# What Is Post-Quantum Cryptography? Definition and Examples

> Post-quantum cryptography (PQC) is public-key cryptography designed to resist attackers with large quantum computers, which could break RSA and ECC.

Source: https://ssl.sh/glossary/post-quantum-cryptography/
Last updated: 2026-11-10

Post-quantum cryptography means public-key algorithms that run on ordinary computers but rest on problems believed to be hard even for quantum computers, such as module lattices and hash functions. A large enough quantum computer running Shor's algorithm could solve factoring and discrete logarithms, breaking [RSA](https://ssl.sh/glossary/rsa/), Diffie-Hellman, ECDHE and ECDSA. In August 2024 NIST published the first standards: FIPS 203 ([ML-KEM](https://ssl.sh/glossary/ml-kem/)) for key establishment, FIPS 204 ([ML-DSA](https://ssl.sh/glossary/ml-dsa/)) and FIPS 205 (SLH-DSA) for signatures. Symmetric algorithms such as AES and SHA-256 need at most larger parameters.

## Why it matters
The urgent threat is "harvest now, decrypt later": traffic recorded today could be decrypted once such machines exist. That is why key exchange is migrating first, using [hybrid key exchange](https://ssl.sh/glossary/hybrid-key-exchange/) that pairs a classical algorithm with ML-KEM. Chrome 131 switched its hybrid TLS key exchange to X25519MLKEM768. Signatures and certificates are a slower, separate effort, because ML-DSA keys and signatures are many times larger than ECDSA's, and a forged signature cannot be used against sessions that have already ended.

## Example
With OpenSSL 3.5 or later, test whether a server negotiates the hybrid post-quantum group:

```bash
openssl s_client -connect example.com:443 -groups X25519MLKEM768
```

The handshake succeeds only if the server supports X25519MLKEM768. In Chrome, the DevTools Security panel names the key exchange used for the current page.

## Common misconceptions
- **"Post-quantum cryptography needs quantum hardware."** It is ordinary software. Quantum key distribution (QKD) is a different, hardware-based technology.
- **"Quantum computers will break all encryption."** AES and SHA-256 remain usable; it is the public-key parts that must change.
- **"Nothing needs to happen until quantum computers exist."** Data recorded today is protected only by today's key exchange.

## Related terms

- [ML-KEM](https://ssl.sh/zh/glossary/ml-kem/): ML-KEM 是 NIST 于 2024 年 8 月在 FIPS 203 中标准化的后量子密钥封装机制，源自 CRYSTALS-Kyber，用于抗量子的密钥建立。
- [ML-DSA](https://ssl.sh/zh/glossary/ml-dsa/): ML-DSA 是 NIST 于 2024 年 8 月在 FIPS 204 中标准化的基于格的后量子数字签名算法，源自 CRYSTALS-Dilithium。
- [X25519MLKEM768](https://ssl.sh/zh/glossary/x25519mlkem768/): X25519MLKEM768 是把经典的 X25519 与后量子算法 ML-KEM-768 组合起来的 TLS 1.3 混合密钥交换群，Chrome 从 131 版起使用。
- [混合密钥交换](https://ssl.sh/zh/glossary/hybrid-key-exchange/): 混合密钥交换把 X25519 等经典算法与 ML-KEM 等后量子 KEM 组合使用，只要其中一个未被攻破，得到的会话密钥就仍然安全。
- [RSA](https://ssl.sh/zh/glossary/rsa/): RSA 是 1977 年提出的公钥算法，TLS 用它对证书和握手进行签名，在 TLS 1.3 之前还用它传输会话密钥。
- [ECC](https://ssl.sh/zh/glossary/ecc/): ECC 即椭圆曲线密码学，是基于有限域上椭圆曲线代数结构的公钥密码技术，能用较短的密钥提供很高的安全强度。
- [密钥交换](https://ssl.sh/zh/glossary/key-exchange/): 密钥交换是 TLS 握手中客户端与服务器建立共享秘密的步骤，保护连接的对称密钥都由这个共享秘密派生而来。