Short answer

    Post-quantum cryptography is a family of public-key algorithms designed to resist attacks by future quantum computers while running on today's ordinary computers and networks. It replaces vulnerable methods such as RSA and elliptic-curve cryptography for key establishment and digital signatures. NIST leads the main standardization effort. Adopting it is a migration across systems, suppliers and data flows, not a single product change.

    In one sentence: Post-quantum cryptography is the replacement for public-key methods that quantum computers are expected to break.

    Part of Standards and regulation in the Knowledge Center

    Definitional Guide

    Think Earlier.

    The quantum problem starts before the quantum computer arrives.

    What is Post-Quantum Cryptography?

    Post-Quantum Cryptography (PQC), also known as quantum-resistant or quantum-safe cryptography, refers to cryptographic algorithms specifically designed to be secure against attacks from both classical computers and future quantum computers.

    The Short Answer

    PQC is the next generation of encryption. Current encryption (RSA, ECC) will be breakable by quantum computers. PQC algorithms are designed to remain secure even when powerful quantum computers exist. NIST finalized the first standards in 2024.

    Why Do We Need Post-Quantum Cryptography?

    Today's widely-used public-key cryptography (RSA, Elliptic Curve) relies on mathematical problems that are extremely difficult for classical computers to solve, but quantum computers, using algorithms like Shor's algorithm, will be able to solve them efficiently.

    When sufficiently powerful quantum computers exist (the timing is uncertain), they could:

    • Break encrypted communications in real-time
    • Forge digital signatures
    • Decrypt data collected today (HNDL attacks)
    • Compromise certificate authorities and PKI infrastructure

    NIST PQC Standards (Finalized 2024)

    After an 8-year evaluation process, the U.S. National Institute of Standards and Technology (NIST) finalized the first PQC standards:

    CRYSTALS-Kyber (ML-KEM)

    Key Encapsulation

    Used for establishing shared secrets and encrypting data. Based on lattice problems. Replaces RSA and ECDH for key exchange.

    CRYSTALS-Dilithium (ML-DSA)

    Digital Signatures

    Used for authentication and non-repudiation. Based on lattice problems. Replaces RSA and ECDSA for signatures.

    When Should Organizations Migrate?

    The migration timeline depends on your data sensitivity and infrastructure complexity. Key considerations include:

    Critical Timeline Factors

    • Data Shelf Life: If your data must remain confidential for 10+ years, it's already at risk from HNDL attacks
    • Migration Time: Full cryptographic migration is a multi-year program in large organizations; estimate your own from inventory and supplier lead times
    • Quantum Timeline: The arrival date of a cryptographically relevant quantum computer is uncertain; NIST's draft transition guidance plans to disallow quantum-vulnerable public-key algorithms after 2035

    Migration Best Practices

    1. Inventory: Catalog all cryptographic assets across your organization
    2. Prioritize: Focus first on long-lived secrets and high-value data
    3. Hybrid Approach: Implement hybrid classical + PQC solutions during transition
    4. Crypto Agility: Design systems to easily swap algorithms in the future
    5. Vendor Engagement: Work with technology providers on their PQC roadmaps

    What Organizations Should Do Now

    • Assess your current cryptographic inventory and quantum risk exposure
    • Understand which systems and data are most vulnerable
    • Plan a phased migration roadmap with governance oversight
    • Monitor vendor PQC adoption and regulatory requirements
    • Document your quantum risk management approach for stakeholders

    What PQC does, what it does not, and how it differs from QKD

    Purpose. Post-quantum cryptography replaces the public-key algorithms that a large enough quantum computer could break. It runs on ordinary computers and networks.

    Where public-key cryptography is used. Two jobs, which migrate separately:

    • Key establishment: agreeing the keys that protect a connection or stored data, for example in TLS or VPNs. NIST's standard for this is ML-KEM (FIPS 203).
    • Digital signatures: proving who sent or approved something, for example certificates, code signing and document signing. NIST's standards are ML-DSA (FIPS 204) and SLH-DSA (FIPS 205).

    PQC is not quantum key distribution. QKD uses dedicated optical hardware to exchange keys between two endpoints. It does not sign anything and needs separate authentication. QCI's position note states QKD is not a substitute for post-quantum cryptography and is not a quantum-readiness action under QCI-QS1 (QCI-PN-01 v1.1).

    Algorithms are only the start. Protection depends on implementation and migration: finding where vulnerable cryptography is used, choosing approved profiles, upgrading products and suppliers, testing, and retiring old paths. See crypto agility and the migration roadmap.

    Limits. PQC addresses one risk: quantum attacks on public-key cryptography. It does not fix weak implementations, stolen keys, misconfiguration or other cybersecurity risks, and it does not by itself protect data already captured under older cryptography.

    For the standards themselves, see NIST PQC standards.

    Assess Your PQC Readiness

    Understand where your organization stands on the path to quantum-safe cryptography with a comprehensive Q-Risk Score assessment.

    Continue Learning

    What is HNDL?

    Understand why adversaries are harvesting your encrypted data today

    What is Q-Risk Score?

    Measure your organization's quantum vulnerability and readiness

    Quantum Risk Governance

    Map PQC migration to your regulatory obligations