Post-Quantum Cryptography Explained
Most encrypted internet traffic today is safe from ordinary computers.
That does not automatically mean it will remain safe forever.
Researchers are developing quantum computers that use quantum-mechanical effects to perform certain calculations in fundamentally different ways from conventional computers. If sufficiently powerful fault-tolerant quantum machines are eventually built, some of the mathematical problems protecting today’s internet could become dramatically easier to solve.
That possibility is why governments, technology companies and standards organizations are already moving toward post-quantum cryptography.
Post-quantum cryptography, usually shortened to PQC, refers to cryptographic algorithms designed to remain secure against attacks from both conventional computers and future quantum computers.
It does not require a quantum computer.
The new algorithms are intended to run on ordinary servers, laptops, phones, routers and cloud infrastructure just as today’s cryptographic software does.
In August 2024, the U.S. National Institute of Standards and Technology finalized the first three major post-quantum cryptography standards after years of international evaluation.
Those standards are:
FIPS 203 — ML-KEM
FIPS 204 — ML-DSA
FIPS 205 — SLH-DSA
NIST — Post-Quantum Cryptography Standards
Then, on October 27, 2026, NIST published the final version of NIST IR 8547, its official high-level roadmap for transitioning away from quantum-vulnerable cryptography.
NIST — Transition to Post-Quantum Cryptography Standards
That means post-quantum cryptography is no longer simply a research topic.
The migration has begun.
For the wider security foundation behind encryption, identity, networks, malware and digital risk, start with The News Ink’s Cybersecurity Explained Complete Guide.
Post-Quantum Cryptography at a Glance
| Topic | Current Position |
|---|---|
| Main purpose | Protect systems from future quantum attacks |
| Does PQC require quantum hardware? | No |
| Main vulnerable technology | Public-key cryptography |
| Major threatened algorithms | RSA, Diffie-Hellman, ECDH, ECDSA and related systems |
| Primary NIST key-establishment standard | ML-KEM |
| Primary NIST signature standard | ML-DSA |
| Alternative signature standard | SLH-DSA |
| Additional NIST KEM | HQC selected for future standardization |
| Main current concern | Harvest now, decrypt later |
| NIST standards finalized | August 2024 |
| NIST transition roadmap finalized | October 27, 2026 |
| Broad U.S. federal migration target | 2035 |
| High-value federal systems | Earlier milestones around 2030–2031 |
| Current deployment strategy | Often hybrid classical + PQC |
The critical point is that today’s internet is not suddenly insecure.
The risk is about what future quantum machines could do to specific cryptographic systems that modern digital infrastructure depends upon.
1. What Is Post-Quantum Cryptography?
Post-quantum cryptography is cryptography designed around mathematical problems that researchers believe will remain difficult for both classical computers and large-scale quantum computers.
NIST describes PQC as a response to the possibility that future quantum computers could break some of the public-key algorithms protecting confidential electronic information today.
NIST — What Is Post-Quantum Cryptography?
Those algorithms help secure:
websites;
email;
VPN connections;
software updates;
banking;
cloud services;
digital signatures;
device authentication.
If the mathematical foundations behind those systems became efficiently solvable by quantum computers, attackers could potentially impersonate systems or recover information protected by vulnerable key-exchange mechanisms.
That is why post-quantum cryptography focuses heavily on replacing public-key cryptography before a sufficiently powerful quantum computer exists.
2. Why Quantum Computers Threaten Today’s Encryption
Modern cryptography depends on mathematical problems that are extremely difficult for ordinary computers.
RSA, for example, relies heavily on the difficulty of factoring very large numbers.
Elliptic-curve systems rely on mathematical problems involving discrete logarithms on elliptic curves.
Classical computers cannot efficiently solve these problems at the key sizes used by modern secure systems.
A sufficiently capable quantum computer changes the situation because of Shor’s algorithm.
Shor’s algorithm showed that a large fault-tolerant quantum computer could efficiently solve mathematical problems underlying RSA and several forms of elliptic-curve cryptography.
That does not mean today’s quantum computers can already break internet encryption.
They cannot.
The News Ink’s Quantum Computing Guide explains why current machines are still limited by noise, error correction and scale.
The danger is what happens if those limitations are eventually overcome.
