What Is Post-Quantum Cryptography?

So, what is post-quantum cryptography, in plain terms? Post-quantum cryptography (PQC) is a set of cryptographic algorithms designed to stay secure even against an attacker with a powerful quantum computer. The post-quantum cryptography meaning behind the name is precise: not cryptography that uses quantum mechanics, but cryptography built to survive the era after quantum computers become powerful enough to break the encryption we rely on today.

That distinction matters because the two are often confused. Quantum key distribution uses quantum physics to secure communication. Post-quantum cryptography is the opposite kind of solution: ordinary math, running on ordinary computers, chosen specifically because quantum computers can’t shortcut it the way they can shortcut RSA or elliptic-curve cryptography.

Why quantum computers break today’s encryption #

Most of the encryption protecting the internet today, RSA, Diffie-Hellman, and Elliptic Curve Cryptography (ECC), relies on math problems that are effectively impossible for a classical computer to solve in a reasonable amount of time: factoring huge numbers, or solving the discrete logarithm problem. A sufficiently powerful quantum computer running Shor’s algorithm could solve those same problems efficiently, unraveling the public-key cryptography that underpins secure browsing, authentication, and key exchange.

This isn’t a distant, purely theoretical concern treated as settled science fiction. Experts estimate a cryptographically relevant quantum computer (CRQC), one actually capable of breaking current encryption, could emerge within the next 5 to 15 years. The uncertainty in that estimate is exactly why organizations are being told to act now rather than wait for a firm date.

The threat that makes this urgent today: harvest now, decrypt later #

The most immediate risk isn’t a future attack. It’s one already happening. In a “harvest now, decrypt later” (HNDL) attack, an adversary intercepts and stores encrypted data today, with no ability to read it yet, and simply waits. Once a cryptographically relevant quantum computer exists, that stored data gets decrypted retroactively.

HNDL makes the migration timeline shorter than it looks. If your data needs to stay confidential for 10 years and quantum computers capable of breaking today’s encryption could arrive within that window, the data is already at risk, right now, even though the computer that will eventually crack it doesn’t exist yet. Government secrets, health records, intellectual property, and any information with a long shelf life are the highest-priority targets for this strategy.

What makes an algorithm “post-quantum” #

Answering what is post-quantum cryptography at the algorithm level means looking at the math each scheme relies on. Post-quantum algorithms are built on different mathematical foundations than RSA and ECC, ones that resist both classical and quantum attacks. The most common approaches include:

Code-based cryptography: security based on the difficulty of decoding general linear error-correcting codes.

Lattice-based cryptography: security based on the difficulty of certain problems in high-dimensional lattices. This is the foundation for ML-KEM, the algorithm NIST selected for key exchange.

Hash-based cryptography: security derived from the properties of cryptographic hash functions, used in signature schemes like SLH-DSA.

NIST’s post-quantum cryptography standards #

In 2024, the National Institute of Standards and Technology (NIST) finalized the first three post-quantum cryptography standards after a multi-year, public evaluation process. These standards anchor the post-quantum cryptography meaning in something concrete: three named algorithms enterprises can actually implement, rather than an abstract research goal.

1. FIPS 203, ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism): replaces algorithms like ECDH for establishing a shared secret at the start of an encrypted session.
2. FIPS 204, ML-DSA (Module-Lattice-Based Digital Signature Algorithm): a quantum-resistant replacement for digital signature schemes such as RSA and ECDSA.
3. FIPS 205, SLH-DSA (Stateless Hash-Based Digital Signature Algorithm): a hash-based signature scheme offering an alternative security foundation to ML-DSA.

These standards give vendors, governments, and enterprises a stable target to build toward, which is what turns post-quantum cryptography from a research topic into something with actual migration deadlines.

What Is Post-Quantum Cryptography Migration? A Practical Path #

Migration timelines are converging, even if they don’t all agree on a single year. The NSA is requiring National Security Systems purchases made after January 2027 to be future-proofed for quantum-safe standards. The UK’s NCSC has published migration milestones for 2028, 2031, and 2035. The EU has published its own phased roadmap through 2035. Historically, replacing a cryptographic standard across an industry (3DES to AES, SHA-1 to SHA-2) has taken 5 to 20 years, which is part of why the guidance is to start early rather than wait for a mandate.

The practical migration path looks roughly like this:

Engage vendors and procurement. Post-quantum readiness is becoming a question enterprises ask their suppliers, not just an internal project.

Cryptographic discovery. Identify where RSA, ECC, Diffie-Hellman, certificates, keys, and cryptographic libraries are actually used across applications, infrastructure, and third-party dependencies. This step is consistently described as the slowest and most underestimated part of the whole process.

Prioritize by sensitivity and lifetime. Long-lived, high-value data (intellectual property, government or health records) is the first target for harvest-now-decrypt-later attacks, so it gets migrated first.

Adopt crypto-agility. Build systems that can swap cryptographic algorithms without a full re-engineering effort, since new post-quantum guidance and refinements are still expected as adoption matures.

Test hybrid approaches. Many early implementations pair a classical algorithm with a post-quantum one in the same handshake (for example, X25519 combined with ML-KEM), so the connection stays secure as long as at least one of the two algorithms holds.

Why cryptographic discovery is the hard part #

Nearly every source on PQC migration converges on the same starting point: you cannot migrate cryptography you don’t know you have. Cryptography is embedded deep inside applications, cloud services, network infrastructure, identity systems, and third-party libraries, often invisibly to the teams responsible for it. Before any algorithm swap happens, an organization needs an accurate, structured inventory of where classical cryptography lives today. That inventory is what a Cryptographic Bill of Materials (CBOM) is built to provide, and it’s the practical first step behind nearly every PQC migration plan..

FAQ #