Post-Quantum Cryptography (PQC)

What is Post-Quantum Cryptography (PQC)?

Post-Quantum Cryptography (PQC) refers to cryptographic algorithms designed to protect data and communications against attacks from both conventional computers and sufficiently powerful quantum computers.

Quantum computers could threaten widely used public-key cryptographic algorithms such as RSA and elliptic curve cryptography (ECC). PQC uses mathematical problems believed to be difficult for quantum computers to solve, providing a path toward quantum-resistant encryption, key establishment, and digital signatures.

PQC does not require organizations to replace all cryptography with quantum computers or quantum hardware. Instead, it provides software-based cryptographic algorithms that can be deployed on conventional computing systems and networks.

Why Post-Quantum Cryptography Matters

Modern digital infrastructure depends heavily on public-key cryptography for secure communications, authentication, digital signatures, certificates, software updates, VPNs, and other security functions.

A sufficiently capable quantum computer could use quantum algorithms such as Shor's algorithm to undermine the mathematical assumptions behind widely deployed public-key algorithms.

The transition also takes significant time because cryptography is embedded throughout applications, hardware, protocols, certificates, libraries, and third-party products. Organizations therefore need to identify quantum-vulnerable cryptography and plan migration before cryptographically relevant quantum computers become available.

Quantum Threats to Current Cryptography

Quantum computing presents different levels of risk depending on the cryptographic algorithm.

RSA and Quantum Computing

RSA relies on the difficulty of factoring large integers. A sufficiently capable quantum computer running Shor's algorithm could potentially factor these integers efficiently, threatening RSA encryption and digital signatures.

Elliptic Curve Cryptography and Quantum Computing

ECC relies on the difficulty of the elliptic-curve discrete logarithm problem. Shor's algorithm could also undermine ECC when sufficiently powerful quantum computers become available.

Symmetric Cryptography

Symmetric algorithms such as AES are affected differently. Grover's algorithm can provide a theoretical speedup against brute-force searches, but it does not threaten symmetric cryptography in the same way Shor's algorithm threatens RSA and ECC.

As a result, PQC migration focuses heavily on replacing quantum-vulnerable public-key cryptography while also evaluating the security strength of symmetric cryptographic systems.

Harvest Now, Decrypt Later

Harvest Now, Decrypt Later (HNDL) is a threat model in which an attacker collects encrypted information today with the intention of decrypting it in the future when sufficiently powerful quantum computing becomes available.

This creates a current security concern for information that must remain confidential for many years. Sensitive intellectual property, financial information, government data, personal information, and long-lived communications may remain valuable even after they are collected.

Organizations therefore cannot treat PQC migration solely as a future technology project. Long-lived sensitive information may require protection before a cryptographically relevant quantum computer exists.

Post-Quantum Cryptography vs Quantum Cryptography

PQC and quantum cryptography are different approaches.

Post-Quantum Cryptography uses mathematical algorithms that are designed to resist quantum attacks while running on conventional computing infrastructure.

Quantum cryptography uses principles of quantum physics to provide cryptographic capabilities, such as Quantum Key Distribution (QKD).

PQC can generally be integrated into existing software, protocols, and networks without requiring quantum communication infrastructure.

NIST Post-Quantum Cryptography Standards

NIST finalized its first three principal PQC standards in 2024:

• FIPS 203 - ML-KEM: Module-Lattice-Based Key-Encapsulation Mechanism Standard ‍
• FIPS 204 - ML-DSA: Module-Lattice-Based Digital Signature Standard ‍
• FIPS 205 - SLH-DSA: Stateless Hash-Based Digital Signature Standard

ML-KEM provides a mechanism for establishing shared cryptographic keys, while ML-DSA and SLH-DSA provide digital signature capabilities.

These standards form an important foundation for organizations beginning PQC migration.

ML-KEM

ML-KEM is NIST's standardized post-quantum key-encapsulation mechanism based on structured lattice mathematics.

