Post-Quantum Cryptography Explained: How Quantum-Safe Encryption Works in 2026

Your encrypted data from 2019 might get cracked in 2031. Not because someone broke your password. Because a government agency stored it and is waiting for the hardware to catch up.

That’s the part of the quantum security conversation most people skip. We talk about future threats as if they’re future problems, but they aren’t. The harvesting is already happening, only decryption is delayed.

I’ve spent time reading through NIST’s finalized post-quantum cryptography standards, studying how PQC algorithms actually work under the hood, and tracking where the industry is in this migration. Here’s what I’ve found — and why I think most organizations are underestimating the urgency.

Key Takeaways

• Post-quantum cryptography is an encryption algorithm designed to hold off attacks from classical and quantum computers.
• NIST finalized its first three PQC standards in August 2024, the ML-KEM, ML-DSA, and SLH-DSA.
• Current RSA and ECC encryption breaks under Shor’s algorithm on a sufficiently powerful quantum computer.
• The “harvest now, decrypt later” (HNDL) threat means adversaries are collecting your encrypted data today to crack it once quantum computers mature.
• NIST plans to deprecate quantum-vulnerable algorithms by 2035, with high-risk systems transitioning much earlier.
• Quantum-safe encryption exists now and is ready to deploy.

What Is Post-Quantum Cryptography (PQC)?

Post-quantum cryptography is a class of cryptographic algorithms that remain secure even when an attacker has access to a large-scale quantum computer. The “post” doesn’t mean these algorithms are built on quantum technology. It means they’re designed to survive in a world where quantum computers are a real attack vector.

This is a subtle but important distinction. Quantum safe cryptography runs on today’s classical hardware. It’s not quantum key distribution or anything exotic. It’s math that’s hard for both regular computers and quantum machines to break.

Quantum-Safe vs Traditional Cryptography 

Traditional public-key cryptography, think RSA and Elliptic Curve Cryptography (ECC), relies on mathematical problems that are computationally expensive for classical computers but get completely demolished by quantum algorithms.

RSA depends on the difficulty of factoring large numbers. ECC relies on the elliptic curve discrete logarithm problem. Both of these can be solved efficiently using Shor’s algorithm on a quantum computer. That’s the core problem.

Quantum safe cryptography instead builds on mathematical problems that remain hard even for quantum machines:

• Lattice problems (the basis of most current NIST-selected PQC algorithms)
• Hash functions (used in SLH-DSA)
• Error-correcting codes (used in HQC, selected by NIST in March 2025 as a backup)
• Multivariate polynomial equations

These don’t have known quantum speedups. That’s what makes them interesting.

Why Post-Quantum Cryptography (PQC)  matters now

Here’s the most uncomfortable part, even if a cryptographically relevant quantum computer doesn’t exist yet, that doesn’t mean the threat is hypothetical. Nation-state actors are almost certainly running what’s called a “harvest now, decrypt later” operation. They collect encrypted traffic today, store it, and wait.

A research published in December 2025 showed that high-retention sectors face exposure due to delayed PQC adoption. Hybrid and forward-secure approaches reduces that risk horizon by over 65%. 

Why Quantum Computing Threatens Current Encryption?

Limitations of RSA and ECC

RSA-2048 is currently considered secure because factoring a 2048-bit number takes an impractical amount of time on regular hardware. The same math that protects your TLS handshake, your SSH keys, and your code-signing certificates.

ECC is more efficient but structurally similar: both rely on one-way mathematical functions that are easy to compute in one direction and hard to reverse.

The problem is that “hard for classical computers” isn’t the same as “hard for all computers.” And quantum computers don’t play by the same rules.

Shor’s algorithm and quantum risk

Shor’s algorithm, published in 1994, can factor large integers and solve discrete logarithm problems in polynomial time on a quantum computer.

Right now, Shor’s algorithm needs a fault-tolerant quantum computer with millions of physical qubits to break RSA-2048. We’re not there yet. Current quantum hardware is noisy, error-prone, and operates at a fraction of that scale.

