What Is Post-Quantum Cryptography?

Almost every secure connection made today relies on public-key cryptography whose security rests on two mathematical problems being hard: factoring large integers, and computing discrete logarithms. RSA depends on the first. Diffie-Hellman and elliptic-curve cryptography depend on the second.

A sufficiently large quantum computer running Shor's algorithm solves both efficiently. Not faster in a way that could be met with longer keys — efficiently, in a way that removes the security assumption entirely.

Post-quantum cryptography is the response:

Post-quantum cryptography is a set of cryptographic algorithms that run on ordinary classical computers but are designed to resist attack by both classical and quantum computers.

The most common misunderstanding is in that definition. PQC does not use quantum physics. It runs on the same servers and laptops as today's cryptography. It simply rests on mathematical problems that no known quantum algorithm solves efficiently.

This article covers what actually breaks, what does not, the standards published so far, why migration is urgent despite the threat being prospective, and how PQC differs from quantum cryptography.

What Breaks and What Does Not

The impact is uneven, and this is the detail most often lost.

Public-Key Cryptography Breaks

Shor's algorithm (1994) efficiently factors integers and computes discrete logarithms. That directly undermines:

  • RSA — key exchange and signatures
  • Diffie-Hellman — key exchange
  • Elliptic-curve cryptography (ECDSA, ECDH) — signatures and key exchange, including the curves used across TLS, SSH, and most cryptocurrencies

These are the algorithms that establish session keys and prove identity. Losing them means an attacker can decrypt intercepted sessions and forge signatures.

Symmetric Cryptography Mostly Survives

Grover's algorithm speeds up unstructured search, which applies to brute-forcing a symmetric key. But the speedup is quadratic rather than exponential — it roughly halves the effective key length.

Practically: AES-128 drops to about 64 bits of quantum security, which is uncomfortable. AES-256 drops to about 128 bits, which remains far out of reach. Hash functions are affected similarly, so SHA-256 remains reasonable and SHA-384 or SHA-512 more comfortable.

The upgrade path here is simply longer keys, which is why the migration conversation centres on public-key algorithms.

The Timing Problem: Harvest Now, Decrypt Later

The obvious objection is that no quantum computer today can run Shor's algorithm at the scale required. Current machines have limited numbers of noisy physical qubits, while estimates for factoring RSA-2048 call for millions of them once error correction overhead is counted.

So why migrate now?

Because encrypted traffic can be recorded today and decrypted later. An adversary with storage and patience can capture traffic now and hold it until a capable machine exists. This is generally called harvest now, decrypt later.

That reframes the deadline. The relevant question is not when a quantum computer will arrive, but:

How long does your data need to stay confidential? Medical records, state secrets, legal archives, and identity documents may need decades of protection. If your data must remain secret for twenty years, an attacker only needs a capable machine within twenty years for today's traffic to be exposed.

How long will your migration take? Replacing cryptography across an organization is measured in years, not months. Embedded devices, hardware security modules, certificate hierarchies, and vendor dependencies all move slowly.

Add those together and the migration window for long-lived secrets has already closed for some organizations. This is why standards bodies pushed on timing well before any machine posed a practical threat.

The Standards

NIST ran an open competition beginning in 2016, soliciting and publicly analysing candidate algorithms over several rounds — an important process detail, since cryptographic confidence comes from sustained public cryptanalysis rather than from any authority's endorsement.

In August 2024, NIST published the first three finalized standards:

FIPS 203 — ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism), derived from CRYSTALS-Kyber. The primary standard for key establishment, and the one most deployments encounter first.

FIPS 204 — ML-DSA (Module-Lattice-Based Digital Signature Algorithm), derived from CRYSTALS-Dilithium. The general-purpose signature standard.

FIPS 205 — SLH-DSA (Stateless Hash-Based Digital Signature Algorithm), derived from SPHINCS+. Signatures based only on hash-function security, providing a fallback whose assumptions differ entirely from the lattice-based schemes.

A fourth signature scheme derived from FALCON was also selected for later publication, and in March 2025 NIST selected HQC — a code-based scheme — as a backup key-encapsulation mechanism whose mathematical foundation differs from ML-KEM's.

The pattern is deliberate: multiple algorithms resting on different hard problems, so a breakthrough against lattices does not leave the field without options.

Hybrid Deployment

Most real-world rollouts have not simply replaced classical algorithms. They combine them.

A hybrid key exchange performs both a classical exchange (such as X25519) and a post-quantum one (such as ML-KEM), then derives the session key from both. The result is secure unless both are broken.

The reasoning is straightforward. PQC algorithms are newer and have accumulated less cryptanalysis than the classical schemes they replace. Hybrid deployment means adopting them early costs nothing in security even if a weakness is later found — a genuine possibility, since at least one candidate in NIST's competition was broken during the process.

This is why deployed configurations pair the two rather than switching outright, and it is the recommended default for most migrations.

Where It Is Already Deployed

Post-quantum key exchange has been shipping in mainstream software for some time, generally in hybrid form and often invisibly.

Major browsers and content delivery networks enabled hybrid post-quantum key exchange for TLS connections, initially pairing X25519 with Kyber and later with the standardized ML-KEM. Messaging applications have added post-quantum key agreement to their protocols. OpenSSH added a post-quantum hybrid key exchange method and later made it a default.

