Post-quantum cryptography is meant to survive an attacker holding a powerful quantum computer, and the name invites an obvious guess: that the defense is quantum too. It is not. It runs on the laptop you already own. So what is it leaning on instead?
Math that both kinds of computer find hard. Of the four algorithms NIST selected first, three rest on a family of problems called and the fourth on , in place of the that today’s encryption depends on. The first three finalized standards came out in 2024.
Much of today’s encryption rests on one asymmetry. Multiply two very large primes and you get a number nobody can take apart again; for large enough numbers, a conventional computer has been estimated to need billions of years to recover the prime factors.
A sufficiently capable quantum computer would sift all those candidate factors at once instead of one by one, arriving exponentially faster. Experts call such a machine cryptographically relevant, and the estimate for the same puzzle drops from billions of years to days or even hours.
So the replacements have to be built on problems that are hard for both kinds of machine. Of the four algorithms NIST selected as the first to be standardized, three use structured lattices and the fourth uses relationships among hash functions, and they cover both general encryption and .
The urgency is not about the machine arriving. Traffic captured and stored today can be decrypted whenever one appears, so the migration has to happen first. That is why NIST published the first three finalized standards in 2024 rather than waiting for the hardware.
wat. Post-quantum encryption is ordinary software; what changes is the math problem underneath it.
wat wat
Encrypted traffic captured today can sit on a disk until a machine exists that opens it, so the deadline for switching is earlier than the arrival of the machine.
How do we know?
NIST runs the Post-Quantum Cryptography project, where submitted algorithms face public analysis before selection, and it published the first finalized standards in 2024 along with migration guidance.
What is still unknown
Hardness here rests on expert belief rather than proof, and nobody knows when or whether a cryptographically relevant quantum computer gets built.
Learn something?
Where to next
Why does a QR code still work when part of it has been erased?standards
How often does a quantum computer make a mistake?quantum computing
How many people does it take before two of them share a birthday?cryptography