Quick Answer: What is post quantum cryptography?
Post quantum cryptography is a family of encryption methods built to resist attacks from both ordinary computers and future quantum computers. It runs on the hardware people already own, so banks, governments, and app developers can start switching to it today through software updates and new security standards.
It differs from quantum key distribution, which needs special quantum hardware and dedicated fiber links. Post quantum algorithms are pure math and work over the normal internet, which is why most organizations treat them as the practical path forward.
Before adopting anything, compare algorithm maturity, standard status, key and signature sizes, performance overhead, hardware support, and your own migration deadline.
In 1994, a mathematician named Peter Shor published an algorithm showing that a powerful quantum computer could crack the public-key encryption protecting nearly everything online. For years that felt like a distant science problem. Then, in August 2024, a US standards body published the first three official encryption standards designed to survive exactly that attack. The race to replace the internet’s locks had officially begun.
Why Ordinary Encryption Suddenly Has an Expiration Date
Almost every secure connection today leans on two families of math: RSA and elliptic-curve cryptography. They protect bank transfers, software updates, messaging apps, and government systems. Their security rests on problems that classical computers find practically impossible to solve.
Shor’s algorithm changes that calculation. A sufficiently large, fault-tolerant quantum computer could solve those problems quickly, which means RSA and elliptic-curve keys would stop being secret. Symmetric encryption and hashing fare better: Grover’s algorithm offers only a quadratic speedup, so doubling key sizes is the usual fix.
Here is the uncomfortable part. No cryptographically relevant quantum computer exists yet, and expert timelines vary widely and remain contested. The threat is not only future decryption, though. Adversaries can record encrypted traffic today and decrypt it later once the hardware catches up. Security professionals call this “harvest now, decrypt later,” and it is the main reason migration is already underway. Data with a long shelf life, such as medical records, state secrets, and intellectual property, is exposed the moment it is captured.
What Makes Post Quantum Cryptography Different
Post quantum cryptography (often shortened to PQC) is cryptography designed to resist attacks from both classical and quantum computers. The crucial detail is that it runs on existing classical hardware. No quantum machine is needed to use it, which separates it sharply from quantum key distribution.
The table below sums up the practical differences.
| Feature | Post quantum cryptography | Quantum key distribution |
|---|---|---|
| Hardware needed | Ordinary servers and devices | Dedicated quantum equipment and fiber |
| Distance limits | None beyond normal networking | Limited by signal loss |
| Authentication | Digital signatures included | Still needs classical signatures |
| Deployment speed | Software and firmware updates | Physical infrastructure builds |
| Standardization | NIST, ISO/IEC, ETSI, national bodies | Narrower, vendor-driven |
The algorithms themselves come from several mathematical families, including lattice problems, hash functions, and error-correcting codes. Lattice-based designs dominated the first standards because they balance security, speed, and key size well.
The NIST Standards That Turned Theory Into Products
The US National Institute of Standards and Technology began its Post-Quantum Cryptography Standardization project in 2016 with a public call for submissions. In July 2022 it selected its first algorithms for standardization. In August 2024 it published the first three finished standards:
- FIPS 203 (ML-KEM), derived from CRYSTALS-Kyber, for key encapsulation.
- FIPS 204 (ML-DSA), derived from CRYSTALS-Dilithium, for digital signatures.
- FIPS 205 (SLH-DSA), derived from SPHINCS+, as a hash-based signature backup.
A fourth family, HQC, was selected as a backup key-encapsulation mechanism in March 2025, with a draft standard expected around 2026. That status is worth checking before you commit, since publication timelines shift.
Standardization is not a US-only effort. ETSI, ISO/IEC, and national bodies such as Germany’s BSI and France’s ANSSI issue their own guidance. The European Union’s coordinated roadmap targets starting transitions by 2026 and high-risk systems by 2030, though those milestones should be verified against current official documents.
What the Migration Deadlines Actually Say
Governments are not waiting for a working quantum computer to set schedules. The US National Security Agency’s CNSA 2.0 guidance sets a timeline for national security systems, with software and firmware signing transitioning by 2025 and broader transition running through 2030 to 2033. NIST’s IR 8547 draft proposes deprecating RSA and elliptic-curve cryptography by 2030 and disallowing it after 2035.
Those dates matter far beyond government contractors. Anyone selling into regulated markets, critical infrastructure, or defense supply chains will feel them through procurement rules and contract clauses. The practical lesson from early adopters is blunt: cryptographic migration is slow, and organizations that start late pay premium rates for scarce expertise.
How Hybrid Schemes Keep You Safe During the Switch
Nobody sensible rips out proven encryption overnight. The dominant approach is hybrid key exchange, which combines a classical algorithm with a post-quantum one so security holds if either component fails. Google Chrome enabled hybrid post-quantum key exchange by default in 2024, an early signal that this pattern works at internet scale.
In practice, hybrid deployment looks like this:
- Inventory every place cryptography is used, including forgotten firmware and third-party libraries.
- Prioritize long-lived secrets and anything that touches software signing.
- Enable hybrid key exchange first, because it is usually a configuration change.
- Pilot post-quantum signatures next, watching certificate and message sizes.
- Set a retirement date for classical-only algorithms and track it.
The order matters. Key exchange protects data in transit and is comparatively easy to swap. Signatures are harder because they touch certificate chains, code signing, and trust stores that update slowly.
