What Is Post-Quantum Cryptography?
Post-quantum cryptography (PQC) refers to cryptographic algorithms designed to remain secure against attacks from both classical and quantum computers. The term distinguishes these algorithms from today's widely deployed public-key algorithms RSA, ECDH, and ECDSA which are mathematically vulnerable to a class of quantum algorithms. PQC algorithms are based on mathematical problems believed to be computationally hard even for quantum computers, making them suitable candidates for long-term cryptographic security. NIST finalized three post-quantum standards in August 2024: ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205).
PQC does not replace all of cryptography. Symmetric encryption such as AES-256 and hash functions such as SHA-3 and SHA-512 are not fundamentally broken by quantum computing at appropriate security levels Grover's algorithm provides only a quadratic speedup for unstructured search, effectively halving the key-length security margin rather than destroying it. The migration focus is specifically on public-key cryptography: the operations that establish shared session keys, authenticate server identities, and verify digital signatures across TLS, SSH, code signing pipelines, and PKI hierarchies.
The Classical Public-Key Foundation: RSA, ECDH, and ECDSA
The public-key algorithms that underpin internet security today were designed when classical computing was the only threat model. RSA's security rests on the difficulty of factoring large integers into their prime components: a 2048-bit RSA modulus cannot be factored in feasible time by classical computers. Elliptic-curve Diffie-Hellman (ECDH) and the Elliptic Curve Digital Signature Algorithm (ECDSA) rely on the discrete logarithm problem in elliptic-curve groups, which is similarly intractable for classical computers at standard key sizes. Both families have been the foundation of secure communications for decades.
The security assumptions underlying RSA and elliptic-curve cryptography are not hard for quantum computers. Shor's algorithm, a quantum algorithm published by mathematician Peter Shor in 1994, can solve both integer factorization and the discrete logarithm problem in polynomial time on a sufficiently large quantum computer. This means a capable quantum computer could break 2048-bit RSA and 256-bit ECDH using the same algorithm, rendering both families cryptographically obsolete simultaneously.
How Shor's Algorithm Breaks Classical Public-Key Cryptography
Shor's algorithm exploits quantum superposition and quantum interference to find the period of a mathematical function efficiently. For integer factorization, it converts the factoring problem into period-finding using the quantum Fourier transform, reducing what takes exponential time on classical computers to polynomial time on a quantum computer. The same approach applies to the discrete logarithm problem, which underpins elliptic-curve cryptography. Breaking 2048-bit RSA would require thousands of logical qubits with high error-correction fidelity far beyond today's noisy intermediate-scale quantum (NISQ) hardware.
Current quantum hardware cannot execute Shor's algorithm at scale against production-grade RSA or elliptic-curve keys. However, the cryptographic community and NIST have acted on the principle that migration should occur well before such hardware is available. Cryptographic migration across large enterprises and supply chains takes years. NIST's standardization process, begun in 2016 and concluded in 2024, was specifically designed to provide organizations with standardized, ready-to-deploy alternatives before the threat becomes operational.
Symmetric Cryptography and Hash Functions: Less Affected
Grover's algorithm, the primary quantum algorithm relevant to symmetric cryptography, provides a quadratic speedup for unstructured search. In practical terms, this halves the effective key-length security margin: AES-128 is reduced to approximately 64-bit effective security, while AES-256 retains approximately 128-bit effective security against quantum adversaries. NIST guidance affirms that AES-256, SHA-384, and SHA-512 provide adequate quantum security margins. Organizations do not need to replace their symmetric encryption or hashing schemes as part of PQC migration.
The migration focus is entirely on public-key operations. Key agreement mechanisms (ECDH, RSA-OAEP key transport), digital signature algorithms (ECDSA, RSA-PSS, EdDSA), and the certificate infrastructure built on them are the components that require replacement. Post-quantum migration programs that treat symmetric cryptography as equally urgent are misallocating resources; NIST SP 1800-38 is explicit that public-key cryptography migration is the near-term priority.
The NIST PQC Standardization Process (2016-2024)
NIST launched its Post-Quantum Cryptography Standardization Project in 2016 with a global call for algorithm submissions. Sixty-nine candidates were submitted in the first round. Over four evaluation rounds spanning eight years, NIST and the international cryptographic research community analyzed candidates for security, performance, implementation characteristics, and resistance to side-channel attacks. The process was explicitly transparent and community-driven, with detailed analysis published at each stage.
