What Is It?
Post-quantum cryptography (PQC) is cryptography designed to survive quantum computers. Today's most widely used public-key algorithms RSA for encryption, ECDSA for signatures, ECDH for key exchange rely on mathematical problems that a large-scale quantum computer could solve in hours or minutes using Shor's algorithm. PQC algorithms replace those mechanisms with problems quantum computers cannot solve efficiently using any known technique.
In August 2024, NIST published the first post-quantum cryptography standards: ML-KEM (FIPS 203) for key encapsulation, ML-DSA (FIPS 204) for digital signatures, and SLH-DSA (FIPS 205) for hash-based signatures. These are the algorithms organizations should plan to adopt.
Symmetric cryptography, including AES-256 and SHA-3, is not broken by quantum computers. The problem is specific to public-key cryptography: the layer that establishes shared keys, authenticates servers, and verifies code and certificate signatures.
Why Does It Matter?
The migration from classical to post-quantum cryptography is not optional. NSA CNSA 2.0 (September 2022) requires all National Security Systems to complete PQC migration by 2033. OMB M-23-02 (December 2022) directs federal agencies to inventory quantum-vulnerable systems and build migration plans. Commercial regulators in finance, healthcare, and critical infrastructure are moving in the same direction.
The urgency is real now because of harvest-now-decrypt-later (HNDL). Adversaries can capture encrypted traffic today communications, authentication tokens, API calls and store it for decryption once a capable quantum computer exists. Organizations whose data must remain confidential for five, ten, or twenty years are already exposed to this threat, regardless of when quantum computers actually arrive.
Cryptographic migrations at enterprise scale take years. Inventorying systems, testing new algorithms, updating protocols, replacing certificates, coordinating with vendors, and re-signing code artifacts is a multi-year program. Beginning before external deadlines arrive is the only way to migrate on your own terms.
How It Works
PQC algorithms use mathematical problems that quantum computers cannot speed up significantly. ML-KEM and ML-DSA rely on lattice mathematics: finding short vectors in high-dimensional grids. This is a different class of problem from integer factorization and discrete logarithm quantum computers offer no known advantage against it at practical parameter sizes.
SLH-DSA uses hash functions (SHA-2 or SHA-3) as its security foundation. Hash functions have no known quantum speedup beyond Grover's algorithm, which halves effective security. Using SHA-256 or larger is sufficient to maintain 128-bit post-quantum security.
In practice, PQC algorithms are drop-in replacements for existing mechanisms. ML-KEM replaces ECDH for key exchange. ML-DSA replaces ECDSA for signatures. The algorithms integrate into TLS 1.3, SSH, S/MIME, and code-signing workflows. The challenge is not mathematical it is executing the migration across legacy systems, supply chains, and hardware at scale.
Enterprise Impact
For enterprise security and engineering teams, PQC migration involves three foundational steps.
Understand what you have
A cryptographic inventory (CBOM) identifies every system, library, and protocol using quantum-vulnerable algorithms and what data they protect. You cannot migrate what you cannot see.
Understand your risk
Systems protecting data that must remain confidential for years are at HNDL risk now. Root CA keys, long-lived archives, health data, and financial records deserve early attention.
Build a phased migration plan
Migration will take multiple years for large environments. A roadmap that sequences systems by risk, upgrade complexity, and vendor readiness is the starting point for making progress.
NIST Guidance
NIST's three August 2024 standards define the post-quantum migration target. Organizations should align their roadmaps to these algorithms.
FIPS 203: ML-KEM
The key encapsulation mechanism for establishing shared secrets. Primary mitigation for harvest-now-decrypt-later risk on data in transit.
FIPS 204: ML-DSA
The general-purpose digital signature algorithm. Replaces ECDSA for certificates, code signing, and authentication tokens.
FIPS 205: SLH-DSA
A hash-based backup signature scheme. Provides algorithm diversity independent of lattice assumptions.