Post-quantum cryptography (PQC) is the family of public-key algorithms designed to stay secure against attackers with large-scale quantum computers. Unlike quantum key distribution, PQC runs on ordinary computers and networks. It is software (and sometimes hardware acceleration) that replaces the mathematics underneath today's key exchanges and digital signatures.
Why today's public-key cryptography is at risk
Almost every secure connection on the internet relies on two hard mathematical problems: factoring large integers (RSA) and computing discrete logarithms (Diffie-Hellman and elliptic-curve cryptography). In 1994 Peter Shor showed that a sufficiently powerful quantum computer can solve both problems efficiently. A machine capable of doing so is known as a cryptographically relevant quantum computer (CRQC).
When a CRQC exists, an attacker will be able to:
- recover session keys from recorded TLS, SSH and VPN handshakes and decrypt the traffic;
- forge digital signatures on software updates, firmware, certificates and documents;
- impersonate servers, services and users whose identities rely on RSA or ECDSA certificates.
Symmetric algorithms such as AES are affected far less. Grover's algorithm gives only a quadratic speed-up, which is countered by using 256-bit keys.
The NIST standards
After an open, multi-year international competition, NIST published the first three post-quantum standards in August 2024:
| Standard | Algorithm | Purpose | Based on |
|---|---|---|---|
| FIPS 203 | ML-KEM | Key encapsulation (replaces ECDH / RSA key transport) | Module lattices |
| FIPS 204 | ML-DSA | Digital signatures (replaces RSA / ECDSA) | Module lattices |
| FIPS 205 | SLH-DSA | Digital signatures, conservative backup | Hash functions |
NIST also approved the stateful hash-based signature schemes LMS and XMSS in SP 800-208. They suit firmware signing, where the signer can reliably track state.
What changes in practice
PQC algorithms have different performance profiles from the algorithms they replace. ML-KEM is very fast, but its public keys and ciphertexts are around a kilobyte each rather than 32 bytes. ML-DSA signatures are a few kilobytes. These sizes affect protocol message limits, certificate chains, constrained devices and network MTUs, which is why migration needs engineering, not just a library upgrade.
Hybrid deployment
Most organisations are adopting PQC in hybrid mode, running a classical algorithm (such as X25519) and a post-quantum algorithm (such as ML-KEM-768) together and combining their outputs. The connection is then secure as long as either algorithm remains unbroken. That protects against unforeseen weaknesses in new algorithms while delivering quantum resistance immediately. The TLS group X25519MLKEM768 is a widely deployed example.
Where to start
- Inventory your cryptography. You cannot migrate what you cannot find.
- Prioritise by data shelf-life and exposure, using Mosca's inequality.
- Deploy hybrid protection first where harvest-now-decrypt-later risk is highest: VPNs and external APIs.
- Re-anchor trust in boot chains and code signing before signature forgery becomes possible.