In 2016, the NSA warned that quantum computers would eventually break the encryption protecting everything from HTTPS to classified communications. The agency urged vendors to start transitioning to "quantum-resistant" algorithms. Most organizations ignored the advice. After all, quantum computers capable of breaking RSA and ECC still felt like science fiction.
They still do, sort of. But the timeline has shifted. NIST finalized its first three post-quantum cryptography standards in August 2024, major cloud providers are shipping PQC-enabled services, and the migration clock is ticking louder.
I've been tracking NIST's PQC standardization process since CRYSTALS-Kyber was first announced. The migration timeline is shorter than most organizations realize.
What is post-quantum cryptography?
Post-quantum cryptography (PQC) is a set of encryption algorithms designed to resist attacks from quantum computers. Unlike quantum key distribution, which requires exotic hardware, PQC runs on classical computers. It just uses harder math.
The candidates fall into four families: lattice-based, hash-based, code-based, and multivariate. NIST selected CRYSTALS-Kyber for key encapsulation and CRYSTALS-Dilithium for digital signatures as its primary standards, published as ML-KEM (FIPS 203) and ML-DSA (FIPS 204), with the hash-based SLH-DSA (FIPS 205) as a backup signature scheme. These are the algorithms most organizations will adopt first.
Why does it matter now?
Because "harvest now, decrypt later" is real. Adversaries are collecting encrypted traffic today, storing it, and planning to decrypt it once quantum computers arrive. If your data has a ten-year shelf life — healthcare records, financial transactions, state secrets — it's already at risk.
MarketsandMarkets projects the post-quantum cryptography market will grow from $420 million in 2025 to $2.84 billion by 2030. That growth signals real urgency. The question is no longer whether to migrate, but how fast.
How does PQC compare to classical cryptography?
| Dimension | Classical (RSA/ECC) | Post-Quantum (ML-KEM/ML-DSA) |
|---|---|---|
| Public key size | 256–512 bytes (RSA-2048 to RSA-4096) | 800–1,568 bytes (ML-KEM); 1,312–2,592 bytes (ML-DSA) |
| Signature size | 256–512 bytes (RSA) | 2,420–4,627 bytes (ML-DSA) |
| Performance | Mature, hardware-optimized | Slower, larger, improving |
| Quantum resistance | None | Resistant to Shor's algorithm |
| Maturity | Decades of deployment | First FIPS standards finalized in 2024 |
The tradeoff is size and speed. PQC keys and signatures are larger. That matters for constrained devices and high-throughput systems. But for most enterprise use cases, the bandwidth and storage cost is negligible compared to the risk of staying on classical cryptography.
What are the migration challenges?
Cryptoagility. Most systems hardcode algorithm choices. Upgrading requires code changes, certificate rotations, and compatibility testing across clients and servers. If your architecture doesn't let you swap algorithms without a redeployment, you're not ready.
Long-lived data. TLS protects data in transit. PQC matters most for data at rest with long lifespans. Healthcare records, legal documents, and government archives need encryption that outlasts the quantum transition.
Vendor coordination. You can't migrate alone. Your cloud provider, your PKI vendor, your chipset supplier, and every partner with a TLS handshake must align on algorithms and timelines. The same goes for the code-signing keys that anchor your software supply chain.
How do you prepare?
Start with a cryptographic inventory. Know what algorithms you're using, where they're deployed, and how long the protected data needs to remain confidential. Prioritize long-lived, high-sensitivity systems for early migration.
Build cryptoagility into new systems. Design your security architecture so algorithm choices are configuration, not code. That makes future transitions cheaper.
Align your vendors. Ask your cloud provider, your certificate authority, and your hardware supplier about their PQC roadmaps. If they don't have answers, that's a risk signal.
In the PQC migration roadmaps I've reviewed, preparation takes well over a year, and most organizations that started early are still working through their cryptographic inventory.
FAQ
Will quantum computers break all encryption?
No. Symmetric encryption like AES-256 remains safe with larger key sizes. The threat is specifically to public-key cryptography: RSA, ECC, Diffie-Hellman.
When do I need to complete migration?
There's no single universal deadline, but NIST's draft transition guidance (NIST IR 8547) proposes deprecating 112-bit RSA and elliptic-curve algorithms after 2030 and disallowing quantum-vulnerable public-key algorithms after 2035. Data with a 10–30 year lifespan needs protection now.
What's the performance impact of PQC?
Handshake times increase due to larger key exchanges. For most web applications, the impact is measurable but not prohibitive. For IoT and high-frequency trading, it requires more careful engineering.
Can I use PQC alongside classical cryptography?
Yes. Hybrid modes — running both classical and post-quantum key exchanges simultaneously — let you transition without breaking compatibility. This is the recommended approach during the migration period.
Which NIST standards should I adopt?
Start with ML-KEM (FIPS 203, derived from CRYSTALS-Kyber) for key encapsulation and ML-DSA (FIPS 204, derived from CRYSTALS-Dilithium) for digital signatures. SLH-DSA (FIPS 205) is a hash-based signature alternative.
Sources
- NIST: NIST Releases First 3 Finalized Post-Quantum Encryption Standards
- NIST CSRC: FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard
- NIST: FIPS 204, Module-Lattice-Based Digital Signature Standard
- NIST CSRC: IR 8547 (Initial Public Draft), Transition to Post-Quantum Cryptography Standards
- MarketsandMarkets: Post-quantum Cryptography (PQC) Market worth $2.84 billion by 2030