But NIST’s own published guidance notes a 2016 expert report, which acknowledged the possibility of quantum technology rendering RSA insecure by 2030. The point is that the transition from classical to quantum-safe cryptography takes 10 to 15 years across a large infrastructure. Which means the time to start was yesterday.

The harvest now, decrypt later threat

This is the attack vector, I think, that gets glossed over most.

“Harvest now, decrypt later” (HNDL) works like this: an adversary intercepts and stores your encrypted communications today. They can’t read them yet. But when a sufficiently powerful quantum computer arrives, they decrypt everything in the archive.

Multiple real-world incidents fit the HNDL pattern. In 2016, Canadian internet traffic to South Korea was rerouted through China. In 2019, something similar happened in Europe involving mobile phone traffic. Again in 2020, traffic from Google, Amazon, Facebook, and over 200 other networks was redirected through Russia.

If any of that traffic was being collected for HNDL purposes, the organizations involved have no way to know. And they won’t know until quantum computers are powerful enough to crack it. By then, it’s too late.

How Post-Quantum Cryptography Works

The underlying math matters here, so let me break down the main families of quantum-safe encryption.

How Lattice Cryptography Works 

Lattice cryptography is the most prominent family in current PQC standards. Both ML-KEM and ML-DSA, the two primary NIST-selected algorithms, are built on lattice problems.

A lattice is a grid of points in high-dimensional space. The security comes from a problem called “Learning With Errors” (LWE). It’s given a noisy system of linear equations, just to find the original solution. Adding structured noise makes this extremely hard to solve, even with quantum algorithms.

The module in ML-KEM (Module-Lattice-Based Key Encapsulation Mechanism) refers to a specific variant called the Module-LWE problem, which offers a good balance between security strength and key size. This is currently the only NIST-approved post-quantum key establishment scheme based on public key cryptography.

Lattice cryptography is fast, produces relatively small keys compared to other PQC families, and is well-studied. It’s the closest thing to a drop-in replacement for RSA/ECC from a performance standpoint.

Hash-based cryptography explained

Hash-based signatures like SLH-DSA (formerly SPHINCS+) rely solely on the security of hash functions, such as SHA-256. Hash functions are already post-quantum: Grover’s algorithm provides only a quadratic speedup against them, which is neutralized by doubling key sizes.

The tradeoff is signature size. SLH-DSA produces larger signatures but is slower than ML-DSA. But its security is extremely well-understood. If lattice cryptography ever develops an unexpected vulnerability, SLH-DSA is your backup. 

When long-term robustness is the priority, NIST recommends using SLH-DSA, like the government archives and critical infrastructure data that needs to remain verifiably secure for decades.

Code-based cryptography explained

Code-based cryptography is based on error-correcting codes. The classic example is McEliece. Quantum-safe encryption security comes from the hardness of decoding a general linear code.

In March 2025, NIST selected Hamming Quasi-Cyclic (HQC) as an additional KEM algorithm, specifically as a backup to ML-KEM. And the reason for that is diversification. If a weakness is found in lattice-based ML-KEM, having a code-based backup built on entirely different math mitigates that risk. A draft standard for HQC is expected in early 2026, final in 2027.

Multivariate cryptography explained

Multivariate schemes are based on the difficulty of solving systems of multivariate polynomial equations over finite fields. These are generally faster for signature verification but produce large public keys.

NIST’s evaluation showed mixed results for multivariate candidates. One submission (Rainbow) was broken during the competition. The field is still active in research, but current NIST PQC standards don’t use multivariate schemes as primary algorithms.

NIST PQC Standards and Selected Algorithms

Why NIST Standardized Post-Quantum Cryptography (PQC)

Cryptographic standards don’t just matter for government systems. They set the baseline for everything, starting from TLS, browsers, certificate authorities, cloud infrastructure, hardware security modules. When NIST standardizes something, the whole ecosystem follows.

NIST started this process in 2016 with a global competition. 82 initial submissions came in by the end of 2017. After multiple evaluation rounds and years of global cryptanalysis, three algorithms made the final cut.