3. RSA Could Become Vulnerable
RSA has been used for decades across digital security.
Its security depends partly on the practical difficulty of factoring a large number created from large prime numbers.
A conventional computer would require an impractical amount of time to factor properly chosen modern RSA keys.
A sufficiently powerful quantum computer running Shor’s algorithm could change that.
This is why NIST’s latest transition roadmap identifies RSA among the cryptographic families that eventually need replacement for quantum-sensitive applications.
The risk affects more than encrypted messages.
RSA has also been widely used in:
digital certificates;
signatures;
authentication;
key establishment.
Replacing such deeply embedded technology is one reason the post-quantum cryptography transition will take years rather than months.
4. Elliptic-Curve Cryptography Is Also Threatened
Many modern systems moved from RSA toward elliptic-curve cryptography because elliptic curves can provide strong security with relatively small keys.
Examples include:
ECDH;
ECDSA;
EdDSA;
X25519-based key exchange.
Unfortunately, these systems are also vulnerable in principle to sufficiently powerful implementations of Shor’s algorithm.
That creates a major problem.
Modern websites, VPNs, mobile applications, identity systems and cloud services use elliptic-curve cryptography extensively.
The News Ink’s Identity Security Explained guide shows how cryptographic keys now sit behind technologies such as passkeys, digital authentication and secure sessions.
A future quantum threat is therefore not merely an encryption problem.
It is also an identity and authentication problem.
5. Symmetric Encryption Is Different
People sometimes hear that quantum computers threaten cryptography and conclude:
“AES will be completely broken too.”
That is too simplistic.
Symmetric algorithms such as AES are affected differently.
Quantum search techniques such as Grover’s algorithm can theoretically reduce the effective security margin of brute-force key searching.
But the effect is much less destructive than Shor’s algorithm is for RSA or elliptic-curve public-key cryptography.
NIST’s current migration planning continues to allow approved symmetric cryptography with sufficiently strong key sizes.
For practical purposes, systems using something such as AES-256 are in a much stronger position against quantum attacks than systems relying on RSA for long-term quantum-sensitive protection.
This is why post-quantum cryptography migration focuses first on public-key systems.
6. What Is “Harvest Now, Decrypt Later”?
This may be the strongest reason organizations cannot simply wait until a powerful quantum computer appears.
Imagine an intelligence service intercepts encrypted communications in 2026.
It cannot decrypt them today.
So it stores them.
Ten years later, it gains access to a quantum computer capable of breaking the public-key system that protected the original session.
The attacker then decrypts old captured information.
This strategy is known as:
harvest now, decrypt later
or
store now, decrypt later.
NIST specifically warns that sensitive information can already be at risk if it needs to remain confidential for many years.
That includes information such as:
government intelligence;
medical information;
trade secrets;
financial records;
research;
critical-infrastructure data.
This is why organizations protecting long-lived secrets need post-quantum cryptography before quantum attacks become practical.
7. When Will Quantum Computers Actually Break RSA?
Nobody knows.
That is the correct answer.
NIST says estimates for a cryptographically relevant quantum computer range from years to decades, while major engineering challenges remain.
Today’s quantum computers do not have the scale and error correction required to break widely deployed modern public-key encryption.
This uncertainty does not mean organizations can ignore the threat.
Large technology migrations take time.
NIST notes that replacing cryptographic infrastructure across the global technology ecosystem can take 10 to 20 years.
A company cannot wait until a quantum machine breaks RSA and then update every server, embedded device, certificate, VPN, router and software product overnight.
Preparation has to happen before the crisis.
8. NIST Spent Years Choosing Post-Quantum Algorithms
NIST began its international PQC standardization process in 2016.
Researchers around the world submitted candidate algorithms.
Those algorithms were publicly studied and attacked by cryptographers for years.
Candidates were removed when weaknesses appeared or when alternatives offered better security and performance.
This competition eventually produced the first three finalized post-quantum cryptography standards in August 2024.
NIST — PQC Standardization Project
This process matters because cryptography cannot be safely standardized only because an algorithm looks complicated.
Researchers need years to analyze whether hidden mathematical or implementation weaknesses exist.
