Security

Post-Quantum
Cryptography

The encryption protecting nearly all internet traffic today would crumble against a large enough quantum computer. Post-quantum cryptography is the fix: new codes that run on the ordinary computers we already have, but that even a quantum machine can't break.

NIST PQC Standards Lattice Cryptography CRYSTALS-Kyber Learning With Errors Hash-Based Signatures Harvest Now, Decrypt Later

Why Today's Encryption Is Vulnerable

Most of the encryption that secures websites, email, and online banking relies on math problems that ordinary computers can't crack in any reasonable time — like finding the prime factors of an enormous number. Shor's algorithm on a quantum computer solves exactly these problems quickly, which would break the protection outright. (RSA rests on integer factorisation; Diffie-Hellman and elliptic curve on the discrete logarithm problem — both fall to Shor's algorithm in polynomial time.)

The other major type of encryption — the kind that scrambles the actual data once a connection is established — holds up much better. A quantum computer weakens it, but only modestly, and simply using a longer key restores full strength. (Symmetric ciphers like AES and hash functions like SHA face only Grover's quadratic speedup, effectively halving the security level; AES-256 in place of AES-128 suffices.)

Why this is urgent now: A code-breaking quantum computer may still be years or decades off, yet the danger is already here. Adversaries can record encrypted data today and simply wait — decrypting it the moment the hardware arrives. Anything that must stay secret for many years is already at risk. ("Harvest now, decrypt later.")

Algorithm Use Quantum Attack Status
RSA-2048 Key exchange, signatures Shor's algorithm → broken ✗ Vulnerable
ECC-256 Key exchange, signatures Shor's algorithm → broken ✗ Vulnerable
Diffie-Hellman Key exchange Shor's algorithm → broken ✗ Vulnerable
AES-128 Symmetric encryption Grover's → ~64-bit effective security ⚠ Weakened
AES-256 Symmetric encryption Grover's → ~128-bit effective security ✓ Adequate
SHA-256 Hashing Grover's → ~128-bit collision resistance ✓ Adequate
Integer lattice — regularly spaced array of points (Wolfram MathWorld)
A regularly spaced array of integer lattice points in 2D — every point has integer coordinates (m, n). Lattice-based cryptography derives its security from hard problems on high-dimensional versions of such structures (hundreds to thousands of dimensions), such as finding the Shortest or Closest Vector, believed to be intractable for both classical and quantum computers. Source: Wolfram MathWorld — "Integer Lattice", Eric W. Weisstein

Learning With Errors (LWE)

The hard problem: Imagine a set of equations that almost balance — each one is correct except for a small, random fudge added in. With the fudge, recovering the secret hidden in the equations becomes astonishingly hard, even with unlimited examples to study and even for a quantum computer. (Given many b = ⟨a, s⟩ + e (mod q) with public a, secret s, small error e — recover s.)

Why a quantum computer can't shortcut it: Unlike factoring, this problem has no hidden repeating pattern for Shor's algorithm to grab onto. The best a quantum computer can do is the modest Grover speedup, which a well-chosen key easily outpaces. (LWE reduces in the worst case to hard lattice problems CVP/SVP; no Shor-style periodicity is known.)

Kyber (ML-KEM): The method for safely exchanging keys, built on a structured form of this problem. Adopted by NIST as FIPS 203 in August 2024 — the primary quantum-safe key-exchange standard. (Module-LWE key encapsulation mechanism.)

Dilithium (ML-DSA): The companion method for digital signatures, proving who sent something and that it wasn't altered. Standardised as FIPS 204. (Based on Module-LWE and Module-SIS.)

🔲

Lattice-Based

The leading family and the basis of most new standards. It offers a good balance of speed and reasonably small keys. (Hard problems: LWE, NTRU, SIS. Standards: Kyber for key exchange; Dilithium and FALCON for signatures.)

#️⃣

Hash-Based

Rests entirely on the security of ordinary hash functions — among the most thoroughly tested assumptions in all of cryptography, making it the conservative, long-term-trustworthy choice. (SPHINCS+ / FIPS 205 is stateless; XMSS and LMS / NIST SP 800-208 are stateful with smaller signatures.)

📊

Code-Based

Built on the difficulty of decoding a deliberately garbled message. Very fast, very old and well-studied, but with large keys. NIST selected the HQC code-based scheme in March 2025 as a backup to Kyber that relies on different math, with its draft standard due in 2026 and finalisation expected in 2027. (McEliece, 1978, is the oldest PQC proposal; HQC chosen 2025 for algorithmic diversity.)

Cautionary Examples

Two once-promising schemes — Rainbow and SIKE — were both broken by ordinary (non-quantum) attacks in 2022, one of them on a laptop. A reminder that new schemes must be stress-tested for years before they can be trusted. (Rainbow: multivariate; SIKE: isogeny-based.)

The First Post-Quantum Standards

After a seven-year worldwide competition involving hundreds of submissions and thousands of cryptographers probing for weaknesses, NIST published its first finalised post-quantum standards in August 2024. They are designed as drop-in replacements for RSA and ECDSA in the protocols that secure the web. A fourth signature standard (FALCON) is still in draft, and a fifth algorithm (HQC) was selected in March 2025 as a code-based backup, with its own draft standard due in 2026 and finalisation expected in 2027. (Finalised drop-in replacements for TLS, code signing, etc.)

FIPS 203 · FINAL
ML-KEM (Kyber)
Key encapsulation — replaces ECDH/RSA for key exchange
FIPS 204 · FINAL
ML-DSA (Dilithium)
Digital signatures — replaces RSA/ECDSA
FIPS 205 · FINAL
SLH-DSA (SPHINCS+)
Hash-based signatures — conservative, larger but well-understood
FIPS 206 · DRAFT
FN-DSA (FALCON)
Compact lattice signatures — draft stage, final expected ~2026–2027
"Harvest Now, Decrypt Later": Intelligence agencies and sophisticated adversaries may already be archiving encrypted internet traffic. Any data encrypted today with RSA or ECC that must remain secret for more than a few years should be considered at risk. NIST has signalled the same urgency on the defensive side: in its internal report IR 8547, it set deadlines deprecating RSA and ECC by 2030 and disallowing them by 2035. Migration to post-quantum standards is a present-day imperative, not a future concern.
Aspect Classical (RSA/ECC) Post-Quantum (Kyber/Dilithium)
Public key size 256 bytes (ECC-256) 800–1,568 bytes (Kyber)
Signature size 64–256 bytes 2,420–4,595 bytes (Dilithium)
Speed (keygen) Fast Faster than RSA; competitive with ECC
TLS/HTTPS status Universally deployed Hybrid classical+PQC now default in major browsers and CDNs
Embedded / IoT devices Tight hardware support Larger memory footprint; active optimisation work
Side-channel resistance Well-studied, mitigations known Active research area; implementations need care