Post-quantum cryptography (PQC) is the family of cryptographic algorithms designed to remain secure against attacks by both classical computers and future large-scale quantum computers.
Why post-quantum cryptography is needed
Almost all public-key cryptography in use today – RSA, elliptic-curve signatures and Diffie–Hellman key exchange – relies on factoring or discrete logarithms. In 1994 Peter Shor showed that a sufficiently powerful quantum computer could solve both problems efficiently. No such machine exists yet, but the threat is already relevant because of “harvest now, decrypt later”: adversaries can record encrypted traffic today and decrypt it once quantum computers become available. Symmetric algorithms are far less affected; doubling key length, for example using AES-256, is considered sufficient.
How post-quantum algorithms work
PQC algorithms run on ordinary computers but are based on mathematical problems with no known efficient quantum attack, such as lattices, hash functions and error-correcting codes. After a public competition launched in 2016, NIST published the first standards in August 2024:
- FIPS 203 (ML-KEM) – a lattice-based key encapsulation mechanism derived from CRYSTALS-Kyber;
- FIPS 204 (ML-DSA) – lattice-based signatures derived from CRYSTALS-Dilithium;
- FIPS 205 (SLH-DSA) – hash-based signatures derived from SPHINCS+.
In 2025 NIST also selected HQC as a backup key-encapsulation algorithm. The competition showed why caution is needed: the SIKE candidate was broken in 2022 with a classical laptop-class computer in about an hour.
How PQC is being adopted
Deployments typically use hybrid schemes that combine a classical and a post-quantum algorithm, so security holds if either remains unbroken. Chrome, Firefox and Cloudflare support hybrid X25519 + ML-KEM key exchange in TLS, Signal introduced PQXDH in 2023, and Apple’s iMessage added PQ3 in 2024. Organisations are advised to inventory their cryptography, prioritise long-lived secrets and build crypto-agility into systems so algorithms can be replaced without redesign.