9. ML-KEM: The Main Standard for Establishing Shared Secrets
The most important NIST standard for key establishment is:
ML-KEM
The full name is:
Module-Lattice-Based Key-Encapsulation Mechanism.
It is defined in FIPS 203 and derived from the earlier CRYSTALS-Kyber submission.
ML-KEM allows two parties communicating over a public network to establish shared secret material that can then be used with symmetric encryption.
This makes it highly relevant to technologies such as secure network connections.
ML-KEM relies on mathematical problems involving structured lattices, particularly variants of the Learning With Errors problem.
Researchers currently believe these problems remain difficult for both classical and quantum computers.
That is what gives ML-KEM its post-quantum cryptography properties.
10. What Is a Key Encapsulation Mechanism?
A key encapsulation mechanism, or KEM, is not the same as directly encrypting an entire video, database or webpage.
Instead, it helps two parties establish a shared secret.
That secret can then be used by an efficient symmetric cipher such as AES.
A simplified secure connection can therefore look like this:
PQC key establishment → shared secret → symmetric encryption → protected data
This design makes sense because symmetric encryption is extremely efficient for large amounts of data.
Public-key cryptography is mainly needed to solve the difficult problem of establishing trust and secret keys across an insecure network.
ML-KEM is designed to solve that key-establishment problem in a quantum-resistant way.
11. ML-DSA Protects Digital Signatures
Encryption is only part of cybersecurity.
Systems also need to prove that information genuinely came from the expected source and has not been modified.
That is the job of digital signatures.
NIST’s primary new signature standard is:
ML-DSA
or:
Module-Lattice-Based Digital Signature Algorithm.
It is standardized in FIPS 204 and is derived from the CRYSTALS-Dilithium project.
Digital signatures can protect:
software updates;
documents;
certificates;
transactions;
firmware;
identity systems.
A future quantum computer capable of forging signatures would create enormous security problems.
That is why digital signatures are a major part of the post-quantum cryptography migration.
12. SLH-DSA Provides a Different Mathematical Approach
NIST also standardized:
SLH-DSA
under FIPS 205.
SLH-DSA is based on hash functions rather than the same structured-lattice assumptions behind ML-KEM and ML-DSA.
That diversity is important.
Cryptographers do not want every future secure system to depend on exactly one mathematical assumption.
If researchers someday discover a major weakness in one family of algorithms, alternatives should exist.
NIST deliberately selected multiple approaches for this reason.
The broader post-quantum cryptography strategy is therefore not simply:
“Replace RSA with one new algorithm forever.”
It is about creating a resilient collection of standardized options.
13. NIST Is Still Standardizing Additional Algorithms
The first standards are not the end of the process.
NIST selected HQC in March 2025 as an additional key-encapsulation algorithm for future standardization.
Unlike ML-KEM, HQC is based on code-based cryptographic problems.
That gives the ecosystem an alternative mathematical foundation if a serious problem is ever discovered in lattice-based systems.
NIST is also continuing work on an additional signature standard derived from FALCON.
This is one reason post-quantum cryptography remains an active research field even after the first standards became final.
The goal is not merely to standardize algorithms.
It is to build an ecosystem capable of surviving future cryptanalytic discoveries.
14. Post-Quantum Does Not Mean Proven Unbreakable Forever
No responsible cryptographer should promise that a cryptographic algorithm will remain secure forever.
Algorithms are selected because the best available research indicates that attacking them is computationally infeasible under reasonable assumptions.
New mathematics can change those assumptions.
Implementation mistakes can also create vulnerabilities even when the underlying algorithm remains mathematically sound.
In 2026, for example, NIST noted that a candidate lattice-based signature algorithm called HAWK was withdrawn after researchers identified a vulnerability during ongoing analysis.
NIST emphasized that the finding did not affect the finalized ML-KEM or ML-DSA standards.
NIST — Post-Quantum Cryptography
This is exactly why public scrutiny remains essential.
Strong cryptography should survive years of attempts to break it.
15. Hybrid Cryptography Is Helping the Internet Transition
Organizations do not necessarily have to switch instantly from classical cryptography to PQC-only systems.
One important migration strategy is hybrid cryptography.
A hybrid key exchange uses both:
a traditional algorithm;
and
a post-quantum algorithm.
The connection remains protected as long as at least one component remains secure.
