Post-quantum cryptography (PQC) is the best available defense against quantum attacks, but it has real limitations: larger key and signature sizes than RSA or ECC, higher performance and bandwidth costs, complex migration across existing systems, and reliance on mathematical assumptions that future cryptanalysis could challenge. These are manageable with careful planning, crypto-agility, and hybrid deployment.
Post-quantum cryptography (PQC) is the most practical defense against future quantum attacks, and NIST has finalized its first standards (ML-KEM, ML-DSA, SLH-DSA). But PQC is not a free upgrade. Its algorithms tend to have larger keys and signatures, higher performance costs, and complex migration paths, and, like all cryptography, they rest on mathematical assumptions. Understanding these limits is key to planning a smooth transition.
Key Takeaways
- PQC’s main limitations are larger key/signature sizes, performance and bandwidth overhead, migration complexity, and reliance on math assumptions that could be challenged by future cryptanalysis.
- The finalized standards (ML-KEM, ML-DSA, SLH-DSA) generally have bigger keys and signatures than RSA and ECC, which affects storage, memory, and bandwidth, especially at scale.
- Resource-constrained and latency-sensitive systems (IoT, embedded, real-time) feel the performance impact most, and some legacy infrastructure may need upgrading.
- Migration is a major undertaking: existing systems, protocols, and libraries must be updated and tested, not just have their algorithms swapped.
- The best responses are crypto-agility (designing systems to switch algorithms easily) and hybrid deployment (pairing PQC with classical algorithms during the transition).
PQC Is the Best Option, but Not a Perfect One
Among the approaches to defending against future quantum computers, post-quantum cryptography is the most favorable and practical, far easier to deploy than Quantum Key Distribution (QKD), and now backed by finalized NIST standards. But acknowledging its limitations is important for realistic planning. Many of these limitations are challenges of cost, size, and complexity rather than fundamental flaws, and most can be managed with the right strategy. Here are the limitations that should not be ignored.
1. Larger Key and Signature Sizes, and Performance
The most tangible limitation is size. The finalized PQC algorithms generally use larger keys, ciphertexts, and signatures than the RSA and elliptic-curve algorithms they replace. ML-KEM has larger public keys and ciphertexts than elliptic-curve key exchange; ML-DSA has considerably larger signatures and keys than ECDSA; and SLH-DSA, the hash-based option, has especially large signatures, which is the price of its conservative security. These larger sizes mean more storage, more memory, and more network bandwidth, and can lengthen encryption, decryption, signing, and verification times.
At small scale the impact may go unnoticed, but as the number of keys and signatures handled at once grows, the cumulative effect on performance becomes significant. Latency-sensitive applications (such as real-time systems and computer vision in autonomous vehicles) and resource-constrained devices (smartphones, IoT, embedded hardware) are the most affected, and aging infrastructure with older hardware may struggle. In some cases, upgrading infrastructure is part of a smooth transition. Because algorithms and their parameter sets differ in efficiency, careful algorithm and parameter selection matters.
2. Migration and Integration Complexity
Moving from classical to post-quantum cryptography is far more than swapping one algorithm for another. Existing systems, applications, and protocols are deeply built around classical algorithms and libraries. Migrating can require significant code changes, updates to cryptographic libraries, and careful compatibility testing across systems that must interoperate. For example, replacing a classical cryptographic library with a PQC one may require reworking how applications call it, then thorough testing to confirm functionality and security are preserved. Across a large organization, discovering everywhere cryptography is used, and updating it all without breaking things, is a substantial, multi-year effort.
3. Rethinking Quantum-Safe Protocols
Beyond individual algorithms, whole protocols need to be adapted to remain secure. This is a broader design task than a simple substitution:
- Key exchange: Key exchange must stay secure against quantum attacks, which is where ML-KEM comes in, but the surrounding protocol also has to accommodate its larger messages.
- Digital signatures: Signatures must remain unforgeable and verifiable, using ML-DSA or SLH-DSA, while protocols and formats absorb their larger sizes.
- Secure communication protocols: Standards like TLS, and the PKI and certificate ecosystem, must be updated to carry post-quantum (and hybrid) algorithms, work that is ongoing across the industry.
4. Reliance on Mathematical Assumptions
Like essentially all modern cryptography, PQC rests on the assumption that certain math problems are hard to solve. The difference from QKD (which is based on physics) is that PQC’s security is mathematical, so there is always a theoretical possibility that future cryptanalysis, classical or quantum, could weaken an algorithm, much as Shor’s algorithm undermined RSA and ECC. This is a genuine long-term consideration, not an immediate threat: the finalized algorithms have survived years of intense public analysis. It is worth noting that lattice-based schemes like ML-KEM and ML-DSA are actually valued for strong security reductions (relating their average-case security to hard worst-case problems), which is a strength, not a weakness. Still, prudent planning assumes algorithms may need to be updated over time.