Practical Tips, Common Mistakes, and What Actually Works
First-hand reports from early migration projects converge on a few lessons. The biggest mistake is treating this as a pure IT upgrade. It is a supply-chain problem: your security depends on libraries, vendors, and hardware modules you do not control.
Another frequent error is forgetting the cryptographic bill of materials. Teams discover post-quantum readiness gaps in embedded devices, VPN concentrators, and old signing servers only after an audit. Building that inventory early saves months.
Performance surprises catch people too. Post-quantum keys and signatures are larger than their classical counterparts, which can strain constrained networks, smart cards, and some certificate chains. Test on real hardware rather than assuming a data-center benchmark translates to a field device.
Finally, governance beats heroics. Assign an owner, publish an internal deadline earlier than any regulator’s, and rehearse the rollback plan. The teams that struggle are the ones that treat migration as a one-off project instead of a standing capability.
For readers tracking how this fits into the wider computing shift, the same hardware race shaping latest breakthroughs in quantum computing is what makes post quantum migration urgent, and understanding what is quantum ai helps explain why so much investment is flowing into the field. The security community also watches for implementation flaws rather than algorithm breaks, and incidents such as the php2shell crypto exchanges risk Hwang Suk Jin SlowMist 2026 report show how operational mistakes, not broken math, usually cause the damage.
Where Post Quantum Cryptography Fits in the Bigger Picture
It helps to separate three ideas that get muddled together. Quantum computing is the hardware. Post quantum cryptography is classical software built to survive that hardware. Quantum key distribution is a hardware-based alternative that still relies on classical signatures for authentication.
Comparing quantum computing vs classical computing makes the asymmetry clear: classical machines get faster incrementally, while quantum machines attack specific problems exponentially. If you want the underlying mechanics, this explainer on what is quantum computing and how does it work covers the basics without the hype, and this analysis of how quantum computing could change artificial intelligence shows why the security stakes keep rising. (Post-Quantum Cryptography)
For most organizations, the honest answer is that post quantum cryptography is boring on purpose. It is math that behaves predictably, standards that vendors can implement, and migration plans that can be tested. Excitement is not the goal. Staying unreadable to a future attacker is.
What Individuals and Small Teams Should Do Now
You do not need a quantum lab to act. Start with the basics: keep software updated, prefer providers who publish their post-quantum roadmap, and ask vendors direct questions about hybrid support. Encryption that protects data at rest with strong symmetric keys remains solid, especially with larger key sizes.
Small teams should also stop treating “we use HTTPS” as a complete answer. Modern TLS already supports hybrid key exchange in major browsers, so the practical step is verifying that your servers and clients negotiate it. That single configuration change buys meaningful protection against harvest-now attacks, and it costs almost nothing.
Conclusion
Post quantum cryptography is the bridge between the encryption we have and the threats we can see coming. It runs on today’s hardware, it is backed by published standards, and it is already deployed in hybrid form across major browsers. The timeline to a cryptographically relevant quantum computer remains genuinely uncertain, and that uncertainty is the argument for moving now rather than waiting for certainty. The organizations that treat migration as a slow, well-documented supply-chain project will barely notice the transition. The ones that wait will be negotiating from weakness, with data already recorded and deadlines already passing.
Frequently Asked Questions
Does post quantum cryptography require a quantum computer?
No. Post quantum algorithms run on ordinary classical hardware such as servers, laptops, and phones. That is the main reason they are practical for mass migration. Quantum key distribution is the approach that needs special quantum equipment.
Is RSA already broken?
Not yet. No publicly known classical attack breaks properly implemented RSA, and no cryptographically relevant quantum computer has been demonstrated. The concern is forward-looking: recorded traffic could be decrypted later, and migration takes years.
How long does migration usually take?
Most large organizations measure cryptographic migration in years, not months, because it touches hardware, firmware, third-party libraries, and certificate authorities. Government guidance generally sets transition windows running to roughly 2030 to 2035, though exact dates should be checked against current official documents.
Are post quantum algorithms slower?
They are often somewhat slower and produce larger keys and signatures, but the gap is usually manageable for network traffic. The harder constraints appear on small or embedded devices with limited memory and bandwidth, which is why testing on real hardware matters.
What is the difference between post quantum cryptography and quantum cryptography?
Quantum cryptography uses quantum physics, for example to distribute keys over quantum channels. Post quantum cryptography uses classical mathematics designed to resist quantum attacks. The names sound similar but describe very different technologies with different deployment costs. (Post-quantum cryptography)
Should small businesses care about this now?
Yes, at least at the level of asking vendors and updating software. Small businesses inherit risk from their suppliers, payment processors, and cloud providers. Checking whether those providers support hybrid key exchange is a low-effort step that improves long-term protection.
The FAQ above covers the questions readers ask most often, but one theme deserves emphasis: post quantum cryptography is not a single product you buy and install. It is a moving target that standards bodies, vendors, and attackers will keep reshaping for years. Treat every roadmap date as provisional, re-read official guidance before committing budget, and build the habit of verifying claims against primary sources rather than vendor marketing. The organizations that stay curious, keep testing on real hardware, and document what they learn will adapt fastest as the algorithms and deadlines evolve. Start small, measure honestly, and let the migration compound over time.
