Post-quantum cryptography
Lesson 21 of 23 in the course “Quantum”. Free, with animations and a quiz.
New maths on old hardware
The main cure for Q-Day isn’t quantum. Post-quantum cryptography (PQC) is a set of new algorithms for ordinary computers and phones. They rest on problems that neither Shor’s algorithm nor any other known quantum algorithm can solve: finding points in high-dimensional lattices, properties of hashes and error-correcting codes. Don’t confuse it with “quantum encryption” over fibre (QKD): that needs special hardware, while PQC is just a software update.
The NIST standards
Since 2016 the US standards institute NIST ran an open competition: cryptographers worldwide proposed algorithms and spent years trying to break each other’s. Some candidates really fell. On 13 August 2024 three standards came out: FIPS 203 (ML-KEM) for key exchange, and FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for signatures. In March 2025 HQC was added as a backup built on different maths, in case something turns up against lattices. Why a backup? History: in 2022 the candidate SIKE was broken in about an hour on a single core of an ordinary computer.
You already use PQC
Good news: the switch is already happening, and you didn’t even notice. Signal added the post-quantum PQXDH key exchange in 2023, Apple enabled the PQ3 protocol in iMessage in 2024, and since 2024 Chrome uses ML-KEM by default when connecting to sites over HTTPS. Almost everywhere it’s a hybrid: the old algorithm and the new one work together. To break the connection you must break both. If a hole is found in the new one, the old one still holds, and vice versa.
Why the rush: Mosca’s rule
If there’s no quantum code-breaker yet, why hurry? Cryptographer Michele Mosca proposed a simple test. x is how many years your data must stay secret. y is how many years migrating to new algorithms will take. z is how many years until a quantum code-breaker arrives. If x + y is bigger than z, you’re already late: an attacker records encrypted traffic today and decrypts it later. Medical records, state secrets and private messages must stay safe for decades. And a big company’s migration can easily take 5–10 years.
The deadlines
Regulators have already set dates. In the draft document IR 8547 (November 2024), NIST proposes deprecating RSA and elliptic curves after 2030 and disallowing them after 2035. The NSA’s CNSA 2.0 programme requires post-quantum support in new systems from 2027 and a full switch of all national security systems by 2035. The EU expects national plans by the end of 2026, critical infrastructure protected by 2030 and the rest by 2035. For business that means one thing: people who can migrate systems to PQC will be in high demand.
The cost of switching
Nothing is free. Post-quantum keys and signatures are noticeably bigger. A Schnorr or ECDSA signature in bitcoin weighs about 64–72 bytes, ML-DSA is 2,420 bytes, and the most conservative hash-based scheme, SLH-DSA, is almost 8 kilobytes. For a website that’s invisible, but for a blockchain it hurts: every signature takes block space, so fees rise or throughput drops. That’s why the bitcoin and Ethereum communities argue so long about which scheme to pick. The second pain is inventory: many companies simply don’t know where they use old cryptography.
Check yourself
- What is post-quantum cryptography?
Correct answer: New algorithms for ordinary computers that resist quantum attacks. PQC is software: new maths on the same phones and servers. That’s exactly why it can be rolled out at scale. - Why switch to PQC before a quantum code-breaker exists?
Correct answer: Data is stolen now and decrypted later, and migration itself takes years. Mosca’s rule: if x + y > z, you’re already late. “Harvest now, decrypt later” makes the threat real today. - Why aren’t post-quantum signatures a free fix for blockchains?
Correct answer: Signatures are tens of times bigger and take space in every block. ML-DSA weighs 2,420 bytes versus ~64–72 for Schnorr/ECDSA. More data per block means higher fees or lower throughput.