It is designed to establish shared secret keys between communicating parties while resisting attacks from both classical and quantum computers.

ML-KEM is relevant to applications and protocols that currently depend on quantum-vulnerable public-key key-establishment mechanisms.

ML-DSA

ML-DSA is a NIST-standardized post-quantum digital signature algorithm based on structured lattice mathematics.

Digital signatures provide capabilities such as authentication, integrity verification, and non-repudiation. ML-DSA provides a quantum-resistant alternative for applications that currently depend on vulnerable public-key signature algorithms.

SLH-DSA

SLH-DSA is a NIST-standardized stateless hash-based digital signature algorithm.

It is based on hash functions rather than lattice mathematics, providing a different cryptographic foundation from ML-DSA.

This diversity can be useful when organizations evaluate cryptographic resilience and alternative algorithm families.

PQC Algorithm Families

Post-quantum cryptography includes several mathematical approaches that have been researched for resistance against quantum attacks.

Important families include:

• Lattice-based cryptography
• Hash-based cryptography
• Code-based cryptography
• Multivariate cryptography
• Isogeny-based cryptography

Not every candidate algorithm becomes a standard. Algorithms are evaluated for security, performance, implementation characteristics, and other practical requirements.

Hybrid Post-Quantum Cryptography

Hybrid cryptography combines a conventional cryptographic mechanism with a post-quantum mechanism.

For example, a protocol can combine a classical key-establishment method with a PQC mechanism so that security does not depend exclusively on either mechanism during the transition period.

Hybrid approaches can help organizations introduce PQC while maintaining interoperability with systems that have not yet completed migration.

PQC and TLS

Transport Layer Security (TLS) protects a large portion of internet communications, making it an important area for PQC migration.

PQC can be incorporated into key-establishment processes used by TLS implementations. Organizations should evaluate whether their browsers, servers, load balancers, APIs, certificates, libraries, and network security products support the cryptographic mechanisms required for their migration strategy.

TLS is also particularly relevant to HNDL because encrypted network traffic can be collected today and potentially decrypted in the future.

PQC and Digital Signatures

PQC is not limited to encryption.

Digital signatures are used for:

• Software signing
• Firmware updates
• Code signing
• Certificates
• Identity authentication
• Document signing
• Secure boot
• Package verification
• API authentication

Quantum-resistant signature algorithms are therefore an important part of a complete PQC migration.

Cryptographic Inventory

A cryptographic inventory is a record of where and how cryptography is used across an organization's systems.

An inventory can identify:

• Cryptographic algorithms
• Protocols
• Certificates
• Keys and key-management systems
• Cryptographic libraries
• Applications
• Hardware and firmware
• APIs
• Network services
• Data protected by cryptography
• Third-party dependencies

A complete inventory helps organizations determine which systems depend on quantum-vulnerable algorithms and prioritize migration. NIST identifies cryptographic discovery and inventory as an important starting point for PQC migration.

Cryptographic Agility

Cryptographic agility, or crypto-agility, is the ability to replace and adapt cryptographic algorithms across protocols, applications, software, hardware, firmware, and infrastructure while maintaining security and operational continuity.

Crypto-agility is important for PQC because organizations may need to replace legacy algorithms across many different technologies without redesigning entire systems.

It also helps organizations respond to future cryptographic changes beyond the current transition to PQC.

PQC Migration Strategy

A practical PQC migration program can include the following stages:

1. Create awareness: Identify the potential impact of quantum computing on organizational cryptography. ‍
2. Discover cryptography: Identify algorithms, certificates, protocols, libraries, and cryptographic dependencies. ‍
3. Build an inventory: Map cryptographic assets to applications, systems, data, owners, and business processes. ‍
4. Assess risk: Identify quantum-vulnerable systems and prioritize sensitive or long-lived information. ‍
5. Evaluate vendors: Determine PQC capabilities and migration roadmaps for technology providers. ‍
6. Establish crypto-agility: Design systems so cryptographic algorithms can be replaced more easily. ‍
7. Test PQC: Evaluate interoperability, performance, compatibility, and security. ‍
8. Deploy progressively: Introduce PQC into appropriate applications, protocols, and infrastructure. ‍
9. Monitor migration: Track remaining quantum-vulnerable cryptographic assets. ‍
10. Retire vulnerable algorithms: Replace legacy cryptography according to organizational and applicable regulatory requirements.