In August 2026, the Internet Engineering Task Force published RFC 10024, defining hybrid post-quantum key-exchange mechanisms for TLS 1.3.
One important example is:
X25519MLKEM768
This combines the traditional X25519 elliptic-curve mechanism with ML-KEM-768.
Hybrid deployment gives organizations quantum resistance while retaining protection based on well-understood classical cryptography during the transition.
16. Post-Quantum TLS Is Already Becoming Real
TLS is the protocol family responsible for protecting much of the encrypted traffic behind HTTPS.
When your browser connects securely to a website, cryptographic protocols establish keys before encrypted data begins flowing.
The post-quantum cryptography transition is now reaching this layer.
Cloudflare has deployed hybrid ML-KEM key agreement across parts of its infrastructure and recommends X25519MLKEM768 for supported TLS deployments.
Cloudflare — Post-Quantum Cryptography
This is important because it shows that PQC is no longer limited to laboratory demonstrations.
Real internet infrastructure is beginning to use it.
The News Ink’s Network Security Explained guide explains how TLS, VPNs, segmentation and secure networking fit into the broader defense of modern systems.
17. Why Post-Quantum Keys and Signatures Can Be Larger
There is a practical cost to post-quantum cryptography.
Some PQC algorithms use larger:
public keys;
ciphertexts;
signatures
than the classical algorithms they replace.
That can affect:
network bandwidth;
certificate sizes;
hardware;
embedded devices;
protocol compatibility.
A desktop computer connected through fiber may barely notice the difference.
A constrained embedded sensor with limited memory may care much more.
Engineers therefore have to evaluate both security and performance.
This is one reason NIST standardized multiple parameter sets and algorithms rather than assuming one configuration works everywhere.
18. Old Hardware Could Be a Major Migration Problem
Changing cryptography in cloud software can sometimes be accomplished through an update.
Replacing cryptography inside hardware installed for decades is harder.
Think about:
industrial control systems;
medical equipment;
vehicles;
satellites;
smart meters;
routers;
security appliances.
Some devices were designed without assuming their cryptographic algorithms would ever need to change.
Others may not have enough processor power or memory for future algorithms.
This creates one of the largest challenges in the post-quantum cryptography transition.
Organizations first need to know where cryptography exists.
Only then can they determine what needs to be upgraded or replaced.
19. Cryptographic Inventory Comes First
An organization cannot migrate what it cannot find.
Security teams need an inventory of:
certificates;
encryption libraries;
VPNs;
TLS services;
authentication systems;
software-signing systems;
hardware security modules;
embedded devices;
third-party products.
CISA, NSA and NIST have urged organizations to build quantum-readiness roadmaps and begin identifying systems that rely on quantum-vulnerable public-key cryptography.
CISA — Quantum-Readiness: Migration to Post-Quantum Cryptography
For many enterprises, discovering every cryptographic dependency may be more difficult than replacing the algorithm itself.
20. Crypto Agility Could Determine How Painful the Migration Becomes
Crypto agility means designing systems so cryptographic algorithms can be replaced without rebuilding the entire application or infrastructure.
NIST finalized updated guidance on crypto agility in 2026.
NIST — Considerations for Achieving Crypto Agility
Imagine two systems.
System A has RSA deeply hard-coded throughout its application.
System B uses a flexible cryptographic layer where administrators can select different approved algorithms.
System B can migrate much more easily.
The lesson extends beyond post-quantum cryptography.
Cryptographic algorithms will change again someday.
Systems should be designed with that expectation.
21. NIST’s Final 2026 Migration Roadmap Makes the Timeline Clearer
On October 27, 2026, NIST released the final version of NIST IR 8547: Transition to Post-Quantum Cryptography Standards.
The report identifies quantum-vulnerable algorithms and describes how organizations should transition toward quantum-resistant alternatives.
The wider U.S. federal strategy targets 2035 for broad migration away from vulnerable public-key cryptography.
More sensitive federal systems face accelerated targets.
NIST says federal high-value assets and high-impact systems are expected to migrate key-establishment mechanisms by around 2030 and digital signatures by 2031 under current directives.
That does not mean every private company worldwide has exactly the same deadline.
It does show that post-quantum cryptography migration now has concrete government timelines rather than vague future ambitions.
