Security
Post-Quantum
Cryptography
The encryption protecting nearly all internet traffic today would crumble against a large enough quantum computer. Post-quantum cryptography is the fix: new codes that run on the ordinary computers we already have, but that even a quantum machine can't break.
The Quantum Threat to Current Cryptography
Why Today's Encryption Is Vulnerable
Most of the encryption that secures websites, email, and online banking relies on math problems that ordinary computers can't crack in any reasonable time — like finding the prime factors of an enormous number. Shor's algorithm on a quantum computer solves exactly these problems quickly, which would break the protection outright. (RSA rests on integer factorisation; Diffie-Hellman and elliptic curve on the discrete logarithm problem — both fall to Shor's algorithm in polynomial time.)
The other major type of encryption — the kind that scrambles the actual data once a connection is established — holds up much better. A quantum computer weakens it, but only modestly, and simply using a longer key restores full strength. (Symmetric ciphers like AES and hash functions like SHA face only Grover's quadratic speedup, effectively halving the security level; AES-256 in place of AES-128 suffices.)
Why this is urgent now: A code-breaking quantum computer may still be years or decades off, yet the danger is already here. Adversaries can record encrypted data today and simply wait — decrypting it the moment the hardware arrives. Anything that must stay secret for many years is already at risk. ("Harvest now, decrypt later.")
Quantum Threat Assessment
Lattice-Based Cryptography
Learning With Errors (LWE)
The hard problem: Imagine a set of equations that almost balance — each one is correct except for a small, random fudge added in. With the fudge, recovering the secret hidden in the equations becomes astonishingly hard, even with unlimited examples to study and even for a quantum computer. (Given many b = ⟨a, s⟩ + e (mod q) with public a, secret s, small error e — recover s.)
Why a quantum computer can't shortcut it: Unlike factoring, this problem has no hidden repeating pattern for Shor's algorithm to grab onto. The best a quantum computer can do is the modest Grover speedup, which a well-chosen key easily outpaces. (LWE reduces in the worst case to hard lattice problems CVP/SVP; no Shor-style periodicity is known.)
Kyber (ML-KEM): The method for safely exchanging keys, built on a structured form of this problem. Adopted by NIST as FIPS 203 in August 2024 — the primary quantum-safe key-exchange standard. (Module-LWE key encapsulation mechanism.)
Dilithium (ML-DSA): The companion method for digital signatures, proving who sent something and that it wasn't altered. Standardised as FIPS 204. (Based on Module-LWE and Module-SIS.)
Post-Quantum Algorithm Families
Lattice-Based
The leading family and the basis of most new standards. It offers a good balance of speed and reasonably small keys. (Hard problems: LWE, NTRU, SIS. Standards: Kyber for key exchange; Dilithium and FALCON for signatures.)
Hash-Based
Rests entirely on the security of ordinary hash functions — among the most thoroughly tested assumptions in all of cryptography, making it the conservative, long-term-trustworthy choice. (SPHINCS+ / FIPS 205 is stateless; XMSS and LMS / NIST SP 800-208 are stateful with smaller signatures.)
Code-Based
Built on the difficulty of decoding a deliberately garbled message. Very fast, very old and well-studied, but with large keys. NIST selected the HQC code-based scheme in March 2025 as a backup to Kyber that relies on different math, with its draft standard due in 2026 and finalisation expected in 2027. (McEliece, 1978, is the oldest PQC proposal; HQC chosen 2025 for algorithmic diversity.)
Cautionary Examples
Two once-promising schemes — Rainbow and SIKE — were both broken by ordinary (non-quantum) attacks in 2022, one of them on a laptop. A reminder that new schemes must be stress-tested for years before they can be trusted. (Rainbow: multivariate; SIKE: isogeny-based.)
NIST PQC Standardisation
The First Post-Quantum Standards
After a seven-year worldwide competition involving hundreds of submissions and thousands of cryptographers probing for weaknesses, NIST published its first finalised post-quantum standards in August 2024. They are designed as drop-in replacements for RSA and ECDSA in the protocols that secure the web. A fourth signature standard (FALCON) is still in draft, and a fifth algorithm (HQC) was selected in March 2025 as a code-based backup, with its own draft standard due in 2026 and finalisation expected in 2027. (Finalised drop-in replacements for TLS, code signing, etc.)
Deployment Considerations