NIST's migration guidance emphasizes cryptographic visibility, risk management, interoperability, benchmarking, and the ability to replace quantum-vulnerable cryptography.

PQC Migration Challenges

Organizations can face several challenges when transitioning to PQC:

Cryptographic Visibility

Organizations may not know where public-key cryptography is embedded across applications, devices, services, libraries, and third-party products.

Legacy Systems

Older systems may lack support for modern cryptographic algorithms and may be difficult or expensive to upgrade.

Interoperability

New algorithms can require changes across multiple systems, protocols, vendors, and communication endpoints.

Performance

PQC algorithms can have different key, ciphertext, signature, memory, and processing characteristics from existing algorithms.

Embedded Cryptography

Cryptography can be deeply embedded within hardware, firmware, operating systems, applications, and proprietary products.

Third-Party Dependencies

Organizations may depend on vendors and service providers whose PQC capabilities and migration timelines differ.

Certificate and PKI Changes

PQC can require changes to certificate infrastructure, authentication mechanisms, certificate authorities, and related PKI processes.

PQC in Cloud Environments

Cloud environments contain extensive cryptographic dependencies across:

• TLS connections
• APIs
• VPNs
• Identity services
• Certificates
• Cloud storage
• Key-management services
• Service-to-service communication
• Application infrastructure
• Managed security services

Organizations should determine how cloud providers and SaaS vendors are addressing PQC and whether applications can support required post-quantum or hybrid cryptographic mechanisms.

PQC for Software Supply Chain Security

Digital signatures and cryptographic verification are widely used to establish trust in software, packages, containers, firmware, and updates.

Quantum-resistant signatures can therefore become an important component of long-term software supply chain security.

Organizations should assess how code-signing infrastructure, package repositories, CI/CD pipelines, firmware signing, and software-verification mechanisms will transition to quantum-resistant signatures.

PQC and Zero Trust

PQC and Zero Trust address different security problems.

Zero Trust focuses on continuously verifying users, devices, workloads, and access requests while enforcing least-privilege access.

PQC protects cryptographic mechanisms against future quantum attacks.

PQC can therefore become part of the cryptographic foundation supporting Zero Trust architectures, particularly for authentication, secure communication, certificates, and service-to-service connections.

PQC Risk Prioritization

Not every cryptographic asset requires immediate migration at the same time.

Organizations can prioritize based on:

• Sensitivity of protected information
• Data retention period
• Exposure to external networks
• Use of RSA or ECC
• Business criticality
• Regulatory requirements
• System replacement timelines
• Vendor PQC readiness
• Difficulty of migration
• Potential HNDL exposure

Long-lived sensitive information and systems with difficult migration paths can require earlier planning.

PQC Testing and Validation

Before deploying PQC algorithms broadly, organizations should evaluate:

• Security
• Performance
• Compatibility
• Interoperability
• Key and certificate sizes
• Network overhead
• CPU and memory consumption
• Application behavior
• Hardware support
• Library support
• Protocol compatibility
• Failure and fallback behavior

Testing should occur in representative environments before production migration.

