QianHeng乾珩 PQC Docs Hub量子文档 ✦ Ask AI✦ 问问文档 ⚐ Scan⚐ 扫一扫
/

QianHeng PQC

A bilingual, teaching-first guide to post-quantum cryptography — explaining the NIST FIPS 203 / 204 / 205 standards, the algorithms behind them, and how to migrate real systems before a cryptographically relevant quantum computer arrives.

Get Started Browse Standards Migration Guide
3finalized FIPS standards (203/204/205)
90+documentation pages
5NIST security categories defined — ML-KEM uses levels 1/3/5 (≈ AES-128/192/256)
EN / 中文bilingual docs

A sufficiently large, fault-tolerant, cryptographically relevant quantum computer running Shor's algorithm would break RSA, Diffie-Hellman and elliptic-curve cryptography — the asymmetric crypto that secures virtually all of today's networks. Post-quantum cryptography (PQC) replaces — and during migration complements (hybrid) — those primitives with new ones believed to resist both classical and quantum attack. This site is a practical, standards-anchored map of that transition.

Why migrate now?

The standards are final

NIST published ML-KEM, ML-DSA and SLH-DSA as FIPS 203/204/205 in August 2024. The interoperable targets exist today, so migration planning no longer needs to wait for NIST's algorithm selection — protocol profiles, certification and product support still need tracking.

Harvest now, decrypt later

Traffic protected today by classical public-key key exchange can be recorded and later decrypted if a quantum computer recovers the session keys (symmetric ciphertext such as AES-256 is not directly broken by Shor). Data with a long secrecy lifetime is already at risk.

Migration is slow

Replacing cryptography across PKI, protocols, hardware and embedded fleets takes years. Crypto-agility has to be engineered, not bolted on.

Mandates are landing

For U.S. federal and national-security systems, NSM-10 (US National Security Memorandum 10) and CNSA 2.0 set concrete migration deadlines; the EU and UK have published staged PQC migration roadmaps.

Browse by topic

Quick Start →

What PQC is, the threat model, and the migration timeline.

Standards →

FIPS 203/204/205, SP 800-208/227, and the global standards map.

Global & Industry →

IETF, ISO/IEC, ETSI, regional mandates, and telecom (3GPP / GSMA).

Algorithm Families →

Lattice, hash, code, multivariate and isogeny-based schemes.

Algorithms →

Deep dives on ML-KEM, ML-DSA, SLH-DSA, Falcon and more.

Migration →

Crypto-agility, hybrid modes, discovery and a playbook.

Protocols →

TLS 1.3, SSH, IPsec and X.509 certificate integration.

Implementation →

liboqs, OpenSSL providers, side-channels and benchmarks.

Solutions →

Sector playbooks: finance, power/energy, Web3.

Industry Practice →

QKD vs PQC, risk model, build blueprint, China vendors & cases.

Reference →

Comparison tables, FAQ, glossary and external resources.

Standardized and selected algorithms

Final FIPS standards — published as final standards in August 2024.

ML-KEM

FIPS 203 — lattice key encapsulation (was CRYSTALS-Kyber).

ML-DSA

FIPS 204 — lattice signatures (was CRYSTALS-Dilithium).

SLH-DSA

FIPS 205 — stateless hash-based signatures (was SPHINCS+).

Selected — standard forthcoming (not yet a final FIPS standard).

FN-DSA

Falcon — compact lattice signatures; FIPS 206 is still in progress and not yet final — see NIST for the draft and the final-release timing.

HQC

An additional code-based KEM alongside ML-KEM (algorithm diversity), selected by NIST in 2025; final standard expected ~2027 (FIPS number not yet official).

Conservative reference candidate — not a NIST FIPS standard; later status is per ISO/IEC or related standards-body work items.

Classic McEliece

Conservative code-based KEM, large public keys; not a final FIPS standard.

Migrate real systems

The standards are only useful once they reach your protocols and PKI — start where the data is.

TLS 1.3

Hybrid ECDHE + ML-KEM (e.g. X25519MLKEM768, still an IETF draft) is deploying across major browser and server stacks; certificates and authentication still rely mostly on RSA/ECDSA, so migration is not yet complete.

Hybrid Modes

Combine classical + PQC so neither alone is a single point of failure.

Discovery & CBOM

Inventory your cryptography before you can replace it.

PKI Migration

Certificates, chains and the size impact of PQC signatures.

A first key exchange

Encapsulating a shared secret with ML-KEM-768 using liboqs in Python:

import oqs

# Recipient (server) generates a keypair
with oqs.KeyEncapsulation("ML-KEM-768") as server:
    public_key = server.generate_keypair()

    # Sender (client) encapsulates a shared secret to the public key
    with oqs.KeyEncapsulation("ML-KEM-768") as client:
        ciphertext, secret_sender = client.encap_secret(public_key)

    # Recipient decapsulates to recover the same secret
    secret_recipient = server.decap_secret(ciphertext)

assert secret_sender == secret_recipient   # shared secret established
print("shared secret:", secret_sender.hex())

Educational example. The exact package, algorithm identifiers and enabled mechanisms vary by liboqs / oqs-python version; a production system needs an audited library and a real key-management design.

Note
This is an educational reference. Summaries are meant to orient engineers and architects; before you implement, always work from the authoritative NIST, IETF and ISO documents linked on each page. Switch to 中文 with the language toggle at the top right.

