Post-quantum cryptography is the work of preparing our digital locks for a different kind of lockpick. The aim is to protect information against future quantum computers powerful enough to defeat important parts of today’s security.
You do not need a quantum laptop to use it. You need ordinary software that implements suitable new cryptography, and services that support it. The cat may continue occupying your existing laptop.
What does “post-quantum” mean?
NIST’s introduction to post-quantum cryptography describes algorithms intended to resist attacks from both conventional and quantum computers. They run on conventional machines. Their security rests on mathematical problems for which no efficient quantum attack is known.
That final wording matters. Cryptographers are making carefully examined security judgements, not promising that nobody will ever discover a better attack. Standards, public scrutiny and sound implementation all belong in the picture.
Quantum key distribution is a different approach, using quantum effects and specialised equipment to distribute keys. PQC is designed for the computers and networks we already operate, though some hardware and products will still need replacement or engineering changes.
A secure connection has several jobs
Imagine sending a parcel: you need to protect its contents, establish who you are dealing with and arrange the necessary keys. Internet security has comparable layers, although the actual mathematics is less convenient to demonstrate with a cardboard box.
Symmetric cryptography uses a shared secret key to protect data efficiently. AES is a familiar example. Public-key cryptography uses public and private keys for functions including establishing shared secrets and creating digital signatures. Those signatures help authenticate information and detect changes.
A modern website connection combines these jobs. It is misleading to describe every handshake as encrypting a message with the server’s public key: key agreement can instead derive a shared secret. Certificates and signatures serve a different purpose from encrypting the page contents.
Our guide to DNS resolution covers another part of the journey: finding the server in the first place. Finding an address and securing the conversation are separate steps.
Why quantum computers change the calculation
RSA relies on the difficulty of factoring large integers. Widely used elliptic-curve systems rely on discrete-logarithm problems. Shor’s quantum algorithm offers efficient ways to solve those underlying problems on a sufficiently capable machine.
“Efficient” does not mean instantaneous. The key size, the algorithm, error correction and the actual hardware all affect the resources needed. As an illustration, Google’s May 2025 research estimate described factoring a 2,048-bit RSA integer in roughly a week with about a million noisy physical qubits under its assumptions. That was a theoretical resource estimate, not a demonstration that Google had cracked such a key.
Research can change those estimates. A projected attack is a reason to prepare; it is not a reliable appointment in the calendar for the day encryption ends.
Symmetric encryption faces a different quantum challenge. NIST’s FAQ explains the limits of Grover-style attacks, including their practical cost and difficulty of parallelisation. AES-256 is not threatened in the same way as RSA. The migration does not mean throwing away every cryptographic tool we have.
Why prepare before the attack is practical?
The concern often called “harvest now, decrypt later” is straightforward: an attacker could record vulnerable encrypted communications, store them and try to recover their contents once better tools become available. NIST discusses this risk in its November 2024 transition draft.
That does not mean a future machine automatically reveals every encrypted byte ever collected. The outcome depends on the cryptographic scheme, the information captured and any additional protection. But a secret intended to last decades needs a different planning horizon from a disposable message about tonight’s dinner.
There is another clock running too: replacing cryptography across services, devices and suppliers takes time. Waiting until an attack is demonstrated would leave a very large amount of work for a very uncomfortable afternoon.
The three standards worth recognising
NIST finalised its first three PQC standards in August 2024:
- ML-KEM, FIPS 203: a key-encapsulation mechanism derived from CRYSTALS-Kyber. It helps establish a shared secret that other cryptographic tools can then use.
- ML-DSA, FIPS 204: a digital-signature scheme derived from CRYSTALS-Dilithium.
- SLH-DSA, FIPS 205: a hash-based signature scheme derived from SPHINCS+, offering a different mathematical foundation from the lattice-based standards.
The first two use structured lattices: mathematical arrangements of points whose associated problems become difficult in high dimensions. The hash-based alternative provides useful diversity. You do not need to picture the dimensions to understand the practical idea: different foundations reduce dependence on a single family of assumptions.
These are building blocks with different jobs. A signature algorithm does not replace a key-encapsulation mechanism merely because both carry the post-quantum label.
Migration is already a software-engineering problem
Google’s September 2024 Chrome announcement described moving its hybrid key agreement from experimental Kyber to standardised ML-KEM, combined with X25519. The design combines conventional and post-quantum components rather than relying entirely on the newer one.
The announcement also illustrates the compatibility work: the earlier Kyber version and final ML-KEM were not interchangeable, so servers needed preparation. Larger messages can affect connections, and performance depends on the algorithm, device and network. “Nobody will notice” is a design goal, not a universal measurement.
A hybrid key agreement also does not automatically upgrade certificates, signatures, stored data and every other layer. An updated browser is one participant in a much larger system.
The UK NCSC’s March 2025 roadmap recommends discovery and initial planning by 2028, priority migrations by 2031 and completion by 2035. These are migration targets for organisations, not a prediction that a code-breaking machine will arrive precisely when the calendar flips.
What should an ordinary user do?
Keep supported devices and software updated so you can receive new protections. For people managing systems, the larger task is to identify cryptographic dependencies, ask suppliers about their plans and test replacements carefully. A product labelled “quantum-safe” still needs to fit into a secure system.
Account security remains relevant too. Long, unique passwords, a suitable password manager and additional authentication protect against familiar threats. A stronger handshake cannot stop you handing your credentials to a convincing fake login page.
The promise of PQC is reassuringly practical: much of the change can happen inside software and services while you get on with your day. The work behind that quiet upgrade is substantial. Ideally, the most dramatic thing happening near your computer will still be the cat knocking a pen off the desk.