PQC Best Practices

Organizations preparing for the post-quantum transition should:

1. Build and maintain a cryptographic inventory.
2. Identify RSA and ECC dependencies.
3. Classify data according to sensitivity and retention requirements.
4. Identify HNDL exposure.
5. Prioritize critical and long-lived data.
6. Assess PQC readiness across vendors and suppliers.
7. Adopt crypto-agility principles.
8. Evaluate NIST-standardized PQC algorithms.
9. Test hybrid cryptographic approaches where appropriate.
10. Validate PQC performance and interoperability.
11. Include PQC requirements in technology procurement.
12. Continuously monitor cryptographic standards and migration guidance.

Post-Quantum Cryptography vs Quantum Key Distribution

PQC uses mathematical algorithms that run on conventional computing infrastructure.

Quantum Key Distribution uses quantum communication properties to establish or distribute cryptographic keys.

PQC can generally be integrated into existing software and communication systems, while QKD requires specialized quantum communication infrastructure.

Post-Quantum Cryptography and Quantum Readiness

Quantum readiness is broader than simply deploying PQC algorithms.

A quantum-ready organization should understand:

• Where cryptography is used
• Which algorithms are deployed
• Which data requires long-term confidentiality
• Which systems are vulnerable to quantum attacks
• Which vendors support PQC
• How certificates and PKI will be affected
• How applications can adopt new algorithms
• How cryptographic changes will be tested and managed

PQC is therefore one component of a broader quantum-risk management and technology modernization strategy.

FAQs

Q1. What is Post-Quantum Cryptography (PQC)?

Post-Quantum Cryptography is a class of cryptographic algorithms designed to protect information and communications against attacks from both conventional and sufficiently powerful quantum computers.

Q2. Why is Post-Quantum Cryptography important?

PQC is important because sufficiently powerful quantum computers could threaten widely used public-key cryptographic algorithms such as RSA and ECC. Organizations also face harvest-now-decrypt-later risks for sensitive data collected before quantum computers become capable of breaking current cryptography.

Q3. Which algorithms are included in NIST's PQC standards?

NIST's initial finalized standards include ML-KEM for key establishment and ML-DSA and SLH-DSA for digital signatures.

Q4. What is ML-KEM?

ML-KEM is a NIST-standardized post-quantum key-encapsulation mechanism designed to establish shared secret keys while resisting quantum attacks.

Q5. What is ML-DSA?

ML-DSA is a NIST-standardized post-quantum digital signature algorithm based on structured lattice mathematics.

Q6. What is SLH-DSA?

SLH-DSA is a NIST-standardized stateless hash-based digital signature algorithm that provides a cryptographic alternative to lattice-based signature schemes.

Q7. What is a harvest-now-decrypt-later attack?

A harvest-now-decrypt-later attack occurs when an attacker collects encrypted information today with the intention of decrypting it later when sufficiently powerful quantum computers become available.

Q8. Is Post-Quantum Cryptography the same as quantum cryptography?

No. PQC uses mathematical algorithms designed to resist quantum attacks and can run on conventional computing systems. Quantum cryptography uses principles of quantum physics for cryptographic applications.

Q9. Can Post-Quantum Cryptography replace RSA and ECC?

PQC provides quantum-resistant alternatives for cryptographic functions currently supported by algorithms such as RSA and ECC, but migration requires application, protocol, infrastructure, interoperability, and performance assessment rather than simply replacing algorithms everywhere.

Q10. What is crypto-agility in PQC?

Crypto-agility is the ability to replace and adapt cryptographic algorithms across systems and infrastructure while maintaining security and operational continuity. It helps organizations manage PQC migration and future cryptographic changes.

Q11. How should organizations prepare for PQC?

Organizations should begin by discovering and inventorying cryptographic assets, identifying quantum-vulnerable algorithms, prioritizing sensitive and long-lived data, assessing vendors, developing a migration roadmap, testing PQC implementations, and improving crypto-agility.

Q12. Does PQC protect against harvest-now-decrypt-later attacks?

PQC can help reduce HNDL risk when quantum-resistant cryptography is deployed to protect information before attackers can collect it for future decryption. The appropriate migration priority depends on the sensitivity and required confidentiality lifetime of the data.