22. NSA Is Also Moving National-Security Systems Toward PQC
The U.S. National Security Agency maintains its own transition framework for national-security systems through the Commercial National Security Algorithm Suite 2.0, usually called CNSA 2.0.
NSA’s updated October 2026 PQC guidance emphasizes that organizations protecting critical systems should begin migration now rather than waiting for a future quantum breakthrough.
NSA — Post-Quantum Cryptography
NSA’s migration schedules require increasingly broad support for quantum-resistant algorithms across national-security technologies during the coming years.
This reinforces a global security reality.
Quantum migration is becoming a procurement requirement.
Organizations purchasing systems expected to remain operational into the 2030s increasingly need to ask whether those products can support PQC.
23. Cloud Computing Makes the Transition Both Easier and Harder
Cloud platforms could accelerate adoption because a provider can update infrastructure used by millions of customers.
A company using managed TLS or cloud networking may receive PQC support without replacing every physical server itself.
But cloud environments also introduce complex dependencies.
Applications may depend on:
load balancers;
API gateways;
identity services;
managed databases;
certificate systems;
third-party SaaS products.
Each may use cryptography differently.
The News Ink’s Cloud Computing Guide explains how modern applications depend on multiple layers of shared cloud infrastructure.
The post-quantum cryptography migration therefore requires coordination across the entire technology supply chain.
24. Digital Certificates Will Need to Change
Secure websites rely heavily on digital certificates.
Certificates help browsers verify that they are communicating with the correct server.
They depend on public-key signatures.
If the signature algorithms used by certificate infrastructure become quantum-vulnerable, the certificate ecosystem must evolve.
This affects:
certificate authorities;
browsers;
servers;
enterprise PKI;
code signing;
device certificates.
The IETF has already been defining standards for using ML-KEM and other PQC technologies within internet public-key infrastructure.
That shows how deep the migration goes.
PQC is not one software update.
It touches many layers of trust.
25. Software Updates Need Quantum-Safe Signatures Too
Operating systems, applications, routers and embedded devices often verify software updates using digital signatures.
The signature tells the device:
This update really came from the trusted vendor and was not altered.
If future attackers could forge those signatures, they might distribute malicious software that appears legitimate.
That makes post-quantum cryptography important for software supply-chain security.
Organizations need to think not only about encrypting data but also about protecting:
firmware;
software packages;
boot systems;
update servers.
Long-lived devices create particular urgency because some hardware shipped today may still be operating in the 2040s.
26. Cryptocurrency and Blockchains Face Quantum Questions Too
Many blockchain systems use elliptic-curve digital signatures.
A sufficiently powerful quantum computer could theoretically threaten some of those signature schemes.
That does not mean Bitcoin or every blockchain is about to collapse.
A cryptographically relevant quantum computer capable of performing such attacks does not exist today.
But blockchain protocols may eventually need quantum-resistant migration plans.
This presents unique challenges because decentralized systems often require broad community agreement before major cryptographic changes.
The issue reinforces a larger lesson.
Post-quantum cryptography affects any technology that depends heavily on vulnerable public-key mathematics.
27. Post-Quantum Cryptography Is Not Quantum Cryptography
These names sound similar but describe different ideas.
Post-Quantum Cryptography
Uses mathematical algorithms designed to resist quantum attacks.
Runs on ordinary computers and networks.
Quantum Cryptography
Uses properties of quantum physics directly.
Quantum key distribution is one example.
NIST emphasizes that the two fields should not be confused.
PQC is generally much easier to deploy across today’s internet because it works within ordinary classical computing infrastructure.
Organizations do not need quantum communication hardware to start becoming quantum resistant.
28. Ordinary Users Do Not Need to Replace Their Computers Today
The post-quantum cryptography transition is largely an infrastructure responsibility.
Ordinary users do not need to panic-buy special “quantum-proof” laptops or phones.
Instead:
keep operating systems updated;
keep browsers updated;
use reputable services;
enable strong authentication;
replace unsupported devices.
Technology companies, cloud providers, governments and software vendors will handle much of the underlying cryptographic transition.
Over time, PQC will increasingly appear inside updates and protocols without ordinary users needing to configure the algorithms manually.
That is how previous cryptographic migrations often worked too.