NIST-Selected Post-Quantum Cryptography Algorithms 

FIPS Standard	Algorithm	Type	Use Case
FIPS 203	ML-KEM	Lattice-based KEM	General encryption, TLS key exchange
FIPS 204	ML-DSA	Lattice-based signatures	Code signing, document signing, protocol authentication
FIPS 205	SLH-DSA	Hash-based signatures	Long-term security, critical infrastructure
FIPS 206 (draft)	FN-DSA (FALCON)	Lattice-based signatures	Bandwidth-limited environments, high-throughput signing

ML-KEM is what you’ll encounter first. As of mid-August 2024, over 16% of human-generated requests to Cloudflare’s servers were already protected with a preliminary version of ML-KEM. That adoption rate is growing. Most browsers will default to PQC key exchange before long.

ML-DSA is the go-to for signatures. Three parameter sets (ML-DSA-44, -65, -87) let you tune the security level versus performance tradeoff.

SLH-DSA is slower and produces larger signatures but relies on hash functions rather than lattices, making it structurally independent from ML-DSA. Good diversification.

FN-DSA (FALCON) offers compact signatures and very high performance, specifically useful where bandwidth is tight. It’s still progressing through standardization as FIPS 206.

Post-Quantum Cryptography (PQC) standardization timeline

• 2016: NIST launched the PQC competition.
• 2022: First algorithms announced for standardization.
• August 2024: FIPS 203, 204, and 205 were finalized and became effective.
• March 2025: HQC selected as backup KEM (draft FIPS expected early 2026).
• 2027: NSA CNSA 2.0 deadline for PQC deployment in new classified systems.
• 2030: NIST expects early adopters in financial services and government to complete the transition.
• 2035: NIST will deprecate quantum-vulnerable algorithms entirely.

Practical Tradeoffs of Post-Quantum Cryptography 

Security advantages of quantum-safe encryption

The most clear advantage is its immunity to Shor’s algorithm. RSA-2048 and ECC-256 break completely under quantum attack. But ML-KEM-768 provides a 192-bit security even against a quantum adversary.

Symmetric algorithms like AES-256 and SHA-384 are mostly fine. Grover’s algorithm cuts their effective security in half, but AES-256 still provides 128-bit post-quantum security. That’s considered sufficient.

The vulnerability is entirely in public-key cryptography. That’s what PQC replaces.

Performance Tradeoffs and Key Size Differences

This is where it gets real. PQC algorithms are not free upgrades.

• ML-KEM-768 has a public key of 1,184 bytes versus 256 bytes for ECC P-256
• ML-DSA-65 signatures are around 3,309 bytes versus 64 bytes for ECDSA
• SLH-DSA signature sizes range from roughly 8KB to 50KB, depending on the parameter set

For most web traffic, this is manageable. For constrained IoT devices with limited bandwidth and memory, it’s a real engineering challenge. A smart meter designed to run for 15 years needs to handle larger keys, larger signatures, and updated firmware from a vendor that may not have moved quickly enough.

Processing time is also higher, though lattice-based algorithms are fast enough for most applications. SLH-DSA’s slowness is the outlier that makes it impractical as a default but worthwhile for specific high-stakes use cases.

Compatibility with existing systems

The transition isn’t like a simple software update. It includes the TLS 1.3, X.509 certificates, VPN protocols, etc.

NIST’s transition timeline projects adoption cycles of 5-10 years for critical infrastructure. That’s the engineering complexity of replacing traditional systems in layers.

Who Needs Post-Quantum Cryptography Today

Financial institutions and long-term data protection

Banks don’t just need to secure today’s transactions. They store decades of financial records. If HNDL adversaries are collecting encrypted financial data now, those records could be exposed when quantum hardware matures.

Financial sector organizations transitioning early are making the right call. NIST projects early financial services adopters completing the transition by 2027 to 2030.

Cloud providers and enterprise security

AWS, Google Cloud, and Microsoft Azure have all announced hybrid TLS support, with full PQC migration targets by 2028 – 2030. If your cloud workloads involve sensitive data with multi-decade confidentiality requirements, hybrid PQC matters right now. And it’s important to do it before those clouds complete their full migration.

