Post-Quantum Cryptography
Quantum Security
Quantum computing does not just threaten encryption it invalidates the mathematical foundations that entire security architectures are built upon. NIST has finalised the standards. The migration window is open. State actors are already collecting.
SHOR'S ALGORITHM
GROVER'S ALGORITHM
NIST FIPS 203/204/205
ML-KEM / ML-DSA
CRYPTO-AGILITY
The Problem Space
Quantum computing is not simply "faster cryptography breaking." It is a fundamental shift in computational capability that renders certain mathematical problems and the entire security architecture built upon them invalid. Systems designed with the assumption that large integer factorisation is computationally infeasible face a direct, documented change in their threat model.
The question is not whether cryptographically relevant quantum computers will exist. IBM's roadmap, documented error-correction advances, and sustained national-scale investment make the trajectory clear. The question is the planning horizon and for data with multi-year confidentiality requirements, that planning horizon is already past.
Y2Q Assessment: The 2035 NIST deprecation deadline is not the risk threshold it is the regulatory final deadline. High-risk systems protecting long-lived sensitive data face harvest-now-decrypt-later exposure today. The effective migration deadline for those systems is now.
The NIST Post-Quantum Standards
NIST completed its seven-year post-quantum cryptography standardisation process in August 2024. The published standards are:
- FIPS 203 (ML-KEM) Key encapsulation mechanism replacing RSA and ECDH. Based on the Module-LWE hardness problem. Three parameter sets for different security levels. This is the primary algorithm for quantum-safe key exchange in TLS and other protocols.
- FIPS 204 (ML-DSA) Digital signature algorithm replacing RSA-PSS and ECDSA. Based on Module-LWE and Module-SIS. Deterministic signing, fast verification. This is the primary algorithm for quantum-safe digital signatures.
- FIPS 205 (SLH-DSA) Stateless hash-based signature algorithm. Security based only on hash function properties entirely independent of lattice assumptions. Larger signatures, more conservative security basis. Recommended as a hedge alongside ML-DSA.
- FN-DSA (FIPS 206, in progress) NTRU lattice-based signature algorithm (FALCON). Compact signatures suitable for constrained environments. Standardisation ongoing.
NIST guidance: begin deploying ML-KEM for key exchange immediately. Plan ML-DSA and SLH-DSA migration for signing applications. NSA CNSA 2.0 sets specific timelines for National Security System migration.
Harvest-Now-Decrypt-Later: Why the Threat Is Present
The most important and most misunderstood aspect of quantum security is the harvest-now-decrypt-later threat vector. It changes the threat model in a fundamental way:
- The collection does not require quantum capability Adversaries need only the ability to intercept and store encrypted traffic, which they already have
- Long-lived sensitive data is the primary target State secrets, intellectual property, legal and financial records, diplomatic communications, and medical data with multi-decade sensitivity
- The attack is retroactive Data encrypted years or decades ago becomes decryptable when quantum hardware arrives. There is no patching of historical communications.
- Nation-state actors have the infrastructure and patience NSA and CISA have explicitly characterised HNDL as an active collection strategy by state-sponsored adversaries
- The effective breach has already occurred for high-risk data If this data was transmitted using classical cryptography and could have been intercepted, it should be treated as potentially compromised against a future quantum-capable adversary
Migration Uncertainty and the Crypto-Agility Imperative
Post-quantum cryptography carries its own uncertainties that responsible analysis must acknowledge:
- Unproven at enterprise scale Post-quantum algorithms have not been deployed at the scale of RSA/ECC; implementation vulnerabilities remain possible
- Potential future cryptanalysis Mathematical techniques could weaken lattice-based algorithms; this is why multiple distinct algorithm families (lattice, hash-based) have been standardised
- Performance and protocol impact ML-KEM ciphertexts and ML-DSA signatures are larger than classical equivalents; protocol-level changes and performance testing are required
- Transition period exposure During hybrid classical/PQC deployment, systems must handle both; hybrid key exchange mitigates exposure during this window
- Migration complexity at scale Enterprise cryptographic migration requires a complete C-BOM as the starting inventory; without it, migration is ungoverned and incomplete
Crypto-Agility: Design cryptographic systems so algorithms can be replaced without architectural redesign. The quantum transition will not be the last forced migration. Systems built for crypto-agility today will be far less costly to maintain across future cryptographic transitions.