Post-Quantum Cryptography (PQC) is the next major transition in public-key cryptography. It addresses a specific, existential risk: sufficiently powerful quantum computers could break widely used public-key algorithms such as RSA and elliptic-curve cryptography (ECC).
That risk is not limited to the day a cryptographically relevant quantum computer becomes operational. Organizations must account for the time required to discover where cryptography is deployed, redesign systems, test new algorithms, replace vulnerable components, and protect data that must remain confidential for many years.
In August 2024, the U.S. National Institute of Standards and Technology (NIST) finalized three principal PQC standards: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). These standards are now the foundation for practical PQC migration.
NIST has officially finalized FIPS 203, 204, and 205. Practical migration starts now because Harvest Now, Decrypt Later (HNDL) attacks threaten long-lived confidential data today, years before Q-Day arrives.
What is Q-Day?
Q-Day is the informal term for the point at which a sufficiently capable, cryptographically relevant quantum computer (CRQC) can practically break public-key cryptography that is widely used today. While estimates vary, NIST notes that migration takes many years, so organizations cannot wait for a confirmed date before starting.
Why is quantum computing a cryptographic problem?
Much of today's public-key security depends on mathematical problems that are extremely difficult for conventional computers:
- RSA: Security depends on the difficulty of factoring large integers.
- ECC: Security depends on the difficulty of solving the elliptic-curve discrete logarithm problem.
A sufficiently large, fault-tolerant quantum computer could use Shor's algorithm to solve these problems efficiently, breaking TLS, VPNs, certificates, and digital signatures. PQC uses lattice-based and hash-based mathematics that remain computationally hard for both classical and quantum machines.
The "Harvest Now, Decrypt Later" (HNDL) Threat
In an HNDL attack, adversaries intercept and record encrypted traffic today. Once a quantum computer becomes available, they can decrypt the archived data. This poses an immediate threat to sensitive long-lived data such as health records, government communications, financial logs, and intellectual property.
NIST finalized three standards for two essential cryptographic functions: key establishment and digital signatures.
| Standard | Algorithm | Primary Purpose | Cryptographic Family |
|---|---|---|---|
| FIPS 203 | ML-KEM (Kyber) | Key establishment / Encryption workflows | Module lattices |
| FIPS 204 | ML-DSA (Dilithium) | Primary Digital Signatures | Module lattices |
| FIPS 205 | SLH-DSA (SPHINCS+) | Backup Digital Signatures | Stateless Hash-based |
FIPS 203: ML-KEM
ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) is the principal standard for general-purpose key establishment. It establishes shared symmetric keys used in TLS 1.3, VPN tunnels, and encrypted storage.
FIPS 204: ML-DSA & FIPS 205: SLH-DSA
ML-DSA provides primary quantum-resistant digital signatures for authentication and PKI certificates. SLH-DSA uses hash-based cryptography as a resilient backup if lattice assumptions are ever challenged.
Dr. Michele Mosca introduced an equation to evaluate cryptographic risk:
Where:
- X = Data confidentiality shelf life requirement
- Y = Time required to migrate cryptographic systems
- Z = Estimated time until Q-Day
If X + Y > Z, you are already exposed to quantum risk today.
If data shelf life (X) = 15 years, and migration time (Y) = 8 years, while Q-Day (Z) is 20 years away: 15 + 8 = 23 > 20. Your organization is vulnerable to Harvest Now, Decrypt Later attacks right now.
Crypto-agility is the architectural ability to swap algorithms without re-architecting systems. During transition, hybrid schemes combining classical (ECDH) and PQC (ML-KEM) protect systems against current and future threats simultaneously.
Migration Roadmap Phases
- Catalog all RSA/ECC keys, certificates, and cipher suites.
- Map long-lived data exposed to Harvest Now, Decrypt Later.
- Audit HSMs, VPN appliances, and third-party SaaS vendors for PQC roadmaps.
- Classify systems by data confidentiality shelf life.
- Benchmark ML-KEM and ML-DSA performance in staging environments.
- Deploy hybrid TLS 1.3 key exchange in production perimeters.
5 Common PQC Migration Mistakes
-
Waiting until Q-Day: Ignoring HNDL attacks and multi-year migration timelines.
-
Treating PQC as a minor patch: PQC changes key sizes, signature overhead, and protocol handshakes.
-
Focusing only on encryption: Leaving digital signatures (ML-DSA) vulnerable to forgery.
-
Hard-coding algorithms: Coupling code to specific algorithms instead of abstraction layers.
-
Ignoring third-party dependencies: Failing to audit vendor APIs, libraries, and cloud infrastructure.
Frequently Asked Questions
NIST finalized FIPS 203 (ML-KEM for key establishment), FIPS 204 (ML-DSA for primary digital signatures), and FIPS 205 (SLH-DSA for hash-based digital signatures) in August 2024.
An attack strategy where adversaries intercept and store encrypted traffic today, waiting to decrypt it once a cryptographically relevant quantum computer is built.
A transition mechanism combining a classical algorithm (like ECDH) with a post-quantum algorithm (like ML-KEM) so that security holds even if one algorithm fails.
Start Your PQC Migration Journey Today
Audit your cryptographic inventory and adopt crypto-agile architecture patterns now.
Read Zero Trust Architecture Guide