What is Post-Quantum Cryptography (PQC)?

What does post-quantum cryptography mean?

Post-quantum cryptography, or PQC, refers to cryptographic algorithms designed to remain secure against attacks by both classical computers and quantum computers. The relevant adversary is not merely a machine that performs quantum computation in isolation: a cryptographically relevant quantum computer (CRQC) is a quantum computer with enough logical qubits to break traditional asymmetric cryptographic algorithms such as RSA or elliptic-curve cryptography within a practical timeframe. The cited evidence does not establish when such a computer will exist; it describes the risk as a future threat and notes that existing quantum computers are not large enough to threaten currently deployed algorithms.13

PQC is primarily a transition of public-key cryptography. It covers algorithms used to establish shared secrets and algorithms used to create and verify digital signatures. A key-establishment scheme enables parties to derive a shared secret, which can then support efficient confidential communication using symmetric-key cryptography. A digital signature supports authentication and detection of unauthorized modification, and can provide evidence that data was signed by the claimed signatory.67

Why is PQC needed?

Traditional public-key cryptography commonly relies on the presumed difficulty, for classical computers, of problems such as integer factorization and discrete logarithms over finite fields or elliptic curves. The cited evidence identifies key-establishment schemes and digital signatures based on these problems as being at risk if large-scale, cryptographically relevant quantum computers are realized. Examples include RSA, finite-field Diffie–Hellman, elliptic-curve Diffie–Hellman, RSA signatures, DSA, ECDSA, and EdDSA.234

The risk is not limited to data that will be transmitted after a CRQC appears. In a “harvest now, decrypt later” attack, an adversary can collect encrypted traffic or other protected data today and attempt decryption when quantum technology becomes capable of attacking the relevant key-establishment method. A related future-forgery concern applies to long-lived trust anchors and signatures: if a traditional signature can eventually be forged, an attacker might exploit a root of trust or signed object that remains accepted in the future.3

Migration takes time because algorithms must be integrated into products, services, protocols, and infrastructure; organizations must procure or update those components and test their operation. NIST’s November 2024 initial public draft on transition states that earlier cryptographic migrations took over a decade and that this more complex migration will likely take at least that long. The same draft says there were no existing CRQCs then threatening the cited security levels, but that the time needed to transition creates urgency.3

Which cryptographic functions are most affected?

The most significant concern is asymmetric, or public-key, cryptography. In public-key systems, separate keys support operations such as encryption and decryption or signing and verification. A CRQC would threaten widely deployed public-key key-establishment schemes and signature schemes whose security depends on factoring or discrete-logarithm assumptions. That includes RSA and finite-field Diffie–Hellman, as well as elliptic-curve key establishment and signatures such as ECDH and ECDSA. EdDSA is also identified in the cited transition material as vulnerable to the relevant quantum attack.234

Symmetric cryptography is affected differently. The cited engineering evidence describes the quantum threat to symmetric cryptography and hash functions as significantly lower than the threat to asymmetric cryptography. It associates the lower risk with Grover’s algorithm and notes that, where applicable, the impact can typically be mitigated by increasing key or digest lengths. This does not mean symmetric systems are automatically safe, nor does it mean that PQC replaces every block cipher, stream cipher, hash function, or message-authentication code. Rather, PQC usage generally denotes the public-key portion of a cryptographic design.1

What are FIPS 203, FIPS 204, and FIPS 205?

NIST released its principal three PQC standards as Federal Information Processing Standards in August 2024. They specify one key-establishment standard and two digital-signature standards selected through a multiyear public standardization process. The standards define approved algorithms and their requirements; they do not, by themselves, complete an organization’s migration or determine every application-specific deployment choice.53

FIPS 203 is the Module-Lattice-Based Key-Encapsulation Mechanism Standard. It specifies ML-KEM, a key-encapsulation mechanism used for key establishment. A KEM enables parties to establish a shared secret; that secret can then be used for tasks suited to symmetric-key cryptography, such as efficient confidential communication. FIPS 203 therefore addresses the public-key step that establishes the symmetric session key, not the entire application’s symmetric encryption design.56

FIPS 204 is the Module-Lattice-Based Digital Signature Standard. It specifies ML-DSA, a lattice-based digital signature algorithm for applications requiring a digital signature. Digital signatures can be generated for stored or transmitted data, and verification is used to authenticate the signatory and detect unauthorized modification.7

FIPS 205 is the Stateless Hash-Based Digital Signature Standard. It specifies SLH-DSA, a stateless hash-based digital signature algorithm derived from the SPHINCS+ submission selected during NIST’s standardization process. Like FIPS 204, it addresses digital signatures rather than key establishment.2

How should organizations think about PQC migration?

