What Is Post-Quantum Cryptography?
Post-quantum cryptography (PQC) refers to cryptographic algorithms designed to remain secure against attacks from both classical and quantum computers. The term distinguishes these algorithms from today's widely deployed public-key algorithms RSA, ECDH, and ECDSA which are mathematically vulnerable to a class of quantum algorithms. PQC algorithms are based on mathematical problems believed to be computationally hard even for quantum computers, making them suitable candidates for long-term cryptographic security. NIST finalized three post-quantum standards in August 2024: ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205).
PQC does not replace all of cryptography. Symmetric encryption such as AES-256 and hash functions such as SHA-3 and SHA-512 are not fundamentally broken by quantum computing at appropriate security levels Grover's algorithm provides only a quadratic speedup for unstructured search, effectively halving the key-length security margin rather than destroying it. The migration focus is specifically on public-key cryptography: the operations that establish shared session keys, authenticate server identities, and verify digital signatures across TLS, SSH, code signing pipelines, and PKI hierarchies.
The Classical Public-Key Foundation: RSA, ECDH, and ECDSA
The public-key algorithms that underpin internet security today were designed when classical computing was the only threat model. RSA's security rests on the difficulty of factoring large integers into their prime components: a 2048-bit RSA modulus cannot be factored in feasible time by classical computers. Elliptic-curve Diffie-Hellman (ECDH) and the Elliptic Curve Digital Signature Algorithm (ECDSA) rely on the discrete logarithm problem in elliptic-curve groups, which is similarly intractable for classical computers at standard key sizes. Both families have been the foundation of secure communications for decades.
The security assumptions underlying RSA and elliptic-curve cryptography are not hard for quantum computers. Shor's algorithm, a quantum algorithm published by mathematician Peter Shor in 1994, can solve both integer factorization and the discrete logarithm problem in polynomial time on a sufficiently large quantum computer. This means a capable quantum computer could break 2048-bit RSA and 256-bit ECDH using the same algorithm, rendering both families cryptographically obsolete simultaneously.
How Shor's Algorithm Breaks Classical Public-Key Cryptography
Shor's algorithm exploits quantum superposition and quantum interference to find the period of a mathematical function efficiently. For integer factorization, it converts the factoring problem into period-finding using the quantum Fourier transform, reducing what takes exponential time on classical computers to polynomial time on a quantum computer. The same approach applies to the discrete logarithm problem, which underpins elliptic-curve cryptography. Breaking 2048-bit RSA would require thousands of logical qubits with high error-correction fidelity far beyond today's noisy intermediate-scale quantum (NISQ) hardware.
Current quantum hardware cannot execute Shor's algorithm at scale against production-grade RSA or elliptic-curve keys. However, the cryptographic community and NIST have acted on the principle that migration should occur well before such hardware is available. Cryptographic migration across large enterprises and supply chains takes years. NIST's standardization process began in 2016 and delivered its first three finalized standards in 2024; work on additional algorithms continues.
Symmetric Cryptography and Hash Functions: Less Affected
Grover's algorithm, the primary quantum algorithm relevant to symmetric cryptography, provides a quadratic speedup for unstructured search. In practical terms, this halves the effective key-length security margin: AES-128 is reduced to approximately 64-bit effective security, while AES-256 retains approximately 128-bit effective security against quantum adversaries. NIST guidance affirms that AES-256, SHA-384, and SHA-512 provide adequate quantum security margins. Organizations do not need to replace their symmetric encryption or hashing schemes as part of PQC migration.
The migration focus is entirely on public-key operations. Key agreement mechanisms (ECDH, RSA-OAEP key transport), digital signature algorithms (ECDSA, RSA-PSS, EdDSA), and the certificate infrastructure built on them are the components that require replacement. Post-quantum migration programs that treat symmetric cryptography as equally urgent are misallocating resources; NIST SP 1800-38 is explicit that public-key cryptography migration is the near-term priority.
The NIST PQC Standardization Process (2016-2024)
NIST launched its Post-Quantum Cryptography Standardization Project in 2016 with a global call for algorithm submissions. Across multiple evaluation rounds, NIST and the international cryptographic research community analyzed candidates for security, performance, implementation characteristics, and resistance to side-channel attacks. The process was explicitly transparent and community-driven, with detailed analysis published at each stage.
