What is post-quantum cryptography?

Almost every private connection you use, from banking to email to a website’s padlock, is protected by two families of public-key cryptography: RSA and elliptic-curve cryptography. Their security rests on math problems that ordinary computers cannot solve in any reasonable time, such as factoring very large numbers.

A quantum computer changes that. A known quantum algorithm, published by Peter Shor in 1994, solves exactly those problems efficiently. A quantum computer large and stable enough to run it does not exist yet, but governments and companies are building toward one. When it works, RSA and elliptic-curve cryptography stop protecting anything.

Post-quantum algorithms are built on different math, chosen because no efficient quantum attack against it is known. The leading approach uses structured lattices; others use hash functions or error-correcting codes. After a multi-year public competition, the US National Institute of Standards and Technology (NIST) finalized the first three standards in August 2024:

• FIPS 203 (ML-KEM), for key establishment, the step that sets up a shared secret at the start of a connection.
• FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA), for digital signatures, which prove identity and that data was not tampered with.

These are not experimental. They are the approved replacements, and the migration off the old algorithms has an official timeline behind it.

You might expect there is nothing to do until a quantum computer is real. There is. An attacker can record encrypted traffic today and simply store it, then decrypt it years later once the machine exists. Anything that must stay secret for a long time, such as health records, financial data, or trade secrets, is already exposed. This is called harvest now, decrypt later, and it is why the deadline that matters is not when quantum computers arrive, but how long your data needs to stay private.

The migration comes down to three steps, in order:

• Find your cryptography. You cannot replace what you cannot see. The first deliverable in every serious plan is an inventory of the algorithms, keys, certificates, and protocols in use, often recorded as a Cryptographic Bill of Materials.
• Prioritize by risk. Start with key establishment on systems whose data has a long confidentiality lifetime, because that is where harvest-now-decrypt-later bites.
• Migrate, usually in hybrid. Most deployments today pair a classical algorithm with a post-quantum one, so a flaw in either still leaves you protected.