Migration is an engineering and risk-management program, not a single algorithm switch. Organizations should inventory applications, systems, protocols, software, hardware, firmware, and infrastructure that use public-key cryptography. They should then prioritize based on the sensitivity and required lifetime of data, exposure to collection or forgery, operational dependencies, and the availability of support in relevant products and standards. NIST’s transition material specifically expects priority for migrating to quantum-resistant key-establishment schemes to address harvest-now-decrypt-later risk, particularly in interactive protocols such as TLS and IKE.53

A migration can involve a direct replacement, a staged transition, or a hybrid construction. In the cited terminology, schemes that combine post-quantum and traditional algorithms for key establishment or digital signatures are commonly called hybrids. A hybrid key exchange combines a traditional key exchange with a post-quantum key exchange into one construction. The term “hybrid” can also describe combinations of asymmetric and symmetric algorithms, so design documents should define the term precisely.8

NIST’s initial public draft on transition describes 2035 as a primary target for completing migration across U.S. federal systems under National Security Memorandum 10, while also emphasizing that application-specific guidance may specify earlier transitions and that risks, security needs, and adoption challenges differ by application. That federal target is not a universal deadline for every organization or system. The evidence also records that NIST expected to deprecate and ultimately remove quantum-vulnerable algorithms from its standards by 2035, with high-risk systems transitioning earlier, in the cited NIST PQC project material.3

How is PQC different from QKD and quantum cryptography?

PQC and quantum key distribution (QKD) solve related-looking problems in different ways. PQC uses conventional mathematical techniques and software and can run on general-purpose computers. QKD uses quantum hardware and quantum effects to generate or distribute keying material. QKD is therefore not a synonym for PQC, and adopting PQC does not require deploying a quantum communications system.

The cited NSA evidence cautions against treating QKD or quantum cryptography as automatically guaranteed by the laws of physics. It describes QKD as a partial solution and says that its security is highly implementation-dependent. This distinction is important when comparing technologies: PQC is a cryptographic algorithm approach intended for integration into existing computing and communications environments, while QKD has different physical, engineering, and operational requirements.

Important qualifications

“Quantum-resistant” describes the intended security objective against known classical and quantum attack models; it is not a promise of unconditional security. The cited standards and guidance use qualified language such as “intended” and “believed to be secure” in relevant contexts, and the engineering guidance remains subject to evolving standards and research. Implementations can also introduce weaknesses independently of the underlying algorithm, so conformance, secure implementation, key management, protocol integration, and operational controls remain important.

PQC also does not eliminate the need for cryptographic agility. Because systems may need to accommodate evolving standards, products, parameters, and application-specific requirements, organizations benefit from being able to identify and change cryptographic algorithms without redesigning every dependent system. The cited evidence describes crypto agility as an operational mechanism for changing cryptographic algorithms while preserving security and ongoing operations, but it does not prescribe one universal architecture.

Conclusion

Post-quantum cryptography is conventional, software-based public-key cryptography designed to withstand both classical and quantum attacks. Its immediate scope is chiefly key establishment and digital signatures threatened by a future CRQC, while symmetric cryptography faces a different and generally lower quantum risk. NIST’s finalized 2024 standards provide concrete foundations: FIPS 203 specifies ML-KEM, FIPS 204 specifies ML-DSA, and FIPS 205 specifies SLH-DSA. Using those standards still requires a separate migration program that inventories dependencies, prioritizes long-lived and exposed data, evaluates deployment and hybrid options, and tests real systems. PQC should also be kept distinct from QKD, which relies on quantum hardware and has different implementation considerations.12345