What Is It?
Post-quantum cryptography (PQC) refers to cryptographic algorithms designed to remain secure against attacks by both classical computers and quantum computers. Unlike today's widely deployed public-key algorithms, PQC algorithms are based on mathematical problems believed to be hard for quantum computers to solve efficiently using any known algorithm.
NIST completed a multi-year standardization process in August 2024 with three finalized standards: ML-KEM (FIPS 203) for key encapsulation, ML-DSA (FIPS 204) for digital signatures, and SLH-DSA (FIPS 205) as a hash-based backup signature scheme. A fourth standard, FN-DSA (FIPS 206, based on FALCON), is in final stages. HQC has been selected as a backup key encapsulation mechanism for algorithm diversity.
PQC does not replace all of cryptography. Symmetric algorithms such as AES-256 and hash functions such as SHA-3 are largely quantum-resistant with appropriate key sizes. The problem is specifically in public-key cryptography: the mechanisms that establish session keys, authenticate servers, and verify code and certificate signatures.
Why Does It Matter?
RSA, ECDH, and ECDSA rest on mathematical problems that Shor's algorithm can solve efficiently on a sufficiently large quantum computer. When such machines become available, the entire public-key layer protecting internet traffic, software supply chains, and PKI hierarchies will be compromised.
The harvest-now-decrypt-later (HNDL) threat means the risk exists today. Adversaries can capture encrypted traffic now and decrypt it once a capable quantum computer is available. Organizations protecting data that must remain confidential for years or decades face exposure from current collection, not only from future quantum attacks.
NSA CNSA 2.0 (September 2022) requires all National Security Systems to migrate to post-quantum algorithms by 2033. OMB M-23-02 (December 2022) directs federal agencies to inventory quantum-vulnerable cryptography and develop migration plans. Commercial sectors face increasing pressure through regulators, auditors, and customers.
How It Works
NIST's standardized algorithms draw on three distinct mathematical families, each believed to be resistant to both classical and quantum attacks.
Lattice problems (ML-KEM, ML-DSA)
Security rests on the hardness of finding short vectors in high-dimensional lattices. The Module Learning With Errors (M-LWE) and Module Short Integer Solution (M-SIS) problems underpin both algorithms. No known classical or quantum algorithm solves these efficiently at the parameter sizes used.
Hash functions (SLH-DSA)
Security depends only on the collision resistance and preimage resistance of SHA-2 or SHA-3. Hash functions have no known quantum speedup beyond Grover's algorithm, which halves effective security manageable by using SHA-256 or larger.
Code-based problems (HQC)
Security rests on the difficulty of decoding random linear codes. HQC is selected as a backup KEM to provide algorithm diversity independent of lattice assumptions.
Enterprise Impact
PQC migration is a multi-year program, not a patch cycle. Key activities for enterprise teams:
Cryptographic inventory
Discover all uses of quantum-vulnerable algorithms (RSA, ECDH, ECDSA) across systems, libraries, firmware, and supply chains. A Cryptography Bill of Materials (CBOM) is the output of this phase.
Risk prioritization
Focus first on data with long confidentiality lifetimes and on systems that are hardest to upgrade. HNDL risk concentrates in systems protecting data archived for years or decades.
Hybrid deployment
Run classical and post-quantum algorithms in parallel during transition. Hybrid key exchange (ECDH + ML-KEM) and hybrid signatures are supported in major TLS stacks and are the recommended interim approach.
Vendor and supply chain coordination
Most cryptographic dependencies live in third-party libraries, HSMs, TLS stacks, and cloud services. Migration requires vendor roadmap alignment and procurement criteria updates.
Crypto-agility
Design systems to swap algorithms via configuration, not code rewrites. Crypto-agility reduces the cost of this migration and future ones.
NIST Guidance
NIST finalized three post-quantum cryptography standards in August 2024. These are the algorithms organizations should plan to adopt.
FIPS 203: ML-KEM
Key encapsulation mechanism for establishing shared secrets. Replaces ECDH and RSA key exchange. Three parameter sets: ML-KEM-512, ML-KEM-768 (recommended), ML-KEM-1024.
FIPS 204: ML-DSA
General-purpose digital signature algorithm. Replaces ECDSA and RSA signatures for code signing, certificates, and authentication. Three parameter sets: ML-DSA-44, ML-DSA-65 (recommended), ML-DSA-87.
FIPS 205: SLH-DSA
Hash-based backup signature scheme providing algorithm diversity independent of lattice assumptions. 12 parameter sets varying hash function, security level, and size/speed tradeoff.
NIST IR 8547 (draft)
Transition guidance covering algorithm migration priorities, hybrid approaches, and crypto-agility requirements for federal systems.