Working of Post-Quantum Cryptography

Post-quantum cryptography (PQC) works by using mathematical problems that are hard for both classical and quantum computers to solve, such as structured-lattice problems. Unlike today’s RSA and ECC, these cannot be broken by Shor’s algorithm. PQC runs on ordinary computers. NIST’s finalized standards are FIPS 203 (ML-KEM) for key exchange and FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for signatures.

Post-quantum cryptography (PQC) works by replacing the math behind today’s public-key cryptography with new problems that even quantum computers cannot solve efficiently. Where RSA and ECC rely on factoring and discrete logarithms (which Shor’s algorithm breaks), PQC uses families like structured lattices and hash-based constructions. It runs on ordinary computers, and the finalized NIST standards are FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA).

First, an Important Distinction: PQC Is Not QKD

Two very different things are often confused. Post-quantum cryptography (PQC) is a set of classical, mathematics-based algorithms that run on ordinary computers and hardware, and resist attacks from quantum computers; this is what NIST standardized in FIPS 203, 204, and 205. Quantum cryptography, usually Quantum Key Distribution (QKD), is different: it uses the physics of light (photons) and special hardware to distribute keys, and its security rests on the laws of physics rather than on hard math problems. This article focuses on how PQC works, which is the practical, standardized path most organizations will adopt. QKD is covered briefly at the end as a related but separate technology.

Key Takeaways

• PQC works by basing cryptography on math problems believed hard for both classical and quantum computers, unlike RSA and ECC, which Shor’s algorithm breaks.
• PQC runs on ordinary computers and hardware; it does not require quantum devices.
• The main PQC families are lattice-based, hash-based, code-based, and multivariate; NIST’s chosen standards are lattice-based and hash-based.
• NIST finalized the first PQC standards in August 2024: FIPS 203 (ML-KEM) for key exchange, FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for signatures.
• PQC is different from Quantum Key Distribution (QKD): PQC is math-based software; QKD is physics-based and needs special hardware.

Why Post-Quantum Cryptography Is Needed

Today’s public-key cryptography, RSA, Elliptic Curve Cryptography (ECC), and Diffie-Hellman, keeps the internet secure by relying on math problems that ordinary computers cannot solve in a reasonable time: factoring huge numbers and computing discrete logarithms. In 1994, Peter Shor showed that a sufficiently powerful quantum computer could solve exactly those problems efficiently, which would break RSA and ECC. Symmetric algorithms like AES and hash functions like SHA-256 are far less affected (a quantum algorithm called Grover’s only weakens them modestly, and larger key sizes compensate). So the quantum threat is squarely aimed at public-key cryptography, and post-quantum cryptography exists to replace it with algorithms that quantum computers cannot break.

How PQC Works: Hard Problems, Not Physics

The core idea of PQC is to build cryptography on mathematical problems that remain hard even for quantum computers. There is no single approach; instead there are several families, each based on a different kind of hard problem:

• Lattice-based: Based on the difficulty of finding short vectors or solving equations in high-dimensional lattices (Learning With Errors and Module-LWE). Lattice schemes offer a strong balance of security, key size, and speed, which is why NIST’s primary standards are lattice-based.
• Hash-based: Built only on the security of cryptographic hash functions (like SHA-2/SHA-3). Because they rely on very well-understood hashing, they are seen as a conservative, high-confidence option, especially for signatures.
• Code-based: Based on the difficulty of decoding general error-correcting codes, an approach studied since the 1970s (McEliece). Very well-vetted, though often with large key sizes.
• Multivariate: Based on the hardness of solving systems of multivariate polynomial equations. Useful for some signature schemes, though several have been broken, underscoring the need for careful evaluation.

In every case, the principle is the same: choose a problem that is easy to use for legitimate parties (who hold a key) but computationally infeasible to reverse, even with a quantum computer. Because these are mathematical, PQC algorithms are ordinary software that can run on the computers, servers, phones, and devices we already use.

