For thirty years, we’ve built the digital world on a polite fiction: that some math problems are too hard to ever solve. Your bank login, your company’s VPN, the software update on your phone, the medical records in the cloud; they all rely on the fact that factoring a 2048-bit number would take classical computers millions of years.
Quantum computers don’t play by those rules. And while we don’t have a cryptographically relevant quantum computer today, the day that fiction breaks is no longer theoretical. It’s on a roadmap. Post-Quantum Cryptography, or PQC, is how we survive it.
The Problem: “Q-Day” and the Harvest Now, Decrypt Later Threat
Modern public-key cryptography relies on two families of problems: integer factorization (RSA) and discrete logarithms (Diffie-Hellman, ECDSA, ECDH). Its security rests entirely on the assumption that these problems are too complex for traditional computers to solve, which keeps our encrypted text safe. And that assumption is perfectly valid for humans or classical computers. But quantum computers don’t play by those rules. Back in 1994, Peter Shor created an algorithm that makes solving these problems trivial for a sufficiently large quantum computer.
For a long time, that threat was just theory because we lacked the hardware, but today, that gap is closing. IBM, Google, Intel, and several startups are in a race to scale from hundreds to thousands of logical qubits.
Most experts don’t predict a code-breaking quantum computer next year, but most also put it within the next 10 to 15 years.
You might think “we can just upgrade when it arrives.”
No, we can’t, and there are three reasons why
First, the data has a long shelf life
An adversary can record your encrypted traffic today and simply store it. When a quantum computer becomes available, they decrypt it retroactively. Intelligence agencies call this “Harvest Now, Decrypt Later.” If your data needs to stay secret for more than ten years, health records, state secrets, intellectual property, long-term contracts, that attack is already happening.
Second, everything is connected
RSA and elliptic-curve cryptography aren’t just in your browser padlock. They’re in code-signing certificates, e-passports, IoT firmware, car keys, blockchain wallets, and the root certificates baked into hardware that can’t be easily updated.
Third, migration takes longer than invention
The last major crypto transition, from SHA-1 to SHA-2, took over a decade. PQC is ten times bigger.
What Post-Quantum Cryptography Actually Is
It’s important to clear up a misconception; post-quantum cryptography is not quantum cryptography.
True quantum cryptography secures data using the physical laws of nature rather than mathematical formulas. For example, Quantum Key Distribution (QKD) uses quantum physics itself to exchange keys and requires specialised hardware like lasers and fibre. PQC is different. It’s classical cryptography, algorithms that run on the laptops and servers we already have, but based on math problems that both classical and quantum computers find hard. In other words, rather than replacing the laptops and servers we already have, we simply update their software to rely on mathematical problems that outsmart even quantum processing power.
The NIST competition focused on the following
Lattice-based cryptography: Based on finding short vectors in high-dimensional lattices. Extremely fast and versatile. This is the current frontrunner.
Hash-based signatures: Based on the security of hash functions. Very well-understood, but signatures can be large.
Code-based cryptography: Based on decoding random linear codes. Old and trusted, but with huge key sizes.
Multivariate and Isogeny-based: Other mathematical approaches that have had a bumpier ride in the NIST process.
The beauty of PQC is that you don’t need a quantum computer to use it. You need to replace the algorithms.
The Standards Are Here: NIST Has Chosen
After an open, global competition that started in 2016 with 82 candidates, NIST made it official.
On August 13, 2024, the U.S. Department of Commerce approved the first three post-quantum standards:
FIPS 203, ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism): Derived from CRYSTALS-Kyber. This is your new key exchange. It will replace ECDH for establishing a shared secret in TLS, VPNs, and messaging.
FIPS 204, ML-DSA (Module-Lattice-Based Digital Signature Algorithm): Derived from CRYSTALS-Dilithium. This is your new general-purpose signature. It will replace ECDSA and RSA signatures for authenticating software, websites, and identities.
FIPS 205, SLH-DSA (Stateless Hash-Based Digital Signature Algorithm): Derived from SPHINCS+. A conservative, hash-based backup signature with different security assumptions than lattice systems.
A fourth, FALCON-based algorithm now called FN-DSA (FIPS 206), is in development for use cases that need smaller signatures.
These are no longer research projects. In 2025, Apple added PQ3 to iMessage using Kyber, Google Chrome enabled hybrid Kyber for TLS 1.3 by default, and Cloudflare, AWS, and Microsoft began offering PQC in their libraries. The standard is set. Deployment has started.
How PQC Will Affect the Cybersecurity Landscape
This is not a simple drop-in replacement. It will reshape how we think about security.
Bigger keys, bigger everything
This is the most immediate engineering shock. An RSA-2048 public key is 256 bytes. An ML-KEM-768 public key is 1,184 bytes. An ML-DSA signature is around 2,400 bytes versus 64 bytes for ECDSA. That might sound small, but when you multiply it by millions of TLS handshakes, embedded SIM cards, or DNSSEC packets that must stay under 512 bytes, it breaks things. Protocols need to be redesigned for fragmentation, caching, and bandwidth.
Crypto agility becomes mandatory
For years, companies hard-coded “we use RSA.” PQC teaches a hard lesson: algorithms are perishable. The new paradigm is crypto-agility; the ability to swap algorithms quickly without rebuilding your entire infrastructure. Organisations that build agility now will survive both the quantum transition and whatever comes after PQC.
The hybrid era will be messy
No one will flip a switch from classical to quantum-safe overnight. The next 5-10 years will be hybrid: X25519 + ML-KEM, ECDSA + ML-DSA used together in the same connection. This provides backward compatibility and ensures that if the new PQC algorithm has a flaw, the classical one still protects you. But hybrids double complexity, and complexity is the enemy of security. Implementation bugs will be our biggest risk.
Digital trust infrastructure needs to be rebuilt
Certificate Authorities must issue certificates with PQC signatures. Hardware Security Modules (HSMs), smart cards, and TPM chips need firmware updates to handle new math. Code-signing for Windows drivers, iOS apps, and car ECUs needs to be re-issued. For long-lived devices like satellites or industrial controllers that were never designed to be updated, this is an existential problem.
A new compliance reality
The U.S. National Security Memorandum NSM-10 mandates federal agencies migrate to PQC by 2035, with high-priority systems much earlier. NIST’s standards trigger similar requirements globally. Soon, “Is your product PQC-compliant?” will be as common in RFPs as “Do you support TLS 1.2?” is today.
What Should You Do Now? Don’t Panic, But Don’t Wait
You don’t need a quantum PhD. You need an inventory.
Discover your cryptography
Most organisations don’t know where they use RSA or ECDSA. Scan your code, network traffic, certificates, libraries, and vendor dependencies. There are automated tools for CBOMs, Cryptography Bills of Materials.
Prioritize crown jewels
Start with data that needs long-term confidentiality and systems with long lifecycles. Root CAs, identity providers, firmware signing keys, and backups of sensitive data are first.
Experiment in the lab
Spin up TLS with ML-KEM in OpenSSL 3.4+, test hybrid signatures in your PKI, measure performance. Lattice algorithms are actually faster than RSA in many cases, but signature verification flows will need tuning.
Demand agility from vendors
Ask every security vendor: What’s your PQC roadmap? When will your HSM, VPN, browser, and cloud KMS support FIPS 203 and 204? Put it in contracts.
The quantum era won’t start with a dramatic Hollywood blackout. It will start quietly, when someone, somewhere, decrypts a message that was supposed to stay secret forever.
Post-quantum cryptography is our chance to re-lay the foundations of digital trust before that happens. The math is ready. The standards are published. The clock is now on all of us.