29. Businesses Should Start Preparing Now
For organizations, the situation is different.
Businesses holding long-lived confidential information should begin preparing even if they do not expect a cryptographically relevant quantum computer soon.
A practical roadmap includes:
1. Inventory cryptography.
Identify where RSA, ECC, Diffie-Hellman and related technologies are used.
2. Classify long-lived information.
Determine which data must remain secret for many years.
3. Contact vendors.
Ask when products will support standardized PQC.
4. Prioritize internet-facing systems.
TLS, VPN and remote-access infrastructure deserve close attention.
5. Build crypto agility.
Avoid designs that permanently lock applications to one algorithm.
6. Test hybrid deployments.
Use standardized migration approaches where appropriate.
7. Update procurement rules.
New long-life systems should have clear PQC roadmaps.
8. Monitor NIST guidance.
Standards and implementation guidance continue evolving.
The goal is controlled migration rather than emergency replacement.
30. Post-Quantum Cryptography Will Not Fix Every Cybersecurity Problem
PQC solves a specific future threat.
It does not stop:
phishing;
malware;
stolen passwords;
ransomware;
zero-day vulnerabilities;
misconfiguration;
insider threats.
An organization can deploy perfect quantum-resistant encryption and still lose data because an employee enters a password into a phishing website.
Likewise, quantum-safe certificates do not help if an attacker steals an administrator’s session token.
The News Ink’s Identity Security Explained guide demonstrates why authentication, access control and session protection remain essential.
The post-quantum cryptography transition strengthens one critical layer of cybersecurity.
It does not replace the rest.
Post-Quantum Cryptography Standards
| Standard | Algorithm | Primary Purpose | Mathematical Family |
|---|---|---|---|
| FIPS 203 | ML-KEM | Key establishment | Module lattices |
| FIPS 204 | ML-DSA | Digital signatures | Module lattices |
| FIPS 205 | SLH-DSA | Digital signatures | Hash-based |
| Future standard | FALCON-derived signature | Additional signatures | Lattice-based |
| Future standard | HQC | Additional KEM | Code-based |
This diversity is deliberate.
Future cryptographic infrastructure needs alternatives in case research discovers unexpected weaknesses.
Classical vs Post-Quantum Cryptography
| Area | Traditional Example | Quantum Concern | PQC Direction |
|---|---|---|---|
| Key establishment | RSA | Shor’s algorithm | ML-KEM |
| Key establishment | ECDH | Shor’s algorithm | ML-KEM/hybrid |
| Digital signatures | RSA | Shor’s algorithm | ML-DSA/SLH-DSA |
| Digital signatures | ECDSA | Shor’s algorithm | ML-DSA/SLH-DSA |
| Symmetric encryption | AES-256 | Reduced brute-force margin | Remains broadly suitable |
| Hashing | SHA-256/SHA-3 | Quantum search effects | Strong hashes remain useful |
The main disruption therefore occurs in public-key cryptography rather than every cryptographic technology simultaneously.
Frequently Asked Questions
What is post-quantum cryptography?
Post-quantum cryptography refers to cryptographic algorithms designed to remain secure against both classical computers and future quantum computers.
Does post-quantum cryptography require a quantum computer?
No. PQC algorithms are designed to run on conventional computers, servers, smartphones and network devices.
Can quantum computers break RSA?
A sufficiently powerful fault-tolerant quantum computer running Shor’s algorithm could theoretically break RSA efficiently. Current quantum computers cannot do this against properly sized modern RSA keys.
Can quantum computers break elliptic-curve cryptography?
A sufficiently powerful quantum computer could also threaten elliptic-curve systems such as ECDH and ECDSA.
Is AES vulnerable to quantum computers?
Quantum algorithms can reduce some symmetric-security margins, but strong symmetric encryption such as AES-256 remains much more resistant than RSA or ECC to known quantum attacks.
What is ML-KEM?
ML-KEM is NIST’s standardized module-lattice-based key-encapsulation mechanism defined in FIPS 203. It is intended for quantum-resistant key establishment.
Is ML-KEM the same as Kyber?
ML-KEM was derived from CRYSTALS-Kyber, but the standardized ML-KEM specification should be treated as the official modern standard rather than assuming every earlier Kyber implementation is identical.
