From Quantum Landscape to Post-Quantum Cryptography

Post-quantum cryptography (PQC) is a new generation of encryption and signature algorithms designed to resist attacks from quantum computers. A future large quantum computer running Shor’s algorithm could break today’s public-key cryptography (RSA, ECC, Diffie-Hellman). In August 2024, NIST finalized the first PQC standards: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA).

Post-quantum cryptography (PQC) is a new generation of cryptographic algorithms built to withstand attacks from quantum computers. A powerful future quantum computer could break the public-key cryptography that secures the internet today, so NIST has standardized quantum-resistant replacements: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA), finalized in August 2024. The migration to these standards is now underway.

Key Takeaways

• Quantum computers threaten today’s public-key cryptography: Shor’s algorithm (1994) can break RSA, ECC, and Diffie-Hellman once a large enough quantum computer exists.
• Post-quantum cryptography (PQC) uses new algorithms, running on ordinary computers, based on math problems believed hard for both classical and quantum machines.
• NIST finalized the first PQC standards in August 2024: FIPS 203 = ML-KEM (key exchange), FIPS 204 = ML-DSA (signatures), FIPS 205 = SLH-DSA (hash-based signatures).
• The ‘harvest now, decrypt later’ threat means encrypted data stolen today could be decrypted once quantum computers mature, so long-lived secrets are already at risk.
• NIST’s draft IR 8547 signals deprecating RSA and ECC after 2030 and disallowing them after 2035, so organizations should begin migrating now.

How Quantum Computers Relate to Cryptography

When Richard Feynman first proposed quantum computers, they seemed like science fiction: fascinating but hard to build. Then in 1994, mathematician Peter Shor changed the security landscape. He devised a way for a sufficiently powerful quantum computer to efficiently break two foundational cryptographic algorithms, RSA and Diffie-Hellman (and, by the same underlying math, Elliptic Curve Cryptography). These algorithms are the guardians of our online secrets, underpinning secure communication and digital signatures.

Shor’s discovery meant that once a large, fault-tolerant quantum computer exists, much of today’s public-key cryptography could be broken. Quantum computers do exist now and can be rented for certain tasks, but they remain far too small to threaten real-world cryptography. The concern is the future. That is why we need post-quantum cryptography: new algorithms that run on ordinary computers but are based on mathematical problems believed to be hard for both classical and quantum machines. Think of it as designing new locks that neither old-school nor super-advanced computers can pick.

Why Should Regular People Care?

Cryptography is woven into everyday life. When you enter a credit card number online, digital signatures confirm you are talking to the right site, and public-key exchange establishes the secret keys that protect the connection, the padlock in your browser. If a powerful quantum computer emerged, those guarantees could weaken: the security behind online transactions, password-recovery systems, and countless other services relies on exactly the algorithms Shor’s method targets. For businesses, the stakes are higher still, since so many systems and so much sensitive data depend on this cryptography. Knowing which of your systems are at risk is the first step.

The ‘Harvest Now, Decrypt Later’ Threat

One reason quantum risk is urgent even though large quantum computers do not yet exist: attackers can record encrypted data today and simply store it, waiting to decrypt it once quantum computers mature. This is called ‘harvest now, decrypt later‘. It means any data that must stay confidential for years, medical records, government secrets, financial and legal data, is effectively at risk right now if it is protected only by quantum-vulnerable algorithms. For long-lived secrets, the quantum threat is not a future problem; it is a present one.

Can Quantum Computers Affect Your Business? Mosca’s Theorem

A useful way to judge urgency is Mosca’s Theorem. It weighs three durations:

• x = shelf-life of the secret. How long your data must stay secret (for example, a few years for a credit card number, or decades for medical records).
• y = migration time. How long it will take your organization to migrate to quantum-safe cryptography (often a protracted effort involving standards, planning, and implementation).
• z = time to a cryptographically relevant quantum computer. How long until a quantum computer capable of breaking current public-key algorithms exists, the most uncertain variable of all.

The theorem’s warning is simple: if x + y > z, your data is at risk before its secrecy expires. In other words, if the time you need to keep data secret plus the time you need to migrate is greater than the time until quantum computers can break your cryptography, you are already behind. Because migration (y) can take years and is under your control, while the quantum timeline (z) is uncertain, the prudent response is to start planning now. Earlier public estimates of z, such as those discussed by Michael Mosca around 2015 to 2017, put a meaningful (though minority) probability of RSA-2048 being broken within a decade or so; those were predictions, not certainties, but they underline the uncertainty that makes waiting risky.

The Standards Are Here: NIST’s Finalized PQC Algorithms

For years, the honest answer to ‘why haven’t post-quantum algorithms been deployed yet?’ was that they were still being standardized. That has changed. NIST began its Post-Quantum Cryptography Standardization process in 2016, receiving 82 submissions. Over several rounds of intense public analysis, many candidates were broken or set aside (the famously broken SIKE was one), which is exactly how rigorous vetting is supposed to work. In August 2024, NIST published the first finalized standards:

Standard	Algorithm (former name)	Purpose
FIPS 203	ML-KEM (Kyber)	Key encapsulation / key exchange
FIPS 204	ML-DSA (Dilithium)	Digital signatures (primary)
FIPS 205	SLH-DSA (SPHINCS+)	Hash-based digital signatures (backup)

ML-KEM (Module-Lattice Key Encapsulation Mechanism) replaces quantum-vulnerable key exchange, while ML-DSA (Module-Lattice Digital Signature Algorithm) is the primary signature standard, both based on structured-lattice problems. SLH-DSA (Stateless Hash-Based Digital Signature Algorithm) provides a signature scheme built on hash functions, giving a mathematically different backup in case lattice methods are ever weakened. A fourth algorithm, FN-DSA (FALCON), is expected as FIPS 206. Together these give organizations standardized, vetted, quantum-resistant tools they can deploy today.