NIST announced its initial algorithm selections in July 2022 and published draft standards for public comment in 2023. The three finalized standards were published in August 2024. Additionally, NIST selected FN-DSA (based on FALCON, expected as FIPS 206) and HQC as further standards providing algorithm diversity. NIST IR 8413 documents the third-round evaluation rationale and the considerations that led to the final selections.
Source summary (not a direct quotation)
ML-KEM is NIST's standardized module-lattice-based key encapsulation mechanism for establishing shared secrets.
ML-KEM (FIPS 203): The Primary Key Encapsulation Mechanism
ML-KEM, standardized as NIST FIPS 203 in August 2024, is a primary post-quantum key encapsulation mechanism for replacing vulnerable classical key establishment. Its security is related to the hardness of the Module Learning With Errors (Module-LWE) lattice problem. Deployment in TLS, IKEv2, SSH, or messaging requires protocol-specific integration and support.
FIPS 203 defines three parameter sets. ML-KEM-512 targets NIST security level 1 (comparable to AES-128). ML-KEM-768 targets security level 3 (comparable to AES-192) and is recommended for most production deployments. ML-KEM-1024 targets security level 5 (comparable to AES-256). During the migration period, ML-KEM is commonly deployed in hybrid mode alongside ECDH X25519 so that an adversary must break both algorithms simultaneously to compromise a session key.
Source summary (not a direct quotation)
This standard specifies key-encapsulation mechanisms (KEMs). A KEM is a set of algorithms that, under certain conditions, can be used by two parties to establish a shared secret key over a public channel.
ML-DSA (FIPS 204): The Primary Digital Signature Standard
ML-DSA, standardized as NIST FIPS 204 in August 2024, is a primary post-quantum digital signature algorithm for replacing vulnerable classical signatures. It is based on Module-LWE and Module-SIS lattice problems. Code signing, certificates, software update authentication, and other signing applications require compatible formats, protocols, and implementations.
Three parameter sets are defined: ML-DSA-44 at NIST security level 2, ML-DSA-65 at level 3 (recommended for most production use), and ML-DSA-87 at level 5. ML-DSA produces larger signatures and public keys than ECDSA but provides fast signing and deterministic signature generation, which eliminates the randomness dependency that created security vulnerabilities in some ECDSA deployments. ML-DSA is the primary replacement for ECDSA and RSA-PSS in PKI hierarchies, code signing pipelines, and authentication systems.
Source summary (not a direct quotation)
ML-DSA is NIST's standardized module-lattice-based scheme for generating and verifying digital signatures.
SLH-DSA (FIPS 205): Hash-Based Backup Signatures
SLH-DSA, standardized as FIPS 205 in August 2024, is a stateless hash-based signature scheme. Its security relies on hash-function properties rather than lattice assumptions; collision resistance alone is not a complete description. This provides an alternative mathematical foundation to ML-DSA. SLH-DSA is not approved for NSS use under CNSA 2.0.
SLH-DSA is slower and produces larger signatures than ML-DSA, making it less suitable for high-volume signing workloads. It is the preferred choice for root certificate authorities, firmware signing, and long-term archival signatures where conservative security assumptions and algorithm independence outweigh performance and size considerations. FIPS 205 defines parameter sets using SHA-2 or SHAKE hash functions at NIST security levels 1, 3, and 5.
Source summary (not a direct quotation)
This standard specifies a stateless hash-based digital signature scheme, SLH-DSA, which is derived from the SPHINCS+ submission to the NIST Post-Quantum Cryptography Standardization Project.
FN-DSA and HQC: Additional Standards in Progress
NIST selected two additional algorithms for standardization beyond the initial three. FN-DSA, based on FALCON and planned for FIPS 206, uses compact lattice-based signatures built on NTRU lattices. FIPS 206 remains in development. FN-DSA is not a stateful hash-based signing scheme; its sampling and implementation requirements need careful attention.
HQC (Hamming Quasi-Cyclic) was selected by NIST as an additional key encapsulation mechanism providing algorithm diversity relative to ML-KEM. HQC is based on error-correcting codes rather than lattice problems, so a fundamental weakness in Module-LWE would not compromise HQC's security. NIST's strategy of selecting algorithms from multiple mathematical families reflects the principle that a diverse algorithm portfolio reduces the systemic risk of a breakthrough in any single area of cryptanalysis.
