What is post-quantum cryptography?

1. The threat in one paragraph

Nearly all public-key cryptography today — RSA, Diffie–Hellman, elliptic curves — rests on two problems being hard: factoring large numbers, and computing discrete logarithms. A quantum computer running Shor's algorithm solves both efficiently. Not faster-by-a-bit; catastrophically faster. The moment such a machine exists at scale, those systems stop protecting anything.

2. Shor's algorithm — what actually breaks

In 1994 Peter Shor showed that a quantum computer could factor integers in roughly polynomial time. The trick isn't brute force — it converts factoring into a period-finding problem, which the quantum Fourier transform solves by letting many computational paths interfere so the right answer stands out.

The same machinery cracks discrete logarithms, which is what elliptic curves rely on. So the damage is broad:

3. Grover's algorithm and symmetric keys

Symmetric cryptography fares far better. Grover's algorithm searches an unsorted space in roughly the square root of the classical time — a real speedup, but only quadratic rather than exponential.

Practically, that halves your effective security in bits. AES-128 drops to about 64-bit security (too weak); AES-256 drops to about 128-bit (still comfortably out of reach). The fix is simply to use 256-bit symmetric keys — no new mathematics required.

4. Lattices: the leading replacement

If factoring and discrete logs both fall, we need hard problems that quantum computers don't know how to attack. The front-runner is lattice-based cryptography.

A lattice is a regular, infinite grid of points in high-dimensional space, generated by adding and subtracting a set of basis vectors. In two dimensions it looks like graph paper. In 500 dimensions, intuition disappears — and so does easy computation.

Two problems make this useful: the Shortest Vector Problem (find the shortest non-zero point) and the Closest Vector Problem (find the lattice point nearest a target). Both are believed hard even for quantum computers, and — crucially — lattice operations are fast, making them practical for real systems.

5. The NIST standards you'll actually use

After an eight-year open competition, NIST published its first post-quantum standards in August 2024. These are the algorithms being deployed now:

ML-KEM is the workhorse — it replaces the key exchange in TLS. SLH-DSA is deliberately conservative: it relies only on hash functions, so if a weakness were ever found in lattices, it remains a safe fallback.

This migration is already visible. Chrome and Firefox negotiate hybrid post-quantum key exchange with major servers today, combining a classical curve with ML-KEM so a break in either one alone isn't fatal.

6. What to do now

• Inventory your cryptography. You can't migrate what you can't find. Know where RSA and ECC are used across your systems.
• Move to AES-256. The cheapest win available — no new algorithms, just longer symmetric keys.
• Adopt hybrid key exchange. Classical + post-quantum together. Most modern TLS libraries already support it.
• Prioritise long-lived secrets. Anything that must stay confidential past ~2035 should move first, because of harvest-now-decrypt-later.
• Design for crypto-agility. Build systems where the algorithm can be swapped without rewriting everything. This won't be the last migration.

7. Frequently asked questions

When will quantum computers break RSA?

Nobody knows. Estimates for a cryptographically relevant quantum computer range from roughly 2030 to well beyond 2040, and some experts doubt it will arrive at all. The uncertainty is exactly why migration is starting now — you can't wait for certainty when the data being recorded today is already vulnerable.

Is post-quantum cryptography the same as quantum cryptography?

No, and the confusion is common. Post-quantum cryptography is classical software that resists quantum attack — it runs on ordinary computers. Quantum cryptography (like QKD) uses quantum physics itself and needs special hardware.

Will Bitcoin be broken by quantum computers?

Its ECDSA signatures are vulnerable in principle, but coins are only exposed once a public key is revealed on-chain. The community can migrate to post-quantum signatures via protocol upgrade — the harder problem is coordinating that across a decentralised network.

Are the NIST standards actually secure?

They survived eight years of public cryptanalysis, which is the strongest assurance available. Not all candidates did — SIKE was famously broken in 2022 by a classical attack, on a laptop, in about an hour. That's the process working as intended.

Do I need to do anything as an individual?

Mostly no — keep your browser and operating system updated and the migration happens beneath you. If you build or operate systems, the checklist above applies.

Keep going