NIST announced its initial algorithm selections in July 2022 and published draft standards for public comment in 2023. The three finalized standards were published in August 2024. Additionally, NIST selected FN-DSA (based on FALCON, expected as FIPS 206) and HQC as further standards providing algorithm diversity. NIST IR 8413 documents the third-round evaluation rationale and the considerations that led to the final selections.
“This standard specifies a key-encapsulation mechanism (KEM), called ML-KEM, which is derived from a public-key encryption and key-encapsulation mechanism submitted to the NIST Post-Quantum Cryptography Standardization Project as "CRYSTALS-Kyber."”
ML-KEM (FIPS 203): The Primary Key Encapsulation Mechanism
ML-KEM, standardized as NIST FIPS 203 in August 2024, is the primary post-quantum key encapsulation mechanism and the designated replacement for RSA key transport and ECDH in key establishment protocols. It is derived from CRYSTALS-Kyber and is based on the hardness of the Module Learning With Errors (Module-LWE) lattice problem. ML-KEM is designed for use in TLS 1.3, IKEv2, SSH, and encrypted messaging protocols.
FIPS 203 defines three parameter sets. ML-KEM-512 targets NIST security level 1 (comparable to AES-128). ML-KEM-768 targets security level 3 (comparable to AES-192) and is recommended for most production deployments. ML-KEM-1024 targets security level 5 (comparable to AES-256). During the migration period, ML-KEM is commonly deployed in hybrid mode alongside ECDH X25519 so that an adversary must break both algorithms simultaneously to compromise a session key.
“This standard specifies key-encapsulation mechanisms (KEMs). A KEM is a set of algorithms that, under certain conditions, can be used by two parties to establish a shared secret key over a public channel.”
ML-DSA (FIPS 204): The Primary Digital Signature Standard
ML-DSA, standardized as NIST FIPS 204 in August 2024, is the primary post-quantum digital signature algorithm and the designated replacement for ECDSA and RSA signatures throughout public key infrastructure. It is derived from CRYSTALS-Dilithium and is based on Module-LWE and Module-SIS lattice problems. ML-DSA supports code signing, X.509 certificate issuance and verification, software update authentication, and general-purpose signing across organizations' technology estates.
Three parameter sets are defined: ML-DSA-44 at NIST security level 2, ML-DSA-65 at level 3 (recommended for most production use), and ML-DSA-87 at level 5. ML-DSA produces larger signatures and public keys than ECDSA but provides fast signing and deterministic signature generation, which eliminates the randomness dependency that created security vulnerabilities in some ECDSA deployments. ML-DSA is the primary replacement for ECDSA and RSA-PSS in PKI hierarchies, code signing pipelines, and authentication systems.
“This standard specifies ML-DSA, a digital signature scheme derived from the CRYSTALS-Dilithium submission to the NIST Post-Quantum Cryptography Standardization Project.”
SLH-DSA (FIPS 205): Hash-Based Backup Signatures
SLH-DSA, standardized as NIST FIPS 205 in August 2024, is a stateless hash-based digital signature scheme. Its security depends entirely on the collision resistance of an underlying hash function rather than lattice-based mathematical assumptions, making it mathematically independent of ML-KEM and ML-DSA. This independence is intentional: if a future cryptanalytic weakness is discovered in the Module-LWE problem underpinning lattice algorithms, SLH-DSA's security is unaffected.
SLH-DSA is slower and produces larger signatures than ML-DSA, making it less suitable for high-volume signing workloads. It is the preferred choice for root certificate authorities, firmware signing, and long-term archival signatures where conservative security assumptions and algorithm independence outweigh performance and size considerations. FIPS 205 defines parameter sets using SHA-2 or SHAKE hash functions at NIST security levels 1, 3, and 5.
“This standard specifies a stateless hash-based digital signature scheme, SLH-DSA, which is derived from the SPHINCS+ submission to the NIST Post-Quantum Cryptography Standardization Project.”
FN-DSA and HQC: Additional Standards in Progress
NIST selected two additional algorithms for standardization beyond the initial three. FN-DSA, based on the FALCON signature scheme and expected as FIPS 206, uses compact lattice-based signatures built on NTRU lattices. Its signature sizes are substantially smaller than ML-DSA, making it well-suited for environments where bandwidth or storage is constrained. FN-DSA's stateful signing process requires careful implementation to avoid nonce reuse, which has implementation complexity implications relative to ML-DSA.
HQC (Hamming Quasi-Cyclic) was selected by NIST as an additional key encapsulation mechanism providing algorithm diversity relative to ML-KEM. HQC is based on error-correcting codes rather than lattice problems, so a fundamental weakness in Module-LWE would not compromise HQC's security. NIST's strategy of selecting algorithms from multiple mathematical families reflects the principle that a diverse algorithm portfolio reduces the systemic risk of a breakthrough in any single area of cryptanalysis.