The Finalized NIST PQC Standards

After a multi-year, multi-round evaluation that began in 2016, NIST finalized the first post-quantum standards in August 2024. These are the algorithms that define how PQC works in practice:

Standard	Algorithm (former name)	Type	Purpose
FIPS 203	ML-KEM (Kyber)	Lattice-based	Key encapsulation / key exchange
FIPS 204	ML-DSA (Dilithium)	Lattice-based	Digital signatures (primary)
FIPS 205	SLH-DSA (SPHINCS+)	Hash-based	Digital signatures (backup)

ML-KEM (Module-Lattice Key Encapsulation Mechanism) is used to establish shared secret keys securely, the post-quantum replacement for quantum-vulnerable key exchange. ML-DSA (Module-Lattice Digital Signature Algorithm) is the primary standard for digital signatures. SLH-DSA (Stateless Hash-Based Digital Signature Algorithm) provides a signature scheme built on hash functions, a mathematically different backup in case lattice methods are ever weakened. A fourth algorithm, FN-DSA (FALCON), is expected to follow as FIPS 206. In real deployments these are often rolled out in hybrid mode, pairing a post-quantum algorithm with a classical one so security holds even if one has an unexpected flaw during the transition.

Where PQC Is Applied

Because PQC is a drop-in replacement for existing public-key cryptography, it applies wherever that cryptography is used today:

• Financial services: Protecting online transactions and sensitive data in finance, so recorded traffic cannot be decrypted later by a quantum computer.
• Government and defense: Securing long-lived government and military secrets, which are the most exposed to ‘harvest now, decrypt later‘.
• Healthcare: Safeguarding patient records and research that must stay confidential for decades.
• IoT and devices: Securing device communications and firmware/code signing, including for constrained IoT devices.
• Internet infrastructure: TLS, VPNs, PKI, and certificates, the plumbing of secure communication, are being updated to support PQC and hybrid modes.

A Related but Different Technology: Quantum Key Distribution (QKD)

It is worth understanding QKD, because it is often confused with PQC. QKD is not math-based software; it uses the physics of quantum mechanics to let two parties (traditionally called Alice and Bob) share a secret key, with the property that any eavesdropper (Eve) disturbs the quantum states and can therefore be detected. Two well-known protocols illustrate it:

• BB84 (uncertainty principle): Uses the polarization of single photons. Alice encodes bits using randomly chosen polarizer settings; Bob measures with his own random settings; they keep only the bits where their settings matched. Because measuring a photon disturbs it (Heisenberg’s uncertainty principle), an eavesdropper introduces detectable errors. Related variants include B92 (two states), SSP (six states), and SARG04.

• E91 (entanglement): Uses pairs of entangled photons shared between Alice and Bob. Their measurements are correlated, and a statistical test (based on Bell’s inequality) reveals whether an eavesdropper is present.

QKD is powerful in theory, but it is not unconditionally secure in practice: real hardware has vulnerabilities. The article’s own examples, the Photon Number Splitting (PNS) attack (where an eavesdropper skims photons from multi-photon pulses) and faked-state attacks (where an eavesdropper spoofs the detector), show that implementation details matter. QKD also requires specialized hardware and dedicated links, which limits its reach. For most organizations, PQC, standardized, software-based, and deployable on existing systems, is the practical route to quantum resistance, while QKD remains a specialized complement in specific high-security settings.

PQC vs QKD at a Glance

PQC: classical math-based algorithms (lattice, hash-based, etc.); runs on ordinary computers and networks; standardized by NIST (FIPS 203/204/205); a drop-in replacement for RSA/ECC.

QKD: physics-based key distribution using photons; needs special quantum hardware and dedicated links; security based on the laws of physics but limited by real-world implementation; a niche complement, not a general replacement.