Blockchain and digital signature infrastructure

The Federal Reserve published research in 2025 on HNDL risks to distributed ledger networks. It creates a structural problem, as public blockchain transactions are permanently public. A quantum computer capable of running Shor’s algorithm could derive private keys from recorded public keys, exposing historical wallets. PQC-based signatures need to be built into blockchain protocols before quantum hardware reaches that capability.

National security and defence

The NSA’s CNSA 2.0 roadmap mandates PQC deployment for new national security systems by 2027, and complete transition by 2035. These attacks targeting government communications represent a direct threat to national security.

IoT and connected device ecosystems

IoT devices are the hardest migration target. They’re embedded and often designed without considering cryptographic agility. Today’s systems with RSA-2048 and a 10-year lifecycle will still be running when quantum attacks become common.

Anything with a long operational life and hardcoded cryptographic libraries needs attention now.

Challenges in Implementing PQC Algorithms

Migration complexity and infrastructure updates

Replacing cryptographic primitives isn’t like patching a library. It touches certificate issuance, revocation, trust chain verification, protocol negotiation, etc. Organizations with complex infrastructure will find that each layer has different readiness levels.

The NIST recommendation to start by inventorying systems using encryption is practical advice. You can’t migrate what you haven’t mapped.

Large key sizes and bandwidth

Bigger keys mean bigger TLS, large certificates with bigger memory requirements in constrained environments. For fast environments, the per-connection overhead adds up. Early Cloudflare deployments showed that this is manageable, but it requires testing.

Integration with existing cryptographic systems

Most real deployments will use hybrid approaches during the transition, like a classical algorithm like X25519 combined with ML-KEM. The industry de facto standard is X25519MLKEM768 for TLS key exchange. This provides security against both classical and quantum attackers during the transition period.

Cryptographic agility requirements

Building quantum-safe encryption into systems should come with cryptographic agility. And that’s the ability to swap algorithms without rebuilding the entire stack. If ML-KEM develops an unexpected weakness after 5 years, you need to be able to move to HQC without a crisis. 

The Future of Quantum-Safe Security

Hybrid cryptography approaches

Hybrid cryptography pairs two algorithms, a classical and a post-quantum. You get the proven security of the classical with the quantum resistance of the PQC. If either one’s broken, the other still provides protection.

This is the practical recommendation for most deployments right now. The FIPS standards explicitly allow PQ/T hybrid combinations. The industry has largely converged on X25519MLKEM768 for TLS.

Timeline for practical quantum computers

Expert estimates vary widely. Some project a cryptographically relevant quantum computer within 10 years. Others think 20 years is more realistic. But the truth is that no one knows.

What’s certain is that the migration timeline for large-scale infrastructure is measured in years, not months. 

Enterprise Readiness and Transition Strategies

The ETSI Quantum-Safe Cryptography Roadmap projects hybrid deployment in 5G networks by 2026-2028. It’ll include full PQC integration in 6G specifications by 2030 and beyond. Enterprises building on top of those networks need to track those timelines.

For most teams, the right starting point is:

1. Inventory all systems using public-key cryptography.
2. Prioritize based on data sensitivity and system lifespan.
3. Pilot ML-KEM for TLS on low-risk services first.
4. Test performance under realistic load before full rollout.
5. Adopt cryptographic agility from the start so future algorithm swaps are routine, not emergencies.

Final Thoughts

Post-quantum cryptography isn’t a speculative field anymore. NIST has finalized standards. Some are approved for federal use and ready for commercial adoption. Cloudflare already has some of its traffic using quantum-safe key agreement. 

But the problem isn’t availability, it’s organizational inertia. Cryptographic migration is slow. But HNDL attacks make the threat non-hypothetical. If sensitive data you encrypted years ago gets exposed in 2030 because someone collected it in 2024, no future PQC deployment can help you.

The timeline that matters isn’t when quantum computers arrive. It’s how long it takes you to migrate.

FAQs