Hybrid Cryptography: A Protocol-Specific Transition Option
Hybrid cryptography combines a classical algorithm with a post-quantum algorithm in a single protocol run, requiring both to be independently broken to compromise the session. For key establishment, a hybrid scheme uses both ECDH and ML-KEM, combining their outputs through a key derivation function so the final session key is secure as long as either algorithm remains unbroken. For digital signatures, a hybrid scheme requires verification of both a classical signature and a post-quantum signature, providing defense in depth during the transition period.
IETF work addresses hybrid key exchange for TLS 1.3 and the design and terminology of post-quantum migration. NSA does not require hybrid solutions for NSS security; any NSS hybrid deployment must follow its specific protocol and interoperability guidance. The NCCoE migration project and SP 1800-38 draft practice guide explore migration and interoperability. Hybrid deployment can reduce HNDL exposure where both endpoints support an appropriately designed and implemented construction.
The Harvest-Now, Decrypt-Later (HNDL) Threat
Harvest-now, decrypt-later (HNDL) is the primary risk that justifies beginning PQC migration before quantum computers capable of running Shor's algorithm at scale are operational. Adversaries intercept and archive encrypted network traffic TLS connections, VPN tunnels, encrypted file transfers for future decryption once a cryptographically relevant quantum computer becomes available. The attack is passive and undetectable. No decryption occurs at collection time; the archived ciphertext simply waits.
HNDL exploits the gap between when sensitive data is captured and when the hardware needed to decrypt it becomes operational. Nation-state adversaries with advanced signals intelligence infrastructure have the motivation, technical capability, and long-term operational planning required to run sustained HNDL collection programs. CISA, NSA, and NIST have all highlighted HNDL as the primary driver for beginning PQC migration now. Any organization generating data with a required confidentiality lifetime extending years into the future should treat HNDL as an active and current threat.
The Regulatory Landscape: NSA CNSA 2.0, OMB M-23-02, CISA, ETSI, DORA
NSA introduced CNSA 2.0 in September 2022. Its current FAQ describes CNSSP 15 milestones for NSS new acquisitions in 2027, equipment phase-out by the end of 2030, and mandated CNSA 2.0 use by the end of 2031, subject to documented exceptions. OMB M-23-02 (November 2022) requires federal agencies to inventory quantum-vulnerable cryptography and plan migration. Organizations must determine which policies apply to their systems rather than assume one universal deadline.
European organizations face parallel requirements. ETSI has published migration guidance including TR 103 619 on quantum-safe cryptography migration strategies and TS 119 312 specifying cryptographic suites for electronic signatures. The EU Digital Operational Resilience Act (DORA, Regulation 2022/2554), which entered application in January 2025, requires financial entities in the EU to maintain robust ICT risk management including cryptographic resilience. The IETF PQUIP working group is developing post-quantum protocol extensions for TLS, SSH, and other widely deployed internet protocols.
Source summary (not a direct quotation)
CNSA 2.0 specifies algorithms for NSS. Its current FAQ describes transition milestones and validation requirements, with exceptions governed by applicable policy.
OMB M-23-02: Federal Agency Migration Requirements
OMB M-23-02, issued by the Office of Management and Budget on November 18, 2022, establishes requirements for federal agencies to inventory quantum-vulnerable cryptography, prioritize systems by risk, and plan migration. The memorandum establishes post-quantum migration as a federal cybersecurity priority.
M-23-02 requires agencies to identify and document encryption use across their systems using a structured discovery approach, prioritize systems protecting data with long confidentiality lifetimes, and work toward replacing vulnerable algorithms with NIST-standardized post-quantum alternatives. Federal contractors and vendors supplying to civilian agencies are directly affected by these requirements, as agencies must address cryptographic vulnerabilities across their supply chains, not just in internally operated systems.
Source summary (not a direct quotation)
Agencies shall maintain a current inventory of their information systems that use cryptographic systems or software and prioritize the transition of those systems to post-quantum cryptographic standards.
Building a Cryptographic Inventory (CBOM)
The first concrete step in any PQC migration program is a comprehensive cryptographic inventory a Cryptographic Bill of Materials (CBOM). A CBOM maps every cryptographic algorithm in use across an organization's systems: network protocols, application code and libraries, X.509 certificates and PKI infrastructure, key management systems, firmware, embedded devices, and third-party software supply chain components. Without a complete CBOM, migration planning is guesswork and risk prioritization is impossible.
Discovery methods include network protocol scanning to identify TLS cipher suites and key exchange algorithms in active connections, static analysis of application source code and binary dependencies, certificate inventory of all X.509 certificates by algorithm and validity period, dependency scanning of software libraries and package manifests, and manual architectural review for cryptographic dependencies not captured by automated tooling. The CBOM serves as the primary input for migration planning and requires ongoing maintenance as systems change.