Hybrid Cryptography: The Recommended Transition Strategy
Hybrid cryptography combines a classical algorithm with a post-quantum algorithm in a single protocol run, requiring both to be independently broken to compromise the session. For key establishment, a hybrid scheme uses both ECDH and ML-KEM, combining their outputs through a key derivation function so the final session key is secure as long as either algorithm remains unbroken. For digital signatures, a hybrid scheme requires verification of both a classical signature and a post-quantum signature, providing defense in depth during the transition period.
The IETF has active work on hybrid key exchange specifications for TLS 1.3 through the PQUIP working group and the draft-ietf-tls-hybrid-design specification. NSA's CNSA 2.0 guidance recommends hybrid deployment as an interim measure for National Security Systems during migration. NIST SP 1800-38 provides practical guidance on deploying hybrid cryptography in enterprise environments. Hybrid deployment allows organizations to protect against HNDL collection today without requiring simultaneous migration of all dependent systems.
The Harvest-Now, Decrypt-Later (HNDL) Threat
Harvest-now, decrypt-later (HNDL) is the primary risk that justifies beginning PQC migration before quantum computers capable of running Shor's algorithm at scale are operational. Adversaries intercept and archive encrypted network traffic TLS connections, VPN tunnels, encrypted file transfers for future decryption once a cryptographically relevant quantum computer becomes available. The attack is passive and undetectable. No decryption occurs at collection time; the archived ciphertext simply waits.
HNDL exploits the gap between when sensitive data is captured and when the hardware needed to decrypt it becomes operational. Nation-state adversaries with advanced signals intelligence infrastructure have the motivation, technical capability, and long-term operational planning required to run sustained HNDL collection programs. CISA, NSA, and NIST have all highlighted HNDL as the primary driver for beginning PQC migration now. Any organization generating data with a required confidentiality lifetime extending years into the future should treat HNDL as an active and current threat.
The Regulatory Landscape: NSA CNSA 2.0, OMB M-23-02, CISA, ETSI, DORA
The regulatory environment for PQC migration has become specific and binding for many organizations. NSA released the Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) in September 2022, specifying the post-quantum algorithms required for National Security Systems and establishing timelines for their adoption. CNSA 2.0 requires exclusive use of post-quantum algorithms by 2033 for most NSS categories. OMB M-23-02 (December 2022) requires all U.S. federal agencies to inventory cryptographic systems vulnerable to quantum attacks and submit prioritized migration plans.
European organizations face parallel requirements. ETSI has published migration guidance including TR 103 619 on quantum-safe cryptography migration strategies and TS 119 312 specifying cryptographic suites for electronic signatures. The EU Digital Operational Resilience Act (DORA, Regulation 2022/2554), which entered application in January 2025, requires financial entities in the EU to maintain robust ICT risk management including cryptographic resilience. The IETF PQUIP working group is developing post-quantum protocol extensions for TLS, SSH, and other widely deployed internet protocols.
“NSA is releasing the Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) to notify National Security System (NSS) owners and operators of the algorithms and timeline required to protect NSS from current and future threats including quantum computing.”
OMB M-23-02: Federal Agency Migration Requirements
OMB M-23-02, issued by the Office of Management and Budget in December 2022, establishes specific requirements for U.S. federal civilian agencies. Agencies must inventory all currently deployed cryptographic systems, identify which systems are vulnerable to quantum attacks, and submit prioritized migration plans. The memorandum establishes the migration of cryptographic systems as a federal cybersecurity priority.
M-23-02 requires agencies to identify and document encryption use across their systems using a structured discovery approach, prioritize systems protecting data with long confidentiality lifetimes, and work toward replacing vulnerable algorithms with NIST-standardized post-quantum alternatives. Federal contractors and vendors supplying to civilian agencies are directly affected by these requirements, as agencies must address cryptographic vulnerabilities across their supply chains, not just in internally operated systems.
“Agencies shall maintain a current inventory of their information systems that use cryptographic systems or software and prioritize the transition of those systems to post-quantum cryptographic standards.”
Building a Cryptographic Inventory (CBOM)
The first concrete step in any PQC migration program is a comprehensive cryptographic inventory a Cryptographic Bill of Materials (CBOM). A CBOM maps every cryptographic algorithm in use across an organization's systems: network protocols, application code and libraries, X.509 certificates and PKI infrastructure, key management systems, firmware, embedded devices, and third-party software supply chain components. Without a complete CBOM, migration planning is guesswork and risk prioritization is impossible.
