What Is Post-Quantum Cryptography?

Post-quantum cryptography (PQC) is a new generation of public-key algorithms designed to resist attacks from both classical and quantum computers. Critically, PQC runs on the ordinary computers, servers, and phones we already use — it is software, not exotic quantum hardware.

A working definition

Post-quantum cryptography — sometimes called quantum-resistant or quantum-safe cryptography — refers to cryptographic algorithms whose hardness assumptions are believed to hold even against a large, fault-tolerant quantum computer. The threat is concrete: a sufficiently large, fault-tolerant quantum computer running Peter Shor's 1994 algorithm would break the math behind today's public-key crypto (RSA, finite-field Diffie-Hellman, and elliptic-curve schemes such as ECDH/ECDSA). PQC replaces those primitives with alternatives built on different mathematical problems — lattices, hash functions, error-correcting codes, and more — for which no efficient quantum attack is known.

PQC is classical software, not quantum technology

A common misconception is that defending against quantum computers requires quantum computers. It does not. PQC algorithms are conventional code: they execute on the same x86 and ARM processors that run your web servers and smartphones today. You deploy PQC the same way you deploy any cryptographic upgrade — through libraries, protocol updates, and certificate changes.

How PQC differs from quantum key distribution

Quantum key distribution (QKD) is a different thing entirely. QKD uses the physics of photons to establish a shared secret over a dedicated optical link, with security rooted in quantum mechanics rather than computational hardness. It requires special hardware, has severe distance limits, and cannot be deployed over the existing internet or stored data. PQC, by contrast, is a drop-in mathematical replacement that works everywhere classical crypto works today.

The two primitives PQC must replace

Public-key cryptography does two jobs, and PQC provides a quantum-safe answer for each.

1. Key establishment (KEMs)

Before two parties can talk securely, they must agree on a shared symmetric key. Today this is done with Diffie-Hellman or RSA key transport. The PQC equivalent is a key encapsulation mechanism (KEM): one side encapsulates a random secret to the other's public key, producing a ciphertext that only the holder of the private key can decapsulate. NIST's standardized KEM is ML-KEM (FIPS 203). See Key Encapsulation Mechanisms.

2. Digital signatures

Signatures prove authenticity and integrity — that a message, a software update, or a TLS certificate genuinely comes from its claimed source. RSA and ECDSA signatures are quantum-vulnerable, so they must be replaced by quantum-safe schemes such as ML-DSA (FIPS 204) and SLH-DSA (FIPS 205). See Digital Signatures.

Why symmetric cryptography is largely fine

Quantum computing does not break everything. Symmetric ciphers and hash functions face only Grover's algorithm, which provides a mere quadratic speedup — it effectively halves the security level rather than collapsing it. In common engineering estimates, increasing symmetric key length offsets the quadratic speedup from Grover; the actual security margin still depends on the algorithm, implementation, and resource estimates. AES-256 and SHA-384 remain secure against a quantum adversary; you generally do not need to replace them, only ensure you are using sufficiently large parameters. The crisis is confined to public-key cryptography, which is exactly what PQC targets. To understand the threat in detail, see The Quantum Threat.

The families of PQC

Because no single mathematical problem is universally trusted, NIST and the wider community pursue several independent algorithm families. Lattice-based schemes lead the standards (efficient and versatile), while hash-based signatures offer the most conservative security, and code-based KEMs provide a long-studied alternative. Diversity is deliberate: if one family is weakened, others stand ready.

Standards & references

• NIST Post-Quantum Cryptography project — the program that ran the PQC standardization competition.
• FIPS 203 (ML-KEM) — the standardized key encapsulation mechanism.
• FIPS 204 (ML-DSA) — the lattice-based digital signature standard.
• FIPS 205 (SLH-DSA) — the hash-based digital signature standard.
• ETSI Quantum-Safe Cryptography — standards and industry guidance on the quantum-safe transition.
• Resources — full standards register