How Encryption Consulting Helps

Understanding how PQC works is the first step; deploying it is the real work. Encryption Consulting’s PQC Advisory Services provide expert-led cryptographic assessment, a migration strategy aligned to the finalized NIST standards (ML-KEM, ML-DSA, SLH-DSA) and the IR 8547 timeline, and hands-on implementation, including hybrid deployments. Paired with cryptographic discovery and inventory (CBOM), we help you find where quantum-vulnerable algorithms live and move to quantum-safe cryptography with confidence. Backed by ISO/IEC 27001:2022 and SOC 2 certified practices.

Frequently Asked Questions

How does post-quantum cryptography work?

Post-quantum cryptography works by basing encryption and signatures on mathematical problems that are believed hard for both classical and quantum computers, such as finding short vectors in high-dimensional lattices. Unlike RSA and ECC, whose underlying problems (factoring and discrete logarithms) can be solved by Shor’s algorithm on a quantum computer, these new problems resist quantum attack. PQC runs as ordinary software on existing computers. NIST’s finalized standards include ML-KEM (FIPS 203) for key exchange and ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for signatures.

Is post-quantum cryptography the same as quantum cryptography?

No, they are different. Post-quantum cryptography (PQC) is classical, math-based algorithms that run on ordinary computers and resist quantum attacks; this is what NIST standardized. Quantum cryptography, usually Quantum Key Distribution (QKD), uses the physics of photons and special hardware to distribute keys, with security based on the laws of physics. PQC is a practical, software-based, drop-in replacement for today’s public-key cryptography, while QKD is a specialized hardware technology used in niche high-security settings. The terms are often confused but are not interchangeable.

What math problems is PQC based on?

PQC uses several families of hard problems. Lattice-based schemes (like ML-KEM and ML-DSA) rely on the difficulty of problems in high-dimensional lattices, such as Learning With Errors, and offer a strong balance of security and performance. Hash-based schemes (like SLH-DSA) rely only on the security of hash functions. Code-based schemes rely on decoding error-correcting codes, and multivariate schemes rely on solving systems of polynomial equations. NIST’s primary standards are lattice-based, with a hash-based option as a conservative backup.

What are the NIST post-quantum standards?

NIST finalized the first post-quantum cryptography standards in August 2024. FIPS 203 is ML-KEM (formerly Kyber), a lattice-based algorithm for key encapsulation and key exchange. FIPS 204 is ML-DSA (formerly Dilithium), a lattice-based algorithm and the primary signature standard. FIPS 205 is SLH-DSA (formerly SPHINCS+), a hash-based signature scheme that serves as a mathematically different backup. A fourth algorithm, FN-DSA (FALCON), is expected as FIPS 206. These are the algorithms organizations should adopt to become quantum-resistant.

Does PQC require special hardware?

No. That is one of its main advantages over Quantum Key Distribution. Post-quantum cryptography is implemented in software using standard mathematics, so it runs on the computers, servers, phones, and devices already in use. This makes it a practical, scalable replacement for existing public-key cryptography, deployable through software and firmware updates and existing protocols like TLS. Quantum Key Distribution, by contrast, requires specialized quantum hardware and dedicated communication links, which limits where it can be used.

Is QKD more secure than PQC?

Not in a way that makes it the better general choice. QKD’s security is based on the laws of physics, which is appealing in theory, but real QKD hardware has demonstrated vulnerabilities (such as photon-number-splitting and faked-state attacks), and it requires specialized equipment and dedicated links. PQC is standardized, runs on ordinary systems, and can be deployed everywhere existing cryptography is used. For the vast majority of organizations, PQC is the practical path to quantum resistance, while QKD remains a niche complement for specific high-security scenarios.

Put Post-Quantum Cryptography to Work

Knowing how PQC works is the start; the finalized standards are ready to deploy today. Explore Encryption Consulting’s PQC Advisory Services to assess your quantum risk and build a migration roadmap to ML-KEM, ML-DSA, and SLH-DSA.