Introduction to Post-Quantum Cryptography

Post-Quantum Cryptography (PQC) is cryptography designed to resist attacks from both classical and quantum computers. It replaces algorithms like RSA and ECC, which a future quantum computer could break, with new quantum-resistant standards: ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205).

Post-Quantum Cryptography (PQC) is a new generation of cryptographic algorithms built to withstand attacks from quantum computers. Today’s public-key algorithms, such as RSA and elliptic-curve cryptography, could be broken by a powerful quantum computer running Shor’s algorithm. In 2024, NIST finalized the first PQC standards, ML-KEM, ML-DSA, and SLH-DSA, and organizations are now migrating to them.

Key Takeaways

• Post-Quantum Cryptography (PQC) is cryptography designed to resist attacks from quantum computers, replacing quantum-vulnerable algorithms like RSA and ECC.
• Quantum computers use qubits and, with Shor’s algorithm, could break the public-key cryptography that secures most of the internet today.
• In August 2024, NIST finalized the first three PQC standards: ML-KEM (FIPS 203) for key encapsulation, ML-DSA (FIPS 204) for digital signatures, and SLH-DSA (FIPS 205) for hash-based signatures.
• The threat is present, not just future: encrypted data captured today could be decrypted later once quantum computers mature, a ‘harvest now, decrypt later’ attack.
• Symmetric cryptography (AES-256) and hashing (SHA-384 and above) remain secure; the migration is primarily about replacing public-key algorithms.

Why Quantum Computers Threaten Today’s Cryptography

Modern digital security rests on a small set of public-key algorithms, chiefly RSA and elliptic-curve cryptography (ECC). Their security depends on mathematical problems, such as factoring very large numbers, that classical computers cannot solve in any practical amount of time. A classical computer would need longer than the age of the universe to factor a 2048-bit RSA key.

Quantum computers change this. A sufficiently powerful, fault-tolerant quantum computer running Shor’s algorithm could solve those same problems efficiently, breaking RSA and ECC. That would undermine the confidentiality and authentication that protect web traffic, financial transactions, digital signatures, and stored data. The point is not that today’s math was wrong, but that a fundamentally different kind of computer changes what is feasible to compute.

A quick primer on qubits

Classical computers store information in bits, each either 0 or 1. Quantum computers use quantum bits, or qubits, which can exist in a superposition of both states at once. Qubits can also become entangled, so their states are correlated in ways classical bits cannot be. Together, superposition and entanglement let a quantum computer explore many possibilities simultaneously, which is what makes certain problems, including the ones underpinning RSA and ECC, tractable that were previously infeasible. The concept traces back to Richard Feynman, who in 1981 proposed using quantum systems to simulate physics that classical machines struggle to model.

What Is Post-Quantum Cryptography?

Post-Quantum Cryptography (PQC), also called quantum-resistant or quantum-safe cryptography, is a family of cryptographic algorithms designed to remain secure against both classical and quantum computers. Crucially, PQC runs on the ordinary computers, servers, and devices we already use; it does not require a quantum computer. It simply relies on different underlying mathematical problems, ones that neither classical nor quantum computers are known to solve efficiently.

This distinguishes PQC from quantum cryptography (such as quantum key distribution), which uses quantum physics itself to protect data and needs specialized hardware. PQC is the practical, deployable path for protecting existing systems, which is why it is the focus of global standardization.

The NIST PQC Standards (Finalized 2024)

After an eight-year global competition that began in 2016, the National Institute of Standards and Technology (NIST) finalized the first post-quantum cryptography standards in August 2024. These are no longer research proposals; they are published federal standards that organizations are actively adopting. The first three are:

Standard	Algorithm	Purpose	Based on
FIPS 203	ML-KEM (formerly Kyber)	Key encapsulation and key exchange	Lattice (module learning with errors)
FIPS 204	ML-DSA (formerly Dilithium)	General-purpose digital signatures	Lattice
FIPS 205	SLH-DSA (formerly SPHINCS+)	Hash-based digital signatures	Hash functions

ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) is the primary replacement for RSA and ECC key exchange. ML-DSA (Module-Lattice-Based Digital Signature Algorithm) is the primary replacement for RSA and ECDSA signatures. SLH-DSA (Stateless Hash-Based Digital Signature Algorithm) provides a signature option based on a completely different mathematical foundation, valued as a conservative backup. A fourth standard, FN-DSA (FIPS 206), based on the FALCON algorithm, is expected to follow. For a deeper look, see EC’s dedicated explainers on ML-KEM, ML-DSA, and SLH-DSA.

The Families of Post-Quantum Cryptography

PQC algorithms draw their security from several different families of hard mathematical problems. Diversity here is deliberate: if one family is later weakened, others remain. The main families are:

• Lattice-based cryptography: Built on the difficulty of problems in high-dimensional lattices. It offers a strong balance of security and performance, which is why ML-KEM and ML-DSA, the primary NIST standards, are lattice-based.
• Hash-based cryptography: Builds signatures purely from the security of hash functions, one of the most conservative and well-understood foundations. SLH-DSA is hash-based, as are the stateful schemes LMS and XMSS used for firmware signing.
• Code-based cryptography: Relies on the difficulty of decoding general error-correcting codes, a problem studied since the 1970s. It tends to have large keys but a long track record.
• Multivariate cryptography: Based on the difficulty of solving systems of multivariate polynomial equations. An active research area, though several schemes have been broken.

