What Is It?
Post-quantum cryptography (PQC) is cryptography designed to survive quantum computers. Today's most widely used public-key algorithms RSA for encryption, ECDSA for signatures, ECDH for key exchange rely on mathematical problems that a large-scale quantum computer could solve in hours or minutes using Shor's algorithm. PQC algorithms replace those mechanisms with problems quantum computers cannot solve efficiently using any known technique.
In August 2024, NIST published the first post-quantum cryptography standards: ML-KEM (FIPS 203) for key encapsulation, ML-DSA (FIPS 204) for digital signatures, and SLH-DSA (FIPS 205) for hash-based signatures. These are the algorithms organizations should plan to adopt.
Symmetric cryptography, including AES-256 and SHA-3, is not broken by quantum computers. The problem is specific to public-key cryptography: the layer that establishes shared keys, authenticates servers, and verifies code and certificate signatures.
Why Does It Matter?
Post-quantum migration is a requirement for systems covered by applicable government policy. NSA CNSA 2.0 establishes phased requirements for National Security Systems, with milestones and exceptions in CNSSP 15 and the December 2024 NSA FAQ. OMB M-23-02 (November 2022) directs federal civilian agencies to inventory prioritized quantum-vulnerable systems and prepare for migration. Commercial organizations must assess the obligations that apply to their sector and contracts.
The urgency is real now because of harvest-now-decrypt-later (HNDL). Adversaries can capture encrypted traffic today communications, authentication tokens, API calls and store it for decryption once a capable quantum computer exists. Organizations whose data must remain confidential for five, ten, or twenty years are already exposed to this threat, regardless of when quantum computers actually arrive.
Cryptographic migrations at enterprise scale take years. Inventorying systems, testing new algorithms, updating protocols, replacing certificates, coordinating with vendors, and re-signing code artifacts is a multi-year program. Beginning before external deadlines arrive is the only way to migrate on your own terms.
How It Works
PQC algorithms use mathematical problems that quantum computers cannot speed up significantly. ML-KEM and ML-DSA rely on lattice mathematics: finding short vectors in high-dimensional grids. This is a different class of problem from integer factorization and discrete logarithm quantum computers offer no known advantage against it at practical parameter sizes.
SLH-DSA uses hash functions (SHA-2 or SHA-3) as its security foundation. Hash functions have no known quantum speedup beyond Grover's algorithm, which halves effective security. Using SHA-256 or larger is sufficient to maintain 128-bit post-quantum security.
PQC algorithms take over the roles of existing public-key mechanisms, but migration is not a simple algorithm swap. ML-KEM supports key establishment and ML-DSA supports digital signatures. Adoption in TLS 1.3, SSH, S/MIME, and code-signing workflows requires compatible protocols, libraries, certificates, and peers, along with interoperability and performance testing across legacy systems, supply chains, and hardware.
Enterprise Impact
For enterprise security and engineering teams, PQC migration involves three foundational steps.
Understand what you have
A cryptographic inventory (CBOM) identifies every system, library, and protocol using quantum-vulnerable algorithms and what data they protect. You cannot migrate what you cannot see.
Understand your risk
Systems protecting data that must remain confidential for years are at HNDL risk now. Root CA keys, long-lived archives, health data, and financial records deserve early attention.
Build a phased migration plan
Migration will take multiple years for large environments. A roadmap that sequences systems by risk, upgrade complexity, and vendor readiness is the starting point for making progress.
NIST Guidance
NIST's three August 2024 standards define the post-quantum migration target. Organizations should align their roadmaps to these algorithms.
FIPS 203: ML-KEM
The key encapsulation mechanism for establishing shared secrets. Primary mitigation for harvest-now-decrypt-later risk on data in transit.
FIPS 204: ML-DSA
The general-purpose digital signature algorithm. Replaces ECDSA for certificates, code signing, and authentication tokens.
FIPS 205: SLH-DSA
A hash-based backup signature scheme. Provides algorithm diversity independent of lattice assumptions.