Post-Quantum Cryptography

A sufficiently large quantum computer breaks all deployed public-key cryptography — not by brute force, but because Shor's algorithm (1994) solves integer factoring and discrete logarithms in polynomial time. That is RSA, Diffie–Hellman and elliptic curves simultaneously. No such machine exists or is close; the migration is nonetheless underway, and the reason is a timing argument rather than a technology forecast.

What actually breaks #

Why migrate before the machine exists #

Harvest now, decrypt later. An adversary records encrypted traffic today and decrypts it whenever a quantum computer arrives. Any secret whose confidentiality must outlive that date — state secrets, medical records, source code, long-lived credentials — is already exposed if it crosses the wire under classical-only encryption.

The second driver is inertia: replacing cryptography across an ecosystem historically takes 10–20 years. SHA-1's retirement took over a decade after it was known broken. Starting when the machine appears is starting too late.

The standards #

NIST ran an eight-year competition and finalized the first three standards on 13 August 2024:

NIST additionally selected HQC in March 2025 as a code-based backup KEM, deliberately resting on different mathematics than the lattice-based ML-KEM so that a break in lattices does not leave the ecosystem without a key-establishment option.

The security assumptions are the point of the diversity:

• Lattices (ML-KEM, ML-DSA, FN-DSA) — hardness of finding short vectors in high-dimensional lattices. Efficient and the mainstream choice.
• Hash-based (SLH-DSA) — security rests only on the hash function. The most conservative assumption in the entire portfolio, at the cost of large signatures (~7–30 KB) and slow signing.
• Code-based (HQC, Classic McEliece) — decoding random linear codes. Decades of analysis; McEliece has enormous public keys (~1 MB) but tiny ciphertexts.

Hybrid deployment #

Real deployments combine a classical and a post-quantum algorithm, deriving the session key from both shared secrets. The handshake is secure if either component holds.

For TLS 1.3 the converged choice is the X25519MLKEM768 group: X25519 and ML-KEM-768 run together, their outputs concatenated into the key schedule. As of 2026 this is enabled by default in Chrome and Firefox for a large share of connections, and supported by the major CDNs and TLS libraries. The practical cost is handshake size — ML-KEM-768 public keys and ciphertexts run around 1.2 KB each, enough to push a ClientHello past a single packet.

Signatures are migrating far more slowly. PQ signatures are large and certificate chains contain several of them, so the PKI impact is substantial; there is also less urgency, because a signature only needs to resist forgery at the time it is verified — there is no harvest-now-forge-later analogue.

Deadlines are now regulatory rather than advisory: a June 2026 US executive order sets federal civilian targets of a migration pilot by 2027, key establishment by 2030, and digital signatures by 2031.

Quantum key distribution is a different thing #

QKD is routinely confused with post-quantum cryptography, and they are close to opposites.