Discovery methods include network protocol scanning to identify TLS cipher suites and key exchange algorithms in active connections, static analysis of application source code and binary dependencies, certificate inventory of all X.509 certificates by algorithm and validity period, dependency scanning of software libraries and package manifests, and manual architectural review for cryptographic dependencies not captured by automated tooling. The CBOM serves as the primary input for migration planning and requires ongoing maintenance as systems change.
Crypto-Agility: Long-Term Cryptographic Resilience
Crypto-agility is the architectural property that allows cryptographic algorithms to be replaced without requiring changes to the broader systems that use them. A crypto-agile system separates algorithm specification from application logic: the algorithm in use is a configuration parameter or library choice rather than a hardcoded implementation detail. When NIST finalizes a new standard or deprecates an existing one, a crypto-agile system is updated through configuration or library updates rather than full application re-engineering.
The NIST NCCoE's guidance on crypto-agility for PQC migration emphasizes that organizations should treat this migration as an opportunity to build durable crypto-agile architecture rather than simply swapping one hardcoded algorithm for another. The PQC migration will not be the last cryptographic transition. As post-quantum standards mature and post-quantum algorithm analysis continues, organizations with crypto-agile architectures can respond to future updates at lower cost and with less operational risk than those who hardcode new algorithms as rigidly as old ones were hardcoded.
Getting Started: Priority Actions
Organizations beginning a PQC program should prioritize three immediate actions. First, initiate a comprehensive cryptographic inventory covering all systems, protocols, certificates, and supply chain dependencies. Without knowing what cryptography your organization uses and where, no migration planning is possible. Second, assess harvest-now exposure by identifying which systems generate data with long required confidentiality lifetimes these systems face the most immediate HNDL risk and should be the first migration targets. Third, begin evaluating hybrid ML-KEM deployment in your highest-priority systems.
Hybrid deployment of ML-KEM alongside ECDH X25519 in TLS connections provides immediate protection against future HNDL decryption without disrupting existing operations. Concurrently, test ML-DSA in non-production certificate authorities and code signing pipelines to understand performance and integration requirements before production rollout. The goal is a staged migration program that reduces the most risk first building technical capacity, organizational knowledge, and crypto-agile infrastructure rather than attempting a simultaneous migration of all systems under time pressure.
References
- [1]NISTNIST FIPS 203(2024)Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM)
- [2]NISTNIST FIPS 204(2024)Module-Lattice-Based Digital Signature Standard (ML-DSA)
- [3]NISTNIST FIPS 205(2024)Stateless Hash-Based Digital Signature Standard (SLH-DSA)
- [4]
- [5]
- [6]
- [7]NSANSA CNSA 2.0(2022)Commercial National Security Algorithm Suite 2.0
- [8]NSANSA PQC FAQ(2022)Quantum Computing and Post-Quantum Cryptography FAQ
- [9]OMBOMB M-23-02(2022)Memorandum on Migrating to Post-Quantum Cryptography
- [10]CISACISA PQC Initiative(2022)Post-Quantum Cryptography Initiative
- [11]CISACISA/NSA/NIST Joint Guidance(2023)Quantum-Readiness: Migration to Post-Quantum Cryptography
- [12]ETSIETSI TR 103 619(2022)Quantum-Safe Cryptography; Migration and Co-existence
- [13]IETFIETF PQUIP WG(2022)Post-Quantum Use In Protocols Working Group
- [14]IETFIETF draft-ietf-tls-hybrid-design(2024)Hybrid key exchange in TLS 1.3
- [15]EUEU DORA (Regulation 2022/2554)(2022)Digital Operational Resilience Act
Related Guides
What Is Harvest Now Decrypt Later?
Harvest-now, decrypt-later (HNDL) is the most immediate cryptographic risk requiring action before quantum computers exist at scale. This guide explains how HNDL attacks work, what data is most exposed, and why cryptographic migration cannot wait.
ML-KEM Explained
ML-KEM (NIST FIPS 203) is the primary post-quantum key encapsulation mechanism, replacing RSA and ECDH in TLS, VPNs, and SSH. This guide explains how it works, its parameter sets, hybrid deployment, and migration from ECDH.
ML-DSA Explained
ML-DSA (NIST FIPS 204) is the primary post-quantum digital signature algorithm, replacing ECDSA and RSA signatures in PKI, code signing, and authentication. This guide explains how it works, its parameter sets, and migration from ECDSA.