Post-Quantum Cryptography (PQC, quantum-resistant cryptography)

Post-quantum cryptography means public-key algorithms that run on ordinary computers but rest on problems believed to be hard even for quantum computers, such as module lattices and hash functions. A large enough quantum computer running Shor's algorithm could solve factoring and discrete logarithms, breaking RSA, Diffie-Hellman, ECDHE and ECDSA. In August 2024 NIST published the first standards: FIPS 203 (ML-KEM) for key establishment, FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for signatures. Symmetric algorithms such as AES and SHA-256 need at most larger parameters.

Why it matters

The urgent threat is "harvest now, decrypt later": traffic recorded today could be decrypted once such machines exist. That is why key exchange is migrating first, using hybrid key exchange that pairs a classical algorithm with ML-KEM. Chrome 131 switched its hybrid TLS key exchange to X25519MLKEM768. Signatures and certificates are a slower, separate effort, because ML-DSA keys and signatures are many times larger than ECDSA's, and a forged signature cannot be used against sessions that have already ended.

Example

With OpenSSL 3.5 or later, test whether a server negotiates the hybrid post-quantum group:

openssl s_client -connect example.com:443 -groups X25519MLKEM768

The handshake succeeds only if the server supports X25519MLKEM768. In Chrome, the DevTools Security panel names the key exchange used for the current page.

Common misconceptions

• "Post-quantum cryptography needs quantum hardware." It is ordinary software. Quantum key distribution (QKD) is a different, hardware-based technology.
• "Quantum computers will break all encryption." AES and SHA-256 remain usable; it is the public-key parts that must change.
• "Nothing needs to happen until quantum computers exist." Data recorded today is protected only by today's key exchange.