What is ML-DSA?
ML-DSA is NIST’s primary lattice-based post-quantum digital-signature standard, defined in FIPS 204 and derived from CRYSTALS-Dilithium.
What is SLH-DSA?
SLH-DSA is a stateless hash-based digital-signature standard defined in FIPS 205.
What is harvest now, decrypt later?
It describes attackers capturing encrypted information today and storing it in hopes that future quantum computers will eventually make decryption possible.
Does a cryptographically relevant quantum computer exist today?
No publicly known quantum computer currently has the scale and fault tolerance required to break widely deployed modern public-key cryptography.
Why start migrating now?
Large cryptographic transitions can take many years, and sensitive data captured today may remain valuable long enough for future quantum attacks to matter.
What is hybrid post-quantum cryptography?
Hybrid cryptography combines a traditional cryptographic mechanism with a PQC algorithm. The goal is to retain protection if either component remains secure.
Is post-quantum cryptography already being used?
Yes. Major internet infrastructure providers have begun deploying hybrid PQC key exchange, and standards such as IETF RFC 10024 now formally define hybrid ML-KEM mechanisms for TLS 1.3.
When should organizations complete migration?
Timelines vary by organization and jurisdiction. Current U.S. federal strategy targets broad migration by 2035, with some high-value systems facing earlier deadlines.
Post-Quantum Cryptography Is a Migration We Have to Complete Before the Emergency
The most difficult thing about post-quantum cryptography is that the threat it addresses is not yet fully visible.
Today’s browsers still work.
Banks still encrypt transactions.
VPNs still connect.
RSA and elliptic-curve systems have not suddenly collapsed.
That can make quantum migration feel premature.
But cybersecurity migrations become dangerous when they begin only after the old system fails.
A cryptographically relevant quantum computer would not merely create a new type of malware.
It could undermine mathematical assumptions built into decades of digital infrastructure.
Secure websites depend on public-key cryptography.
VPNs depend on it.
Digital certificates depend on it.
Software signatures depend on it.
Authentication systems depend on it.
Cloud services depend on it.
Many long-lived devices contain it.
Replacing all of that takes time.
NIST began preparing years before the threat became practical for precisely that reason.
Its first three standards were finalized in 2024.
ML-KEM now provides the primary standardized path for quantum-resistant key establishment.
ML-DSA and SLH-DSA provide new digital-signature options.
HQC is being developed as an additional KEM based on different mathematical assumptions.
The IETF has standardized hybrid ML-KEM mechanisms for TLS.
Major internet companies are deploying them.
And as of October 27, 2026, NIST now has a final transition roadmap showing how organizations should move away from quantum-vulnerable public-key systems.
The post-quantum cryptography transition is therefore moving through the same path followed by many infrastructure technologies:
research → standardization → experimentation → deployment → migration.
The most urgent organizations are those protecting information that must remain confidential for many years.
For them, “harvest now, decrypt later” changes the timeline.
An attacker does not need a quantum computer today.
They only need the ability to capture today’s encrypted information and keep it until the technology improves.
That means cryptographic protection has to consider not merely whether data is secure this morning, but whether it must still be secure in 2036 or 2046.
Organizations also need to avoid replacing one rigid cryptographic system with another.
The deeper lesson is crypto agility.
Algorithms change.
Weaknesses are discovered.
Standards evolve.
Systems designed to replace algorithms cleanly will survive future transitions far more easily than systems with cryptography permanently embedded throughout their code and hardware.
And ordinary users should keep the threat in perspective.
Quantum computing does not mean every password will suddenly become readable tomorrow.
There is no known cryptographically relevant quantum computer capable of breaking modern RSA and elliptic-curve deployments at scale today.
The correct response is preparation, not panic.
The internet has time to migrate.
But only if the migration begins before that time runs out.
That is ultimately the purpose of post-quantum cryptography.
It is not technology designed for a science-fiction future.
It is cybersecurity infrastructure being built today so that the information society already exists in a safer form if powerful quantum computing eventually arrives.
Follow The News Ink
For more research-driven explainers, science coverage and global stories, follow The News Ink on X, Instagram, Threads, Medium, Substack, Bluesky, Pinterest, TikTok, Quora and Mastodon.
