QuantumAtlas

Applications

Post-Quantum Cryptography

Encryption methods designed to be secure against attacks from both classical and quantum computers.

Definition

Post-quantum cryptography (PQC) refers to cryptographic algorithms that are believed to be secure against attacks by large-scale quantum computers, particularly Shor's Algorithm, which could break widely-used encryption schemes like RSA. These new algorithms are based on mathematical problems believed to be hard even for quantum computers.

In depth

Post-quantum cryptography, or PQC, is a family of encryption and signature schemes that run on ordinary computers and are believed to resist attacks from both classical and quantum computers. They are designed to replace RSA and elliptic-curve cryptography, which Shor's algorithm would break. The new schemes are based on problems for which no efficient quantum algorithm is known, such as finding short vectors in high-dimensional lattices, decoding random linear codes, and inverting hash functions.

After a public competition that began in 2016, the U.S. National Institute of Standards and Technology published the first three standards on August 13, 2024. FIPS 203 specifies ML-KEM, a lattice-based key exchange derived from CRYSTALS-Kyber. FIPS 204 specifies ML-DSA, a lattice-based signature derived from CRYSTALS-Dilithium. FIPS 205 specifies SLH-DSA, a hash-based signature derived from SPHINCS+. A signature based on Falcon is in progress as FN-DSA, and in March 2025 NIST selected HQC, a code-based scheme, as a backup key exchange. The competition also taught a lesson about caution: the candidate SIKE was broken in 2022 by a classical attack in about an hour on a laptop.

Migration is the hard part. The new schemes have larger keys and signatures: an ML-KEM-768 public key is 1,184 bytes compared with 32 bytes for X25519, and an ML-DSA-65 signature is about 3,309 bytes compared with 64 bytes for Ed25519. Deployments therefore start with hybrid modes that combine a classical and a post-quantum algorithm, as in the X25519MLKEM768 key exchange used by Chrome, Cloudflare, and others. Organizations are advised to build crypto-agility, take inventory of cryptographic use, and follow national timelines, including the NSA's CNSA 2.0 and the UK NCSC's milestones for 2028, 2031, and 2035.

Technical Definition

The main families of post-quantum cryptographic algorithms include: lattice-based cryptography (based on problems like Learning With Errors), hash-based signatures, code-based cryptography, and multivariate polynomial cryptography. NIST (the US National Institute of Standards and Technology) completed a multi-year standardization process in 2024, selecting several algorithms — including CRYSTALS-Kyber for key exchange and CRYSTALS-Dilithium for digital signatures — as the first post-quantum standards.

Visual Explanation: An Analogy

Imagine current internet encryption as a lock whose key can be copied by a powerful enough machine (a quantum computer). Post-quantum cryptography replaces it with a fundamentally different type of lock — one whose key-copying mechanism simply doesn't work on the new design, even with a quantum machine.

Key facts

ItemDetail
NIST standards (August 2024)FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA)
BackupHQC selected in March 2025 as an additional key-encapsulation method
Math familiesLattices, error-correcting codes, hash functions, and multivariate equations
SizesML-KEM-768 public key 1,184 bytes; ML-DSA-65 signature about 3,309 bytes
LessonSIKE was broken in 2022 by a classical attack

Where the idea comes from

NIST launched its post-quantum standardization process in 2016, with 82 submissions from 25 countries, and narrowed them through three rounds before selecting the first algorithms in 2022 and publishing standards in 2024.

Real-World Use Cases

  • Securing internet communications (HTTPS) against future quantum attacks
  • Protecting government and military communications long-term
  • Addressing 'harvest now, decrypt later' threats — where encrypted data is collected now and decrypted once quantum computers mature

How it differs from related ideas

  • Post-quantum cryptography uses classical hardware and mathematical hardness, while quantum key distribution uses quantum hardware and physics.
  • It replaces public-key algorithms, and symmetric ciphers such as AES-256 remain adequate.
  • Hybrid schemes protect against failures of either the classical or the new algorithm.

Common Misconceptions

  • Post-quantum cryptography does not use quantum computers — it's classical cryptography designed to be resistant to quantum attacks.
  • Adopting post-quantum cryptography is necessary even before large quantum computers exist, because of the harvest-now-decrypt-later risk.

Frequently asked questions

What is post-quantum cryptography?

Cryptographic algorithms that run on ordinary computers and are believed to resist quantum attacks, designed to replace RSA and elliptic-curve cryptography.

Which post-quantum standards exist?

NIST published ML-KEM, ML-DSA, and SLH-DSA in August 2024, with HQC chosen as a backup in 2025.

Is post-quantum cryptography proven secure?

No cryptographic scheme is proven secure. These are believed secure after years of public analysis, which is why hybrid deployment is common.

Related Terms

Keep exploring

← Back to the dictionary