Crypto-Agility: Long-Term Cryptographic Resilience
Crypto-agility is the architectural property that allows cryptographic algorithms to be replaced without requiring changes to the broader systems that use them. A crypto-agile system separates algorithm specification from application logic: the algorithm in use is a configuration parameter or library choice rather than a hardcoded implementation detail. When NIST finalizes a new standard or deprecates an existing one, a crypto-agile system is updated through configuration or library updates rather than full application re-engineering.
The NIST NCCoE's guidance on crypto-agility for PQC migration emphasizes that organizations should treat this migration as an opportunity to build durable crypto-agile architecture rather than simply swapping one hardcoded algorithm for another. The PQC migration will not be the last cryptographic transition. As post-quantum standards mature and post-quantum algorithm analysis continues, organizations with crypto-agile architectures can respond to future updates at lower cost and with less operational risk than those who hardcode new algorithms as rigidly as old ones were hardcoded.
Getting Started: Priority Actions
Organizations beginning a PQC program should prioritize three immediate actions. First, initiate a comprehensive cryptographic inventory covering all systems, protocols, certificates, and supply chain dependencies. Without knowing what cryptography your organization uses and where, no migration planning is possible. Second, assess harvest-now exposure by identifying which systems generate data with long required confidentiality lifetimes these systems face the most immediate HNDL risk and should be the first migration targets. Third, begin evaluating hybrid ML-KEM deployment in your highest-priority systems.
Hybrid deployment of ML-KEM alongside ECDH X25519 in TLS connections provides immediate protection against future HNDL decryption without disrupting existing operations. Concurrently, test ML-DSA in non-production certificate authorities and code signing pipelines to understand performance and integration requirements before production rollout. The goal is a staged migration program that reduces the most risk first building technical capacity, organizational knowledge, and crypto-agile infrastructure rather than attempting a simultaneous migration of all systems under time pressure.
References
- [1]NISTNIST FIPS 203(2024)Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM)
- [2]NISTNIST FIPS 204(2024)Module-Lattice-Based Digital Signature Standard (ML-DSA)
- [3]NISTNIST FIPS 205(2024)Stateless Hash-Based Digital Signature Standard (SLH-DSA)
- [4]NISTNIST SP 1800-38 (preliminary draft)(2023)Migration to Post-Quantum Cryptography (preliminary drafts and current project guidance)
- [5]
- [6]NISTNIST Crypto Agility(2025)Crypto Agility
- [7]NSANSA CNSA 2.0(2024)The Commercial National Security Algorithm Suite 2.0 and Quantum Computing FAQ
- [8]NSANSA PQC FAQ(2022)Quantum Computing and Post-Quantum Cryptography FAQ
- [9]OMBOMB M-23-02(2022)Memorandum on Migrating to Post-Quantum Cryptography
- [10]CISACISA PQC Initiative(2022)Post-Quantum Cryptography Initiative
- [11]CISACISA/NSA/NIST Joint Guidance(2023)Quantum-Readiness: Migration to Post-Quantum Cryptography
- [12]ETSIETSI TR 103 619(2022)Quantum-Safe Cryptography; Migration and Co-existence
- [13]IETFIETF PQUIP WG(2022)Post-Quantum Use In Protocols Working Group
- [14]IETFIETF draft-ietf-tls-hybrid-design(2024)Hybrid key exchange in TLS 1.3
- [15]EUEU DORA (Regulation 2022/2554)(2022)Digital Operational Resilience Act
Related Guides
What Is Harvest Now Decrypt Later?
Harvest-now, decrypt-later (HNDL) is the most immediate cryptographic risk requiring action before quantum computers exist at scale. This guide explains how HNDL attacks work, what data is most exposed, and why cryptographic migration cannot wait.
ML-KEM Explained
ML-KEM (NIST FIPS 203) is the primary post-quantum key encapsulation mechanism, replacing RSA and ECDH in TLS, VPNs, and SSH. This guide explains how it works, its parameter sets, hybrid deployment, and migration from ECDH.
ML-DSA Explained
ML-DSA (NIST FIPS 204) is the primary post-quantum digital signature algorithm, replacing ECDSA and RSA signatures in PKI, code signing, and authentication. This guide explains how it works, its parameter sets, and migration from ECDSA.