Common PQC Myths

The short version: what the myths get wrong

PQC discussions often collapse several different questions into one: whether a quantum computer exists today, which cryptographic primitives are exposed, whether a migration needs quantum equipment, and whether a standardized algorithm can be inserted without engineering work. Those are separate questions. The evidence supports a measured conclusion: the quantum threat is future-oriented but important enough to plan for now; the principal immediate transition target is vulnerable public-key cryptography; and deployment is an engineering and risk-management program rather than a single algorithm swap. [claimIds: claim-01, claim-02, claim-04]123

Myth 1: Quantum computers already break all encryption

Reality: The cited evidence describes advanced quantum computers as a strong possibility and says that the field remains in its infancy. Researchers still face major technical hurdles, and it remains an open question how formidable quantum computers can become. A cryptographically relevant quantum computer (CRQC) is specifically a quantum computer with sufficient logical qubits to break traditional asymmetric algorithms such as RSA or ECC within a practical timeframe. That definition is not the same as saying that all encryption is currently broken. [claimIds: claim-01]12

The relevant technical concern is selective. Traditional asymmetric algorithms based on integer factorization, finite-field discrete logarithms, or elliptic-curve discrete logarithms would be vulnerable to attacks using Shor’s algorithm on a CRQC. This affects important functions such as key agreement, key transport, and digital signatures. By contrast, NIST’s November 2024 initial public draft says existing symmetric-cryptography algorithm standards are less vulnerable to quantum attacks and that NIST does not expect to need to transition away from those standards as part of the PQC migration. [claimIds: claim-02]23

Myth 2: If a standard exists, deployment is automatic

Reality: A finalized standard is a necessary reference point, not a completed migration. FIPS 203 specifies a key-encapsulation mechanism for establishing a shared secret key; that shared key can then be used with symmetric-key algorithms for tasks such as encryption and authentication. FIPS 204 and FIPS 205 define digital-signature standards. These standards describe cryptographic mechanisms, but an organization must still integrate them into protocols, applications, libraries, hardware modules, certificate and key-management systems, and operational processes. [claimIds: claim-04]3

NIST’s November 2024 initial public draft states that, once PQC algorithms are standardized, applications need to be modified to use them. It identifies dependencies on standardized protocols, security technologies, software cryptographic libraries, and hardware cryptographic modules. The same draft says applications and services may require changes to implementations, key sizes, algorithm performance, protocols, and libraries, along with refactoring, extensive testing, and sometimes interface redesign. [claimIds: claim-04]3

Validation is also not identical to assurance of an entire system. NIST SP 800-227, published in September 2025 as a final document, says validation testing checks whether an implementation correctly computes the desired output for a small number of often randomly sampled inputs. It does not guarantee correct functioning on all inputs. That limitation reinforces the need for broader testing, secure integration, and operational review around a standardized primitive. [claimIds: claim-08]7

Myth 3: PQC requires quantum hardware

Reality: PQC is conventional cryptography designed to resist attacks from both quantum and classical computers. The cited terminology defines a post-quantum asymmetric cryptographic algorithm as one intended to be secure against attacks using quantum computers as well as classical computers. NSA’s post-quantum resources describe these algorithms as implemented on existing platforms and deriving their security from mathematical complexity. PQC therefore does not require an organization to operate a quantum computer, quantum network, or quantum key-distribution equipment. [claimIds: claim-03]45

Quantum key distribution (QKD) is a different technology and should not be treated as synonymous with PQC. NSA describes QKD as a partial solution that does not itself authenticate the source of a QKD transmission; it also requires special-purpose equipment and dedicated physical communications arrangements. The cited evidence says the confidentiality services QKD offers can be provided by quantum-resistant cryptography, which is typically less expensive and has a better-understood risk profile. [claimIds: claim-09]5

Myth 4: Every cryptographic primitive must be replaced identically

Reality: PQC migration is driven by cryptographic purpose and threat, not by a rule that every algorithm receives an identical replacement. Traditional asymmetric cryptography covers different functions, including key agreement, key transport, encryption-related public-key operations, and digital signatures. A KEM establishes a shared secret; a signature algorithm provides data integrity and data-origin authentication. The standards and terminology in the evidence distinguish these purposes rather than presenting one universal primitive. [claimIds: claim-10]849

The threat model also differs by primitive family. RSA and elliptic-curve systems used for key establishment or signatures are examples of traditional asymmetric algorithms exposed to a CRQC. Existing symmetric standards are described by NIST as less vulnerable, and NIST does not expect their replacement to be part of the PQC migration. A practical inventory should therefore record where cryptography is used, what security property it provides, and which algorithm family supplies it before selecting a transition path. [claimIds: claim-02, claim-10]23849

Nor are standardized PQC algorithms necessarily drop-in replacements for traditional algorithms. RFC 9958 explicitly cautions that the NIST PQC algorithms available at the time of that document were not necessarily drop-in replacements; for example, RSA and ECC can be used as both KEMs and signature schemes, whereas different PQC algorithms may have more specific purposes. [claimIds: claim-11]2

Myth 5: Hybrid cryptography is always stronger

Reality: A hybrid scheme combines two or more key-exchange or cryptographic components based on different assumptions. Its intended security property can be that the final session key remains secure as long as at least one component remains unbroken. A post-quantum/traditional hybrid combines at least one post-quantum and one traditional component, and its design is aimed at requiring successful breaking of all components to break the relevant security property. [claimIds: claim-05]634

