-DSA is slower and produces larger signatures than ML-DSA but relies on a more conservative security assumption (hash functions rather than lattice problems). It exists as a backup in case lattice-based schemes are ever found to be weaker than expected.
What “harvest now, decrypt later” actually means
The concept is straightforward:
- An adversary intercepts and stores encrypted network traffic today (cheap, passive, undetectable)
- The adversary waits until quantum computers can break the encryption (estimated 2030-2035)
- The adversary decrypts the stored data
The critical question is not “when will quantum computers arrive?” It is: “will this data still be sensitive in 5-10 years?”
For most consumer data (shopping, social media), the answer is probably no. For state intelligence, trade secrets, medical records, long-lived credentials, and financial data, the answer is often yes.
This is why organizations need to migrate now, not when quantum computers arrive. The data being transmitted today is already at risk if it will remain sensitive for a decade.
Who has acknowledged this threat:
- NIST (published standards specifically to address it)
- NSA (CNSA 2.0 requires PQC for national security systems by 2030)
- Google (moved internal deadline to 2029, called it “sooner than previously anticipated”)
- Cloudflare (stated they are “actively adjusting quantum priorities” in response to Google’s deadline change)
- Cloud Security Alliance (published specific PQC migration guidance in May 2026)
Who has already shipped PQC
Several major systems already support post-quantum cryptography:
| System | PQC Status | Algorithm | Since |
|---|---|---|---|
| Apple iMessage | Live (PQ3 protocol) | Kyber-1024 (pre-FIPS, equivalent to ML-KEM-1024) | February 2024 |
| Signal | Live (PQXDH) | Kyber-768 | September 2023 |
| Google Chrome | Live (TLS hybrid) | ML-KEM-768 + X25519 | 2024 |
| Cloudflare | Live (TLS hybrid) | ML-KEM-768 + X25519 | 2024 |
| AWS KMS | Live | ML-KEM (hybrid mode) | 2024 |
The pattern: all current deployments use hybrid mode, combining a classical algorithm (X25519 or RSA) with a PQC algorithm (ML-KEM). If either algorithm is secure, the connection is secure. This protects against both quantum attacks and potential undiscovered weaknesses in the new PQC algorithms.
The migration timeline
Based on current government and industry guidance:
| Timeline | What happens |
|---|---|
| 2024 | NIST standards finalized. Early adopters (Apple, Signal, Chrome) ship PQC |
| 2025-2026 | Major cloud providers add PQC support. Migration planning begins |
| 2027-2028 | Compliance frameworks require PQC migration plans |
| 2029 | Google’s internal deadline. Expect pressure on the wider ecosystem |
| 2030 | NSA CNSA 2.0 deadline for national security systems |
| 2030-2035 | Estimated window for cryptanalytically relevant quantum computers |
The gap between “standards finalized” (2024) and “quantum computers arrive” (2030-2035) is the migration window. It sounds long, but migrating cryptography across an enterprise takes years: inventorying all systems, prioritizing, testing, deploying, and validating that nothing broke.
What you need to do (the short version)
- Cryptographic inventory: Identify every system that uses RSA, ECC, or DH for key exchange or signatures
- Data sensitivity assessment: Determine which data will still be sensitive in 10+ years
- Prioritize: Migrate the highest-sensitivity data paths first
- Deploy hybrid mode: Use ML-KEM + classical algorithm together, not replace one with the other immediately
- Test: PQC algorithms have larger key sizes and different performance characteristics, verify nothing breaks
- Monitor: Track vendor support and compliance deadlines for your industry
Why not just upgrade key sizes?
A common misconception: “can’t we just use bigger RSA keys?” No. Shor’s algorithm (the quantum algorithm that breaks RSA) scales polynomially with key size. Doubling the key size does not double the difficulty for a quantum computer. It barely slows it down. The mathematical structure of RSA and ECC is fundamentally vulnerable, regardless of key size.
PQC algorithms are based on entirely different mathematical problems (lattice problems, hash-based constructions) that quantum computers cannot efficiently solve. This is not a key-size fix, it is a complete algorithmic replacement.
FAQ
When will quantum computers actually break encryption?
Most credible estimates say cryptanalytically relevant quantum computers (capable of breaking RSA-2048) will exist between 2030 and 2035. Google’s 2029 deadline suggests they may believe the lower end of that range. Nobody knows for certain.
Do I need to worry about this if I am not a government agency?
If your systems handle data that will be sensitive for 10+ years (trade secrets, medical records, financial data, legal documents), yes. If your data is only sensitive for days or weeks, the urgency is lower but you should still plan for migration because compliance frameworks will eventually require it.
Is PQC slower than current cryptography?
ML-KEM (key exchange) is actually faster than RSA for key generation and encapsulation. Key sizes are larger (ML-KEM-768 public key is 1,184 bytes vs ECDH’s 32 bytes) but operations are fast. ML-DSA (signatures) is slower than Ed25519 but faster than RSA signatures. The main impact is bandwidth (larger keys and signatures) not computation speed.
What is hybrid mode?
Hybrid mode combines a classical algorithm (like X25519) with a PQC algorithm (like ML-KEM) in the same connection. Both must be broken to compromise the session. This protects against quantum attacks (classical algorithm breaks) and potential PQC weaknesses (PQC algorithm breaks). All current production deployments use hybrid mode.
Should I wait for more standards before migrating?
No. FIPS 203/204/205 are finalized. They will not be retracted. Additional standards may come (NIST’s fourth-round candidates), but ML-KEM and ML-DSA are the primary algorithms for migration today. Waiting gains you nothing and extends your exposure window.