Post-quantum cryptography: what it is, NIST standards and how to migrate

Post-quantum cryptography is the only application of quantum computing with a deadline already written, because you do not need to own a quantum computer to be affected, it is enough to hold data that must stay confidential for longer than the hardware will take to mature. This guide covers everything needed to make a decision, from the exact threat posed by Shor’s algorithm to what it does and does not put at risk, from the NIST standards published in 2024 to the mathematics of lattices explained at the right level, through to the principle of crypto-agility and the five-step migration plan, with the regulatory deadlines already set in Europe and the United States. The approach is operational, because post-quantum cryptography is a building site to be planned rather than a debate to be followed.

What is post-quantum cryptography?

Post-quantum cryptography, often abbreviated to PQC, is the family of cryptographic algorithms built on mathematical problems for which no efficient attacks are known, even by a quantum computer. It is worth clearing up a common misunderstanding straight away: it is not quantum cryptography and it uses neither qubits nor photons, since it runs on ordinary computers, smartphones and servers exactly like RSA, which is why it can be deployed with a simple software update. The difference lies in the underlying mathematics, because in place of factoring and the discrete logarithm, both vulnerable to Shor’s algorithm, it uses problems such as those on lattices, which resist every quantum attack known so far. A general overview is available on Wikipedia.

Why are RSA and elliptic curves at risk?

RSA and elliptic curves are at risk because their security rests on two problems, factoring and the discrete logarithm, which Shor’s algorithm solves in polynomial time on error-corrected quantum hardware. This is not a threat that can be negotiated away by lengthening the keys, since the cost of the attack grows only polynomially with their size. It must, however, be delimited precisely, because it concerns public-key cryptography, that is, key exchange, digital signatures and certificates. Symmetric cryptography, such as AES, and hash functions suffer at most Grover’s quadratic advantage, which can be neutralised by doubling the lengths, so much so that AES-256 is still considered secure and does not need to be replaced with post-quantum cryptographic algorithms. The scope of the migration, therefore, is vast but well defined, and covers everything that today uses RSA, Diffie-Hellman or elliptic curves. In a typical organisation this means TLS channels, VPNs, document and code signing, digital identities and a long tail of supplier systems, so much so that the real scope only truly emerges by taking an inventory.

Why is the problem urgent already today?

The problem is urgent already today because of the strategy known as harvest now, decrypt later, which consists in intercepting and archiving encrypted traffic today, at storage costs that are by now negligible, in order to decrypt it when quantum hardware has matured. From this follows the rule used to calculate urgency, known as Mosca’s theorem, according to which if the useful life of the data plus the migration time exceeds the time until the threat arrives, one is already late. For trade secrets, health data, classified information and intellectual property, categories whose confidentiality often lasts twenty years, the sum is soon done. And it is precisely for this reason that post-quantum cryptography does not wait for quantum advantage, because the risk window opened with the archives, not with the machines.

What are the 2024 NIST standards?

The standardisation process run by NIST, launched in 2016 with an international competition, produced the first federal standards in 2024. ML-KEM, derived from CRYSTALS-Kyber, is used for key encapsulation, that is, the role that RSA and Diffie-Hellman play today in establishing secure channels, while ML-DSA, derived from CRYSTALS-Dilithium, and SLH-DSA, based on hash functions, are used for digital signatures. Further schemes, on different mathematical foundations, remain under evaluation in order to diversify the risk, so that if one family of problems gave way to an unexpected attack the alternatives would already be ready. For an organisation, these names are the shopping list of the migration, and their adoption in the main protocols and libraries is already under way, so much so that those who migrate today are working on consolidated standards, the fruit of almost a decade of public evaluation.

What is lattice security based on?

The lattices on which the standardised schemes are based are mathematical structures that have been studied at length, regular grids of points in spaces with hundreds of dimensions, in which certain geometric problems remain extremely hard to solve even with enormous computing power. The decisive property, for anyone who has to trust these algorithms, is that no efficient quantum algorithm capable of breaking them is known, despite decades of attempts, because Shor’s algorithm exploits a periodic structure that lattices, as far as we know, do not offer. The security remains conjectural, as for all modern cryptography, but it is built on foundations that have been studied in depth by the international scientific community.

What changes in practice for performance and size?

The migration involves more than a simple change of library, and it is best to know this in advance. Post-quantum keys and signatures are larger, since where an elliptic-curve key takes up tens of bytes, ML-KEM requires hundreds or thousands, and some signatures grow even more. The practical consequences are heavier network handshakes, larger certificates, possible problems on constrained devices such as embedded systems and smart cards, and protocols that have to be adapted. Computational performance, on the other hand, is generally good, often even better than RSA. It is system arithmetic, not dramatic but real, which has to be measured on one’s own actual workloads rather than simply assumed, and it is part of serious migration work. The good news is that the post-quantum cryptography ecosystem has already absorbed a good part of these constraints, since the reference implementations are optimised and the profiles for constrained devices are being defined.

What is crypto-agility and why does it matter?

Crypto-agility is the strategic lesson of this whole affair, because it consists in designing systems so that cryptographic algorithms can be replaced without having to rewrite the applications. The current transition is made slow and costly precisely by cryptography hard-wired deep inside firmware, proprietary protocols and decades-old devices, whereas the next transition, because there will be one anyway, whatever the cause, will have to cost less. In practice it means abstraction of cryptographic primitives, inventories maintained over time and the adoption of hybrid modes, in which classical and post-quantum algorithms work together so that security holds even if one of the two were to fail. The major network protocols are already following this path, and it is worth keeping it as a reference.

How is the migration plan built?

The migration plan is divided into five sequential steps, by now codified by the guidelines of the main agencies.

1. Inventory. Map where the vulnerable cryptography lives, including what is nested inside suppliers, devices and protocols, typically the longest phase.
2. Classification. Rank the data by useful life, because it is this criterion, dictated by Mosca’s theorem, that sets the priorities.
3. Prioritisation. Start from critical infrastructure, from channels carrying long-confidentiality data and from signing systems with multi-year validity.
4. Replacement. Adopt the standards, preferably in hybrid mode, coordinating with suppliers.
5. Verification. Carry out interoperability and performance tests, with continuous monitoring, because migration is a multi-year programme, not a one-off project.

Which deadlines have regulators set?

The main jurisdictions have already put precise dates on the calendar. In the United States, federal directives require agencies to carry out a cryptographic inventory and to transition national security systems, with horizons pointing to the early 2030s. In Europe, the roadmap coordinated by the Member States calls for the formal start of migration and the priority protection of critical infrastructure by the end of the decade, in line with the NIS2 Directive. The subject also falls within the perimeter of national security and of critical technologies. The regulatory message is by now unambiguous, because post-quantum cryptography has moved from recommendation to obligation with a deadline, and the technical time needed for a serious inventory makes it advisable not to wait for the last possible year.

What role does emulation play in preparation?

Here, emulation plays a role that is above all educational and one of risk assessment. In a quantum emulation environment such as the EQM platform used by HumanQ, the security team can run Shor’s algorithm on reduced instances and understand mechanically how the attack it is countering works, so that the defence can be sized better when the threat is no longer an abstract acronym but an experiment reproduced with one’s own hands. Emulation also helps to follow the evolution of attack variants that use few qubits, the parameter that most influences timeline estimates. Combined with the inventory and the migration plan, it closes the circle of quantum readiness, a path that can be summed up in three steps: understand, quantify, act.