The practical implication for most people is that some fraction of their encrypted browsing is already protected against harvest-now-decrypt-later without any action on their part — provided both endpoints support it.

Signatures are lagging behind key exchange. Certificate hierarchies are slower to change, and post-quantum signatures are considerably larger than ECDSA ones, which has real consequences for handshake size.

What Migration Actually Involves

Inventory first. Most organizations do not have a complete picture of where cryptography is used — in applications, embedded devices, third-party services, and hardware modules. You cannot migrate what you have not found, and inventory is usually the longest phase.

Prioritize by data lifetime. Systems handling data that must stay confidential for decades are the genuine urgency. A session token expiring in an hour is not.

Adopt hybrid where available. It is the low-risk path and is what most standards guidance recommends.

Plan for larger keys and signatures. Post-quantum keys and signatures are bigger than their elliptic-curve equivalents. This affects handshake sizes, certificate chains, packet fragmentation, and constrained devices — sometimes in ways that surface only under load.

Build crypto-agility. The deeper lesson is that hard-coded algorithms are the actual problem. Systems that can swap cryptographic primitives through configuration will handle the next transition far better than those requiring code changes, and there will be a next transition.

PQC Versus Quantum Cryptography

These sound alike and are frequently confused, but they are different things.

Post-quantum cryptography is mathematics. Classical algorithms, classical hardware, chosen because no efficient quantum attack is known. It works over existing networks and requires no new equipment.

Quantum cryptography, in practice usually quantum key distribution (QKD), uses quantum physics itself to distribute keys, exploiting the property that measuring a quantum state disturbs it so eavesdropping is detectable. It requires specialized hardware and dedicated links, and has distance limitations.

QKD is scientifically genuine but operationally narrow, and several national security agencies have expressed reservations about it as a general-purpose solution — citing hardware requirements, limited reach, and the fact that it addresses key distribution while leaving authentication to conventional cryptography anyway.

For essentially all organizations, PQC is the relevant technology and QKD is not.

Conclusion

Post-quantum cryptography replaces the public-key algorithms that a large quantum computer would break with ones resting on problems no known quantum algorithm solves efficiently. It runs on ordinary hardware, and symmetric encryption is largely unaffected — the change is concentrated in key exchange and signatures.

The reason to act before any capable machine exists is that recorded traffic can be decrypted retroactively. For data with a long confidentiality requirement, the effective deadline passed some time ago, which is why standards bodies moved when they did.

The most durable takeaway is not any particular algorithm name. It is crypto-agility: systems that can change cryptographic primitives without a rewrite will handle this transition and the ones after it. Migrations of this scale are rare enough that most systems were never designed for them, and that is the underlying problem worth fixing.

Frequently Asked Questions

What is the difference between post-quantum cryptography and quantum cryptography?

Post-quantum cryptography uses classical mathematical algorithms running on ordinary computers, selected because no efficient quantum attack against them is known. Quantum cryptography — usually quantum key distribution — uses quantum physics to distribute keys, relying on the fact that measurement disturbs a quantum state so eavesdropping becomes detectable. PQC needs no new hardware and works over existing networks; QKD requires specialized equipment and dedicated links with distance limits. For nearly all organizations, PQC is the applicable technology.

Should I turn on post-quantum encryption?

If your software offers it, generally yes, particularly in hybrid mode where a post-quantum algorithm is combined with a classical one. Hybrid means the connection stays secure unless both are broken, so there is little downside. For individuals this mostly happens automatically — current browsers negotiate hybrid post-quantum key exchange where the server supports it. For organizations the decision is less about a toggle and more about inventory and planning, since the work is in finding every place cryptography is used.

Does Google use post-quantum cryptography?

Google has been among the earlier adopters, running post-quantum key exchange experiments in Chrome and enabling hybrid post-quantum key agreement for TLS connections, initially pairing X25519 with Kyber and subsequently with standardized ML-KEM. Other major providers and content delivery networks have shipped comparable support. Since deployment status changes and depends on both endpoints negotiating it, checking current documentation for the specific service is more reliable than any general statement.

Will quantum computers break all encryption?

No. Shor's algorithm breaks the public-key algorithms based on factoring and discrete logarithms — RSA, Diffie-Hellman, and elliptic-curve cryptography — which handle key exchange and signatures. Symmetric encryption such as AES and hash functions such as SHA-2 are affected only by Grover's algorithm, which provides a quadratic speedup that effectively halves key strength. AES-256 remains secure against that, and the mitigation is simply larger keys. The disruption is concentrated in public-key cryptography.

Are QPUs better than GPUs?

They are not comparable in that way. A GPU performs many classical arithmetic operations in parallel and is what trains and runs machine learning models. A quantum processing unit manipulates qubits to exploit interference, and is useful only for the narrow set of problems where a quantum algorithm exists — factoring, certain search problems, and simulating quantum systems. A QPU is not a faster GPU and would perform poorly at the tasks GPUs handle. They address different problems rather than competing.

When do I need to migrate to post-quantum cryptography?

That depends on how long your data must stay confidential and how long your migration will take. Because encrypted traffic can be recorded now and decrypted once capable hardware exists, data requiring decades of secrecy is already at risk today. Large migrations typically take years, so organizations handling long-lived sensitive data should be inventorying and planning now. Data with short-lived confidentiality — session tokens, ephemeral traffic — is much less urgent.