The Threat Is Already Here: Harvest Now, Decrypt Later

A common misconception is that the quantum threat can wait until quantum computers arrive. It cannot, because of harvest now, decrypt later attacks. An adversary can capture encrypted data today, store it, and simply wait until a quantum computer capable of breaking the encryption exists, then decrypt it. Any data whose sensitivity outlasts the arrival of quantum computing, such as health records, financial data, state secrets, and intellectual property, is effectively at risk now. This is why organizations are urged to begin migrating well before a cryptographically relevant quantum computer is built.

What Stays Secure

Not all cryptography is equally threatened. The quantum impact falls very differently on different types:

• Public-key cryptography (at risk): RSA, ECC, Diffie-Hellman, and ECDSA are all broken by Shor’s algorithm and must be replaced. This is the focus of the PQC migration.
• Symmetric encryption (largely safe): AES is only modestly affected. Grover’s algorithm halves effective key strength, so AES-256 retains about 128 bits of security and remains secure.
• Hash functions (largely safe): SHA-256, SHA-384, and SHA-3 remain secure at appropriate output sizes, with SHA-384 and above recommended for the highest assurance.

Challenges in the Transition to PQC

Migrating to post-quantum cryptography is a significant undertaking, and several challenges shape it:

• Larger keys and signatures: PQC algorithms generally have larger keys and signatures than RSA or ECC, which can affect bandwidth, storage, and performance in constrained environments.
• Performance: Some PQC operations are more computationally demanding, requiring testing in real workloads before deployment.
• Discovery and inventory: Most organizations do not know everywhere they use vulnerable cryptography. You cannot migrate what you cannot see, so a cryptographic inventory is the essential first step.
• Crypto-agility: Systems must be built so algorithms can be swapped without re-engineering, because standards will keep evolving. Hybrid modes that combine a classical and a post-quantum algorithm are common during the transition.
• Migration complexity: Existing infrastructure is deeply tied to classical algorithms, so the transition takes careful, prioritized planning across many systems.

How Encryption Consulting Helps

The move to post-quantum cryptography is one of the largest cryptographic transitions in decades, and it is easier with a clear roadmap. Encryption Consulting’s Post-Quantum Cryptography Advisory Services provide risk assessment, cryptographic discovery, and a prioritized migration strategy aligned to the finalized NIST standards, helping you identify where RSA and ECC are used, prioritize by risk and data longevity, and adopt ML-KEM, ML-DSA, and SLH-DSA with the crypto-agility to keep adapting. For the step-by-step path, see our post-quantum migration guide. Backed by ISO/IEC 27001:2022 and SOC 2 certified practices.

Frequently Asked Questions

What is post-quantum cryptography in simple terms?

Post-quantum cryptography (PQC) is a new set of encryption and signature methods designed to stay secure even against quantum computers. Today’s protections, like RSA, could be broken by a powerful quantum computer, so PQC replaces them with algorithms based on math problems that quantum computers are not known to solve. Importantly, PQC runs on the regular computers and devices we already use; it does not require any quantum hardware.

What are the NIST post-quantum cryptography standards?

In August 2024, NIST finalized its first three PQC standards. FIPS 203 is ML-KEM (formerly Kyber), used for key encapsulation and key exchange. FIPS 204 is ML-DSA (formerly Dilithium), used for general-purpose digital signatures. FIPS 205 is SLH-DSA (formerly SPHINCS+), a hash-based signature scheme. ML-KEM and ML-DSA are lattice-based and are the primary replacements for RSA and ECC. A fourth standard, FN-DSA (FIPS 206), based on FALCON, is expected to follow.

Why is post-quantum cryptography needed now if quantum computers cannot break encryption yet?

Because of harvest-now-decrypt-later attacks. An adversary can capture encrypted data today and store it until a quantum computer capable of decrypting it exists, then break it retroactively. Any data that must stay confidential for years, such as health, financial, or government records, is effectively at risk today. Migration also takes years across large organizations, so starting early is essential to be ready before a cryptographically relevant quantum computer arrives.

Does quantum computing break all encryption?

No. Quantum computing primarily threatens public-key cryptography such as RSA, ECC, and Diffie-Hellman, which Shor’s algorithm can break. Symmetric encryption like AES is far more resistant: Grover’s algorithm only halves effective key strength, so AES-256 remains secure. Hash functions such as SHA-256 and SHA-384 also remain secure at appropriate sizes. The post-quantum migration is therefore focused mainly on replacing public-key algorithms, not symmetric encryption or hashing.

What is the difference between post-quantum cryptography and quantum cryptography?

Post-quantum cryptography (PQC) uses new mathematical algorithms that run on ordinary classical computers and resist quantum attacks; it is the practical path for protecting today’s systems. Quantum cryptography, such as quantum key distribution (QKD), uses the principles of quantum physics itself to secure data and requires specialized quantum hardware. PQC is software-based and widely deployable, while quantum cryptography is hardware-dependent and used in niche, high-security settings.

How do organizations start migrating to post-quantum cryptography?

The first step is a cryptographic inventory: discovering everywhere RSA, ECC, and other vulnerable algorithms are used across systems, applications, and devices. From there, organizations prioritize migration by risk and data longevity, adopt the NIST standards (ML-KEM, ML-DSA, SLH-DSA), often use hybrid classical-plus-quantum modes during the transition, and build crypto-agility so algorithms can be updated later. A structured assessment and roadmap, such as EC’s PQC Advisory Services, makes the process manageable.

Start Your Post-Quantum Journey

The NIST standards are final, the threat is present, and the migration takes time. Explore Encryption Consulting’s PQC Advisory Services for a risk assessment and a migration roadmap aligned to ML-KEM, ML-DSA, and SLH-DSA, or read our post-quantum migration guide to plan your first steps.