Why Now Daily.

Published

Post-Quantum Cryptography: Algorithms Designed for Future Attacks

Post-quantum cryptography uses algorithms that run on ordinary computers but are designed around problems believed to resist attacks from both classical and future quantum computers. NIST has finalized ML-KEM for key establishment and ML-DSA and SLH-DSA for signatures.

Timeline

  1. 2016-12-20: NIST formally began soliciting candidate algorithms for its post-quantum cryptography standardization process.
  2. 2023-08-21: CISA, NSA and NIST published joint quantum-readiness guidance urging roadmaps, cryptographic inventories, risk assessment and vendor engagement.
  3. 2024-08-13: NIST finalized FIPS 203, 204 and 205 for ML-KEM, ML-DSA and SLH-DSA.
  4. 2025-03-11: NIST selected the code-based HQC key-encapsulation mechanism as a future backup standard to ML-KEM.
  5. 2025-12-19: NIST published final guidance on crypto agility, emphasizing the ability to replace algorithms while preserving security and operations.
  6. 2026-10-12: Current NIST, CISA and NSA guidance was reviewed for this guide.

Post-quantum cryptography, or PQC, is a family of cryptographic algorithms intended to withstand attacks from conventional computers and a future cryptographically relevant quantum computer. The algorithms run in software or hardware on today’s ordinary computing platforms; they do not require a quantum computer. “Post-quantum” describes the threat model, not the machine doing the encryption. It is also different from quantum cryptography or quantum key distribution, which uses quantum-physics equipment and specialized communication links. [1][5]

The main concern is public-key cryptography. Widely deployed RSA and elliptic-curve methods support key establishment and digital signatures across web connections, software updates, identities, documents and devices. A sufficiently capable fault-tolerant quantum computer could solve the mathematical problems protecting those systems much faster than classical computers. Such a machine does not exist today, and no one knows when or whether it will. The impact would be large enough, however, that NIST says preparation cannot wait for a precise arrival date. [1][3]

NIST finalized three standards in August 2024. FIPS 203 specifies ML-KEM, a module-lattice key-encapsulation mechanism for establishing a shared secret over a public channel. That shared secret can then support symmetric encryption and authentication. FIPS 204 specifies the lattice-based ML-DSA signature algorithm, while FIPS 205 specifies the hash-based SLH-DSA signature algorithm as a mathematically different alternative. A key-establishment mechanism and a signature solve different problems, so replacing an old algorithm requires mapping each use to the appropriate standardized construction. [2]

These standards are designed to resist known quantum attacks, but “quantum-safe” is not an absolute guarantee. Security depends on the mathematical assumptions, parameter set, implementation, protocol integration, random-number generation, key handling and surrounding system. New analysis can also change confidence over time. NIST selected the code-based HQC mechanism in 2025 as a future backup to ML-KEM rather than a replacement, specifically adding diversity in case a weakness appears in the main lattice-based approach. Organizations should follow final standards and validated product guidance instead of deploying an unreviewed algorithm from a marketing claim. [2][3]

The urgency comes partly from “harvest now, decrypt later.” An adversary can copy encrypted traffic or stored ciphertext today and retain it until a future machine can attack the public-key protection. Information that must remain confidential for many years, such as health, research, commercial or government records, can therefore face risk before a cryptographically relevant quantum computer exists. Signatures have a different timing profile because forgery usually matters when a verifier accepts it, but long-lived code-signing, device and identity systems still need planned transitions. [1][4]

Migration takes years because cryptography is embedded throughout protocols, libraries, certificates, hardware security modules, firmware, operational technology, cloud services and purchased products. The joint CISA, NSA and NIST roadmap recommends discovering where quantum-vulnerable algorithms are used, inventorying systems and assets, assessing risk, prioritizing information with long secrecy lifetimes and engaging vendors. The inventory must include signature creation and validation, including mechanisms that authenticate software and firmware updates, not only obvious encrypted network connections. [4]

Testing must cover more than whether a library can calculate the new algorithm. PQC keys, ciphertexts and signatures can have different sizes and performance characteristics, affecting network handshakes, packet limits, certificates, storage, constrained devices and hardware acceleration. Both ends of a protocol need compatible implementations, downgrade behavior must be controlled, and recovery must be possible if a component fails. Some migrations use hybrid constructions that combine classical and post-quantum mechanisms during transition, but the combination still needs a defined protocol and careful security review. [2][4]

A practical readiness program starts with ownership, an inventory tied to data lifetime and business impact, and procurement requirements that ask vendors which final standards they support and when. Teams should test representative workloads, document dependencies, update incident and key-management procedures, and design cryptographic agility: the ability to replace algorithms across protocols, applications, software, hardware and firmware without losing security or continuity. PQC is a necessary technology change, but a reliable transition is an engineering and governance program rather than a single upgrade switch. [1][3][4]

Sources

  1. NIST — What Is Post-Quantum Cryptography?
  2. NIST CSRC — Announcing Approval of Three FIPS for Post-Quantum Cryptography
  3. NIST — NIST Selects HQC as Fifth Algorithm for Post-Quantum Encryption
  4. CISA, NSA and NIST — Quantum-Readiness: Migration to Post-Quantum Cryptography
  5. NSA — Post-Quantum Cybersecurity Resources

Related stories