The Migration Clock: NIST IR 8547

Standardization was the starting gun, not the finish line. NIST’s draft internal report IR 8547 lays out a transition timeline for moving off quantum-vulnerable cryptography: the traditional public-key algorithms (RSA, ECDSA, ECDH, and similar) are slated to be deprecated after 2030 and disallowed after 2035. Given that large migrations take years, and given the harvest-now-decrypt-later risk to long-lived data, organizations should be building a roadmap now: discovering where vulnerable cryptography is used, prioritizing high-value and long-lived data, and planning a phased move to ML-KEM and ML-DSA, often via hybrid schemes that combine classical and post-quantum algorithms during the transition.

Why the Transition Takes Care

Moving the world’s cryptography to new algorithms is a major undertaking. Many otherwise-promising post-quantum candidates struggled with practical issues such as large key sizes or large signatures, sometimes reaching impractical proportions, which is why a decade of research focused on finding schemes with manageable sizes and strong security. The multi-round NIST process, in which a number of candidates were broken along the way, reflects a deliberate caution: it is far better to find weaknesses during evaluation than after global deployment. That measured pace is a feature, not a bug, and it is why the finalized standards can be trusted.

A widely cited Deloitte analysis has suggested that a significant share of large enterprises expect competitive or operational impact from quantum computing within a few years; while specific figures vary by source and date, the direction is clear, and it reinforces the case for organizations to assess quantum risk and plan proactively rather than wait.

How Encryption Consulting Helps

Navigating the move to post-quantum cryptography, from discovery to strategy to implementation, is exactly what Encryption Consulting’s PQC Advisory Services are built for. We provide expert-led cryptographic assessment, build a prioritized migration strategy aligned to the finalized NIST standards (ML-KEM, ML-DSA, SLH-DSA) and the IR 8547 timeline, and support hands-on implementation, including hybrid deployments during the transition. Combined with cryptographic discovery and inventory (CBOM), we help you find where quantum-vulnerable algorithms live and move to quantum-safe cryptography with confidence. Backed by ISO/IEC 27001:2022 and SOC 2 certified practices.

Frequently Asked Questions

What is post-quantum cryptography?

Post-quantum cryptography (PQC) is a set of cryptographic algorithms designed to resist attacks from quantum computers. Unlike quantum cryptography, PQC runs on ordinary classical computers, but it is based on mathematical problems believed to be hard for both classical and quantum machines. It exists because a powerful future quantum computer could break today’s public-key algorithms like RSA and ECC. In August 2024, NIST finalized the first PQC standards: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA).

How do quantum computers threaten current cryptography?

In 1994, Peter Shor showed that a sufficiently powerful quantum computer could efficiently break the math behind widely used public-key algorithms, RSA, Diffie-Hellman, and Elliptic Curve Cryptography, which secure most online communication and digital signatures. Symmetric algorithms like AES and hash functions like SHA-256 are far less affected (a quantum algorithm called Grover’s only weakens them modestly). The main quantum threat is to public-key cryptography, which is why the finalized PQC standards focus on quantum-resistant key exchange and signatures.

What are FIPS 203, 204, and 205?

They are the first finalized NIST post-quantum cryptography standards, published in August 2024. FIPS 203 is ML-KEM (formerly Kyber), used for key encapsulation and key exchange. FIPS 204 is ML-DSA (formerly Dilithium), the primary digital signature standard. FIPS 205 is SLH-DSA (formerly SPHINCS+), a hash-based signature scheme that serves as a mathematically different backup. ML-KEM and ML-DSA are based on structured-lattice problems. A fourth algorithm, FN-DSA (FALCON), is expected to follow as FIPS 206.

What is ‘harvest now, decrypt later’?

It is a threat model in which attackers record encrypted data today and store it, intending to decrypt it later once quantum computers become powerful enough to break the encryption. This matters because data that must remain confidential for many years, such as medical, financial, government, or legal records, is effectively at risk now if it is protected only by quantum-vulnerable algorithms like RSA or ECC. It is a key reason to begin migrating to post-quantum cryptography before large quantum computers actually exist.

When do organizations need to migrate to PQC?

The migration is already beginning. NIST’s draft IR 8547 indicates that traditional public-key algorithms such as RSA and ECC are slated to be deprecated after 2030 and disallowed after 2035. Because large cryptographic migrations take years and the ‘harvest now, decrypt later’ threat puts long-lived data at risk today, organizations should start now by discovering where vulnerable cryptography is used, prioritizing sensitive and long-lived data, and planning a phased transition to ML-KEM and ML-DSA, often using hybrid classical-plus-PQC schemes during the changeover.

Is Mosca’s Theorem still relevant?

Yes. Mosca’s Theorem frames quantum urgency around three durations: how long data must stay secret (x), how long migration takes (y), and how long until a quantum computer can break current cryptography (z). If x plus y is greater than z, your data is at risk before its secrecy expires. Because migration time is significant and the quantum timeline is uncertain, the theorem argues for acting now rather than waiting, which is even more compelling today because the replacement standards have been finalized and are ready to deploy.

Start Your Post-Quantum Journey

The standards are finalized and the migration clock is running. Explore Encryption Consulting’s PQC Advisory Services to assess your quantum risk, build a migration roadmap aligned to NIST’s finalized standards, and move to quantum-safe cryptography with expert guidance.