Recently updated近期更新

See the full changelog.查看完整更新日志。

乾珩 PQC

偏教学、重讲解的后量子密码双语指南——讲清 NIST FIPS 203 / 204 / 205 标准、背后的算法原理， 以及如何在具备密码学威胁的量子计算机到来之前完成真实系统的迁移。

快速开始 浏览标准 迁移指南
3已定稿 FIPS 标准（203/204/205）
90+文档页面
5NIST 定义的安全类别 ML-KEM 取其中 1/3/5 约 AES-128/192/256
EN / 中文双语文档

一台足够大、容错、达到密码学相关规模的量子计算机运行 Shor 算法将能攻破 RSA、Diffie-Hellman 与椭圆曲线密码——也就是支撑当今 几乎所有网络安全的非对称密码。后量子密码（PQC）采用被认为能同时抵抗经典与量子攻击的新原语，在迁移期与其并用（混合），并最终将其替换。 本站是这场迁移的实用、以标准为锚点的导览图。

为什么现在就要迁移

标准已定稿

NIST 于 2024 年 8 月把 ML-KEM、ML-DSA、SLH-DSA 发布为 FIPS 203/204/205。可互操作的目标今天就已存在，迁移规划无需再等待 NIST 算法选择；但协议规范、认证体系与产品支持仍需持续跟踪。

先收集、后解密

若今天的通信依赖经典公钥密钥交换，攻击者可先记录流量，待量子计算机能恢复会话密钥后再解密（AES-256 等对称密文不会被 Shor 直接攻破）。保密期长的数据已经处于风险之中。

迁移周期漫长

在 PKI、协议、硬件与嵌入式设备群中替换密码需要数年。密码敏捷性必须事先设计，而非事后加装。

合规要求陆续出台

对美国联邦与国家安全系统，NSM-10（美国国家安全备忘录第 10 号）与 CNSA 2.0 设定了明确的迁移期限；欧盟与英国也发布了分阶段的 PQC 迁移路线图。

按主题浏览

快速开始 →

PQC 是什么、威胁模型，以及迁移时间表。

标准规范 →

FIPS 203/204/205、SP 800-208/227 与全球标准地图。

国际与行业 →

IETF、ISO/IEC、ETSI、各国监管，以及电信 3GPP/GSMA。

算法家族 →

格、哈希、编码、多变量与同源类方案。

算法详解 →

ML-KEM、ML-DSA、SLH-DSA、Falcon 等深入解析。

迁移 →

密码敏捷性、混合模式、资产发现与实战手册。

协议集成 →

TLS 1.3、SSH、IPsec 与 X.509 证书集成。

实现与工程 →

liboqs、OpenSSL 提供者、侧信道与性能基准。

行业方案 →

金融、电力能源、Web3 落地方案。

行业落地 →

QKD/PQC、风险模型、构建框架、中国厂商案例。

参考 →

对比表、常见问题、术语表与外部资源。

已标准化与已入选标准化的算法

已发布 FIPS 标准——2024 年 8 月作为最终标准发布。

ML-KEM

FIPS 203——格密钥封装（原 CRYSTALS-Kyber）。

ML-DSA

FIPS 204——格签名（原 CRYSTALS-Dilithium）。

SLH-DSA

FIPS 205——无状态哈希签名（原 SPHINCS+）。

已入选 标准待发布（尚非最终 FIPS 标准）。

FN-DSA

Falcon——紧凑的格签名；FIPS 206 仍在制定中，尚未最终发布，具体草案与最终发布时间以 NIST 发布为准。

HQC

NIST 于 2025 年入选、ML-KEM 之外的额外编码类 KEM（提供算法多样性）；最终标准预计约 2027 年，FIPS 编号尚未正式公布。

保守参考候选——非 NIST FIPS 标准；后续状态以 ISO/IEC 或相关标准组织公开工作项为准。

经典 McEliece

保守的编码类 KEM，公钥较大；尚非最终 FIPS 标准。

迁移真实系统

标准只有进入你的协议与 PKI 才有价值——从数据所在之处开始。

TLS 1.3

混合 ECDHE + ML-KEM（如 X25519MLKEM768，仍为 IETF 草案）正在主流浏览器与服务端栈中部署；但证书与认证层仍多依赖 RSA/ECDSA，完整迁移尚未完成。

混合模式

经典 + PQC 组合，使任何一方单独失效都不致命。

资产发现与 CBOM

先盘点密码资产，才能替换它。

PKI 迁移

证书、证书链与 PQC 签名带来的尺寸影响。

第一次密钥交换

用 liboqs 在 Python 中以 ML-KEM-768 封装一个共享密钥：

import oqs

# 接收方（服务端）生成密钥对
with oqs.KeyEncapsulation("ML-KEM-768") as server:
    public_key = server.generate_keypair()

    # 发送方（客户端）用公钥封装共享密钥
    with oqs.KeyEncapsulation("ML-KEM-768") as client:
        ciphertext, secret_sender = client.encap_secret(public_key)

    # 接收方解封装，恢复出相同的密钥
    secret_recipient = server.decap_secret(ciphertext)

assert secret_sender == secret_recipient   # 共享密钥建立成功
print("共享密钥:", secret_sender.hex())

仅作教学示例。具体包名、算法标识与启用机制会随 liboqs / oqs-python 版本变化；生产系统需使用经过审计的库与真实的密钥管理设计。

说明
本站为教学性参考。各页摘要旨在帮助工程师与架构师建立全局认识；实现前请务必以每页所链接的 NIST、IETF、ISO 权威原文为准。用右上角的语言开关可切换到 English。

Recently updated近期更新

See the full changelog.查看完整更新日志。

⚑ Report an error⚑ 纠错与校正