That does not make every hybrid deployment automatically stronger. NIST’s November 2024 draft says hybrid solutions may hedge against a cryptographic or implementation flaw and can accommodate legacy requirements, but also says they add complexity. ETSI TR 103 966 V1.1.1, a final document published in October 2024, explores security, efficiency, agility, selection, and deployment tradeoffs and explicitly does not provide guidance on whether to use hybrid schemes. The choice therefore requires analysis of component assumptions, composition, implementation quality, interoperability, performance, and lifecycle management. [claimIds: claim-05, claim-12]63410

Myth 6: Larger keys, signatures, or ciphertexts make PQC unusable

Reality: Changed sizes and performance are real migration considerations, but “unusable” is an unsupported generalization. NIST’s transition draft identifies changes in key sizes and algorithm performance as issues that applications must accommodate. It also says developers may need to refactor code, conduct extensive testing, and redesign interfaces. Those statements support measurement and engineering adaptation, not an assumption that PQC cannot operate in constrained systems. [claimIds: claim-13]31

NIST’s PQC overview specifically notes that candidate algorithms were evaluated on large computers, smartphones, and devices with limited processor power, including smart cards, Internet-of-Things devices, and individual microchips. This does not prove that every deployment will meet its latency, bandwidth, memory, or storage requirements. It does show why performance should be assessed in the target environment rather than rejected solely because artifacts differ from traditional cryptography. [claimIds: claim-13]31

The appropriate response is to establish measurements for handshake size, certificate or key-object handling, signing and verification cost, memory, bandwidth, failure behavior, and hardware-module support where relevant. Those measurements should be tied to the application’s security purpose and protocol constraints. The evidence supports that engineering work is needed; it does not support a universal claim that PQC artifacts make systems unusable. [claimIds: claim-04, claim-13]31

Myth 7: One PQC algorithm fits every purpose

Reality: PQC is an algorithm and protocol family, not one universal algorithm. FIPS 203 defines a KEM for shared-secret establishment. FIPS 204 defines a module-lattice-based digital-signature standard, and FIPS 205 defines a stateless hash-based digital-signature standard. Their purposes and operational properties differ. A selection process should begin with the required function—such as key establishment or signature generation and verification—then consider security requirements, implementation constraints, interoperability, lifecycle, and validation. [claimIds: claim-10, claim-14]84911

The same principle applies to key use. FIPS 204 says agencies are advised that digital-signature key pairs should not be used for other purposes. That is a concrete reminder that algorithm selection is not merely a matter of finding the largest or newest parameter set; key separation and intended use remain part of sound cryptographic architecture. [claimIds: claim-14]8911

Myth 8: Migration can wait until a CRQC exists

Reality: Waiting for a demonstrated CRQC can leave long-lived confidential data exposed to “harvest now, decrypt later.” NIST’s PQC overview says it is not possible to predict exactly when—or even if—quantum computers will break present-day encryption, but the potential threat is great enough to prepare now. It also says that integrating a new algorithm into information systems has historically taken 10 to 20 years. [claimIds: claim-15]1

The reason to begin is therefore not certainty about a date. It is the combination of uncertain quantum timelines, long system lifecycles, lengthy standards and integration work, and data whose confidentiality must last beyond the date of collection. NIST’s overview, published August 13, 2024, says the first three finalized PQC standards were released in 2024 and encourages organizations to begin transition immediately. That status statement is tied to the cited document and should not be generalized beyond the evidence cited here. [claimIds: claim-15, claim-16]1

A sensible first phase is discovery: inventory applications that use public-key cryptography, identify vendors and dependencies, classify data by confidentiality lifetime, and locate systems that cannot be updated quickly. The transition draft also emphasizes backward compatibility and interoperability during the transition period. Migration timing will vary by application; the cited NIST material describes the November 2024 text as an initial public draft and identifies 2035 as a primary federal migration target under National Security Memorandum 10, while noting that timelines may vary by use case. [claimIds: claim-04, claim-17]3

Myth 9: PQC eliminates ordinary security risks

Reality: PQC addresses a cryptographic threat model; it does not make systems secure by itself. The evidence identifies implementation mistakes as a source of security vulnerabilities or loss of usability and says validation testing does not guarantee correct behavior on all inputs. PQC also does not replace authentication design, access control, secure key handling, patching, monitoring, protocol security, or protection against implementation and side-channel weaknesses. [claimIds: claim-06, claim-08]725

RFC 9958 warns that implementers of cryptographic hardware should be aware that current best practices for side-channel resistance may not be sufficient against quantum adversaries. That is an additional reason not to treat “post-quantum” as a complete security label: implementations and hardware still require analysis appropriate to their threat environment. [claimIds: claim-06]725

Finally, PQC is not the same as QKD and does not promise security by the laws of physics. NSA states that QKD and related quantum-cryptography security is highly implementation-dependent rather than assured by physical theory alone. Both classical and post-quantum systems still depend on correct engineering, authenticated participants, trustworthy components, and disciplined operations. [claimIds: claim-09]5

Conclusion

The most useful correction to PQC myths is to replace absolute claims with scoped engineering questions. A CRQC is a future capability that threatens important traditional asymmetric algorithms, not proof that all encryption has already failed. PQC runs on existing platforms and does not require quantum hardware. Standards provide essential, finalized building blocks, but deployment still requires inventory, purpose-specific algorithm selection, protocol and application changes, testing, validation, interoperability work, and lifecycle planning. Hybrid designs may help during transition, but they add complexity and are not automatically stronger. Finally, PQC reduces a future cryptographic risk; it does not eliminate ordinary security risks. [claimIds: claim-01, claim-03, claim-04, claim-05, claim-06]1245367