Post-Quantum Cryptography Reference Guides

A comprehensive reference covering why classical public-key cryptography is being replaced, the NIST-standardized algorithms (ML-KEM, ML-DSA, SLH-DSA), the harvest-now decrypt-later threat, and how to plan and execute a cryptographic migration program.

Harvest-now, decrypt-later (HNDL) is the most immediate cryptographic risk requiring action before quantum computers exist at scale. This guide explains how HNDL attacks work, what data is most exposed, and why cryptographic migration cannot wait.

ML-KEM (NIST FIPS 203) is the primary post-quantum key encapsulation mechanism, replacing RSA and ECDH in TLS, VPNs, and SSH. This guide explains how it works, its parameter sets, hybrid deployment, and migration from ECDH.

ML-DSA (NIST FIPS 204) is the primary post-quantum digital signature algorithm, replacing ECDSA and RSA signatures in PKI, code signing, and authentication. This guide explains how it works, its parameter sets, and migration from ECDSA.

SLH-DSA (NIST FIPS 205) is a stateless hash-based post-quantum signature scheme providing algorithm diversity independent of lattice mathematics. This guide explains when to use SLH-DSA versus ML-DSA, its parameter sets, and its role in long-term trust infrastructure.

Crypto-agility is the architectural property that allows cryptographic algorithms to be replaced without re-engineering dependent systems. This guide explains what crypto-agility means, why it matters for post-quantum migration, and how to build crypto-agile architecture.

Cryptographic discovery is the process of identifying every algorithm in use across an organization's systems, protocols, libraries, and supply chains. This guide explains discovery methods, how to build a CBOM, and how to translate findings into a migration roadmap.

A quantum risk assessment scores an organization's cryptographic exposure by data sensitivity, confidentiality lifetime, system criticality, and regulatory context. This guide explains the four risk dimensions and how to translate findings into a prioritized migration roadmap.

A Cryptographic Bill of Materials (CBOM) is a structured inventory of every cryptographic asset in an organization's systems. This guide explains what a CBOM contains, how to build one, and how to use it as the foundation of a post-quantum migration program.

Hybrid cryptography combines classical and post-quantum algorithms so both must be broken simultaneously for security to be compromised. This guide explains how hybrid key establishment and hybrid signatures work, their security properties, and how to deploy them during PQC migration.