The New Mathematical Foundations
Post-Quantum Cryptography (PQC) refers to cryptographic algorithms designed to be secure against attacks from both classical and quantum computers. The goal is not to use quantum mechanics (that's Quantum Key Distribution, a different field) — it's to find new mathematical problems that quantum computers cannot solve efficiently.
The key insight: Shor's Algorithm is specifically tailored to factoring and discrete logarithm problems. It does not provide a general speedup for all mathematical problems. PQC researchers have identified several mathematical domains that appear resistant to known quantum algorithms.
Lattice-Based Cryptography: The Leading Approach
The most promising and widely adopted PQC approach is lattice-based cryptography. A lattice is a regular grid of points in high-dimensional space (think of a 2D grid of dots, but extended to hundreds or thousands of dimensions).
The hard problem underlying lattice cryptography is the Shortest Vector Problem (SVP): given a lattice defined by a set of basis vectors, find the shortest non-zero vector in the lattice. In high dimensions, this problem is believed to be hard for both classical and quantum computers. No efficient quantum algorithm for SVP is known.
The NIST PQC Standardization Process
Recognizing the urgency, the US National Institute of Standards and Technology (NIST) launched a global competition in 2016 to evaluate and standardize post-quantum cryptographic algorithms. Dozens of submissions from cryptographers worldwide were evaluated over multiple rounds.
In 2024, NIST published the first finalized PQC standards:
| Standard | Based On | Purpose | Replaces |
|---|---|---|---|
| ML-KEM (formerly CRYSTALS-Kyber) | Lattice (Module-LWE) | Key encapsulation / key exchange | RSA, ECDH |
| ML-DSA (formerly CRYSTALS-Dilithium) | Lattice (Module-LWE) | Digital signatures | RSA, ECDSA |
| SLH-DSA (formerly SPHINCS+) | Hash functions | Digital signatures | RSA, ECDSA |
| FN-DSA (formerly FALCON) | Lattice (NTRU) | Digital signatures (compact) | RSA, ECDSA |
ML-KEM is the primary algorithm for key exchange and is expected to become the default in TLS, SSH, and VPN protocols. ML-DSA is the primary algorithm for digital signatures. SLH-DSA is a conservative backup based on hash functions (a completely different mathematical foundation), providing diversity in case lattice-based approaches are later found to be vulnerable.
The Migration Challenge
Migrating the internet's cryptographic infrastructure is a massive, multi-decade undertaking:
- Hardware: Cryptographic accelerators in CPUs, network cards, and HSMs must be updated or replaced.
- Protocols: TLS, SSH, IPsec, and code signing standards must be updated. TLS 1.3 is already being extended to support hybrid key exchange (combining classical ECC with ML-KEM for defense-in-depth during the transition).
- Software: Every library, application, and service that performs cryptographic operations must be updated.
- Key sizes: PQC algorithms generally have larger key sizes and signatures than their classical counterparts, impacting bandwidth and storage.
The recommended strategy for organizations today is crypto-agility: designing systems so that the cryptographic algorithm can be swapped out without redesigning the entire system. This means abstracting cryptographic operations behind interfaces rather than hardcoding specific algorithms.
If asked "How does your organization prepare for post-quantum cryptography?", a strong answer covers three points: (1) Inventory — identify all systems using asymmetric cryptography (TLS endpoints, SSH keys, code signing, VPNs); (2) Crypto-agility — ensure cryptographic algorithms are configurable, not hardcoded, so migration is a configuration change rather than a rewrite; (3) Prioritize long-lived secrets — data that must remain confidential for 10+ years should be re-encrypted with PQC algorithms now, because of harvest-now-decrypt-later attacks. Mentioning the NIST standards (ML-KEM, ML-DSA) by name demonstrates current awareness.