Post-Quantum Cryptography(PQC)
Cryptographic algorithms designed to remain secure against attacks from sufficiently powerful quantum computers, using mathematical problems believed to be hard even for quantum algorithms like Shor's algorithm.
Post-quantum cryptography (PQC) refers to cryptographic algorithms built to resist attacks from quantum computers. It is distinct from "quantum cryptography," which uses quantum mechanical effects directly (for example, quantum key distribution).
Why it matters
Most of today's public-key cryptography, including RSA, Diffie-Hellman, and elliptic-curve cryptography (ECC), relies on mathematical problems (integer factorization, discrete logarithms) that are computationally infeasible for classical computers but would be efficiently solvable by a sufficiently large, fault-tolerant quantum computer running Shor's algorithm. Symmetric cryptography (AES) and hash functions are considered far more quantum-resistant, requiring only larger key/output sizes (per Grover's algorithm) rather than replacement.
No quantum computer today is large or stable enough to break production RSA or ECC key sizes. The migration urgency comes from two separate pressures:
- Harvest now, decrypt later: adversaries can record encrypted traffic today and decrypt it once a capable quantum computer exists, which matters for any data that must stay confidential for years to decades.
- Migration lead time: replacing cryptography across an organization's systems, protocols, and supply chain realistically takes years, so waiting until quantum computers are a live threat leaves no runway.
The NIST standards
In August 2024, NIST finalized the first three PQC standards:
- FIPS 203 (ML-KEM): a lattice-based key-encapsulation mechanism, derived from CRYSTALS-Kyber, used for establishing shared secrets (e.g., in TLS).
- FIPS 204 (ML-DSA): a lattice-based digital signature scheme, derived from CRYSTALS-Dilithium.
- FIPS 205 (SLH-DSA): a hash-based signature scheme, derived from SPHINCS+, offered as a conservative backup with different security assumptions than lattice-based schemes.
A fourth algorithm, HQC, was selected in 2025 as a backup KEM based on a different mathematical foundation (code-based cryptography) in case weaknesses are later found in lattice-based approaches.
Migration approach
Most near-term deployments use hybrid schemes, combining a classical algorithm (e.g., X25519) with a PQC algorithm (e.g., ML-KEM) so that breaking either alone is insufficient to compromise the connection. This is the approach already shipped in Chrome, Firefox, and OpenSSH for key exchange.