Post-Quantum Cryptography

Why Quantum Changes Everything

Quantum computers leverage qubits and superposition to solve problems that classical computers can't touch — including breaking widely-used cryptographic schemes.

RSA & ECC Broken

Shor's algorithm can factor large integers and compute discrete logs in polynomial time, shattering RSA and Elliptic Curve cryptography.

Harvest Now, Decrypt Later

Adversaries are already capturing encrypted data today, planning to decrypt it once quantum computers become powerful enough.

The Clock is Ticking

Experts estimate cryptographically relevant quantum computers could arrive within 10–15 years. Migration must begin now.

Global Infrastructure at Risk

TLS, VPNs, digital signatures, banking, government secrets — all rely on algorithms that quantum computers will defeat.

NIST Standardized Algorithms

In 2024, NIST released the first post-quantum cryptographic standards. These are the algorithms that will protect the next era of digital communication.

ML-KEM (FIPS 203)

Module-Lattice-Based Key Encapsulation Mechanism, formerly known as CRYSTALS-Kyber. It is the primary standard for post-quantum key exchange, used in TLS handshakes and hybrid encryption.

Based on the hardness of the Module Learning With Errors (MLWE) problem over structured lattices.

Key Encapsulation Lattice-Based FIPS 203

ML-KEM-768 Key Sizes

1,184

Public Key (bytes)

1,088

Ciphertext (bytes)

Shared Secret (bytes)

ML-DSA (FIPS 204)

Module-Lattice-Based Digital Signature Algorithm, formerly CRYSTALS-Dilithium. The primary standard for post-quantum digital signatures.

Based on the hardness of finding short vectors in module lattices (MLWE and MSIS problems).

Digital Signature Lattice-Based FIPS 204

ML-DSA-65 Sizes

1,952

Public Key (bytes)

3,309

Signature (bytes)

4,032

Secret Key (bytes)

SLH-DSA (FIPS 205)

Stateless Hash-Based Digital Signature Algorithm, formerly SPHINCS+. A conservative backup standard relying only on the security of hash functions.

Uses a hypertree of many-time XMSS-like trees with FORS (Forest of Random Subsets) for one-time signing.

Digital Signature Hash-Based FIPS 205

SLH-DSA-SHA2-128f Sizes

Public Key (bytes)

17,088

Signature (bytes)

Secret Key (bytes)

FN-DSA (Falcon)

FFT over NTRU-Lattice-Based Digital Signature Algorithm. Selected by NIST as an additional signature standard, offering the smallest combined public key + signature sizes among lattice-based schemes.

Based on the hardness of the Short Integer Solution problem over NTRU lattices, using fast Fourier sampling.

Digital Signature NTRU Lattice Compact Signatures

FN-DSA-512 Sizes

897

Public Key (bytes)

666

Signature (bytes)

1,281

Secret Key (bytes)

PQC Timeline

Key milestones in the journey toward quantum-resistant cryptography.

1994

Shor's Algorithm Published

Peter Shor demonstrates a quantum algorithm that can factor integers in polynomial time, threatening RSA and ECC.

2016

NIST PQC Competition Launched

NIST calls for proposals for post-quantum public-key encryption, key exchange, and digital signature algorithms.

2022

First Finalists Announced

NIST selects CRYSTALS-Kyber, CRYSTALS-Dilithium, Falcon, and SPHINCS+ as the first algorithms to be standardized.

2024

FIPS Standards Published

NIST publishes FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) as the first post-quantum cryptographic standards.

2025–2030

Migration Period

Organizations worldwide begin transitioning to PQC. Hybrid approaches (classical + PQ) are deployed during the transition.

2030+

Quantum Threat Horizon

Cryptographically relevant quantum computers may emerge. Systems not yet migrated face existential risk.

Classical vs Post-Quantum

How today's cryptographic algorithms compare against the quantum threat.

Algorithm	Type	Quantum Safe	Key Size	Status
RSA-2048	Encryption / Signature	Vulnerable	256 bytes	Widely deployed
ECDSA (P-256)	Digital Signature	Vulnerable	32 bytes	Widely deployed
ECDH (X25519)	Key Exchange	Vulnerable	32 bytes	Widely deployed
AES-256	Symmetric Encryption	Safe (Grover: 128-bit)	32 bytes	Remains secure
ML-KEM-768	Key Encapsulation	Quantum Safe	1,184 bytes	FIPS 203 standard
ML-DSA-65	Digital Signature	Quantum Safe	1,952 bytes	FIPS 204 standard
SLH-DSA-128f	Digital Signature	Quantum Safe	32 bytes	FIPS 205 standard

Frequently Asked Questions

Common questions about post-quantum cryptography and the transition ahead.

Most experts estimate that cryptographically relevant quantum computers (CRQC) could arrive between 2030 and 2040. However, the "harvest now, decrypt later" threat means sensitive data encrypted today is already at risk.

Yes. Grover's algorithm reduces the effective security of symmetric ciphers by half, so AES-256 would offer 128-bit security against quantum attacks — still considered very secure. AES-128 would drop to 64-bit, so upgrading to AES-256 is recommended.

A hybrid approach combines a classical algorithm (like X25519) with a post-quantum algorithm (like ML-KEM) so that the connection remains secure even if one of them is broken. This provides security against both classical and quantum attacks during the transition period.

Post-quantum algorithms rely on different mathematical problems (lattices, hash trees) that inherently require more data to represent keys and signatures. ML-KEM-768 public keys are about 1 KB — larger than ECC but still practical for most applications.

Start by inventorying where cryptography is used in your systems (crypto agility assessment). Prioritize long-lived data and connections. Adopt hybrid TLS configurations where supported, update libraries to versions that include PQC support (e.g., OpenSSL 3.5+, liboqs), and follow NIST and your industry's migration guidance.