5. Uncertain Quantum Timeline and Public Trust
Two softer but real limitations remain. First, the timeline is uncertain: no one knows exactly when a cryptographically relevant quantum computer will exist, which makes it harder to justify urgent investment, even though the ‘harvest now, decrypt later‘ threat means long-lived data is already at risk. Second, as with any new technology, building trust takes time; organizations and the public want confidence, backed by standards bodies and track record, before relying fully on new cryptography. The finalization of the NIST standards directly addresses both, giving a concrete basis for planning and a foundation of trust.
How to Manage These Limitations: Crypto-Agility and Hybrid Mode
The limitations above are real but manageable, and two practices are central to handling them:
CRYPTO-AGILITY: design systems so that cryptographic algorithms can be swapped without re-architecting everything. If an algorithm ever needs to be replaced (because of new cryptanalysis or better options), an agile system can adapt quickly. This directly addresses the ‘algorithms may need updating’ limitation.
HYBRID DEPLOYMENT: during the transition, pair a post-quantum algorithm with a classical one (for example, ML-KEM alongside elliptic-curve key exchange) so security holds even if one has an unexpected weakness. NIST encourages hybrid mode for early adoption.
Combined with careful algorithm selection, phased migration, and cryptographic discovery, these practices turn PQC’s limitations into a manageable engineering program rather than a barrier.
How Encryption Consulting Helps
Navigating PQC’s limitations, choosing efficient algorithms and parameters, planning a phased migration, and building crypto-agility, is exactly what Encryption Consulting’s PQC Advisory Services deliver. We provide expert-led cryptographic assessment, a migration strategy aligned to the finalized NIST standards (ML-KEM, ML-DSA, SLH-DSA) and the IR 8547 timeline, and hands-on implementation, including hybrid deployment and performance-aware algorithm selection. Paired with cryptographic discovery and inventory (CBOM), we help you find where cryptography lives and transition without breaking systems. Backed by ISO/IEC 27001:2022 and SOC 2 certified practices.
Frequently Asked Questions
What are the main limitations of post-quantum cryptography?
The main limitations are larger key, ciphertext, and signature sizes than RSA and ECC, which raise storage, memory, and bandwidth needs and can slow operations; performance impact on resource-constrained and latency-sensitive systems; the complexity of migrating existing systems, protocols, and libraries; and reliance on mathematical assumptions that future cryptanalysis could challenge. There are also softer limits like the uncertain quantum timeline and the time needed to build trust. Most are manageable with careful planning, crypto-agility, and hybrid deployment.
Do post-quantum algorithms have larger keys than RSA and ECC?
Generally, yes. The finalized NIST algorithms tend to have larger keys, ciphertexts, or signatures than the classical algorithms they replace. ML-KEM has larger public keys and ciphertexts than elliptic-curve key exchange, ML-DSA has larger signatures and keys than ECDSA, and SLH-DSA (the hash-based option) has especially large signatures as the trade-off for its conservative, well-understood security. These larger sizes affect storage, memory, and bandwidth, which is most noticeable at scale and on constrained devices, so algorithm and parameter selection matters.
Is post-quantum cryptography unbreakable?
No cryptography is provably unbreakable, and PQC is no exception. PQC’s security rests on mathematical problems believed hard for both classical and quantum computers, but there is always a theoretical possibility that future cryptanalysis could weaken an algorithm. This is why the finalized algorithms went through years of public scrutiny, and why crypto-agility, designing systems so algorithms can be replaced easily, is recommended. PQC is a strong, standardized defense, but organizations should plan for the possibility of future updates rather than assume permanence.
Why is migrating to PQC difficult?
Because cryptography is embedded throughout modern systems. Migrating is not just swapping an algorithm; it means discovering everywhere cryptography is used, updating applications, libraries, and protocols, handling larger key and signature sizes, and testing extensively to ensure systems still interoperate and stay secure. Legacy and resource-constrained infrastructure may need upgrades, and the effort spans years across a large organization. This is why starting early, with cryptographic discovery and a phased plan, is strongly recommended rather than waiting.
Is QKD better than PQC because it has fewer limitations?
Not really. Quantum Key Distribution (QKD) is based on physics rather than math, which is appealing in theory, but it has significant practical limitations: it requires specialized quantum hardware and dedicated links, does not scale like software, and real QKD systems have demonstrated hardware vulnerabilities such as photon-number-splitting and faked-state attacks. PQC, by contrast, runs on existing systems, is standardized, and can be deployed everywhere classical cryptography is used. For most organizations, PQC is the practical path, with QKD a niche complement.
How can organizations deal with PQC’s limitations?
The two most important practices are crypto-agility and hybrid deployment. Crypto-agility means designing systems so cryptographic algorithms can be replaced without major re-architecture, which addresses the risk that an algorithm may need updating. Hybrid deployment pairs a post-quantum algorithm with a classical one during the transition, so security holds even if one has a flaw. Combined with careful algorithm and parameter selection, cryptographic discovery, and a phased migration plan, these turn PQC’s limitations into a manageable program.
Plan Around PQC’s Limitations
PQC’s limitations are real but manageable with the right strategy. Explore Encryption Consulting’s PQC Advisory Services to assess your environment, select efficient algorithms, and build a crypto-agile migration roadmap to quantum-safe cryptography.