Post-Quantum Cryptography is the field concerned with cryptographic algorithms and protocols designed to remain secure against attackers possessing large-scale quantum computers as well as conventional computers. Its primary focus is public-key cryptography because Shor's algorithm can efficiently solve the integer-factorisation and discrete-logarithm problems underlying widely deployed systems such as RSA and elliptic-curve cryptography. Post-quantum algorithms are intended to run on conventional computers and networks rather than requiring users to possess quantum hardware. This distinguishes post-quantum cryptography from quantum cryptography, which includes techniques such as quantum key distribution that rely on quantum physical systems. The objective is therefore cryptographic resilience against quantum-enabled computation within ordinary digital infrastructure.
The main families investigated for post-quantum cryptography include lattice-based, hash-based, code-based, multivariate and isogeny-based constructions, although the security status of individual families and algorithms varies. Lattice-based schemes derive security from difficult problems involving structured lattices and have become particularly prominent because they can support both key establishment and signatures. Hash-based signatures rely primarily on the security of cryptographic hash functions and provide strong conservative foundations, although some constructions have larger signatures or state-management requirements. Code-based systems rely on difficult decoding problems and have a long history of cryptographic research. Multivariate and isogeny approaches have experienced major cryptanalytic developments, demonstrating why post-quantum security cannot be inferred merely from belonging to a particular mathematical family.
Standardisation has been a central part of post-quantum cryptography because algorithms need rigorous public analysis, implementation guidance and interoperable specifications before widespread deployment. The US National Institute of Standards and Technology has conducted a multi-year public process to evaluate candidate algorithms and develop post-quantum standards. In 2024, NIST published its first principal post-quantum standards, including ML-KEM for key encapsulation and ML-DSA and SLH-DSA for digital signatures. These standards are based on lattice and hash techniques. The existence of a standard does not mean every organisation can immediately replace all classical cryptography because real systems contain certificates, protocols, hardware, embedded software, long-lived archives and dependencies that require coordinated migration.
Post-quantum migration is complicated by “harvest now, decrypt later” threats. An attacker can potentially collect encrypted traffic today and retain it for future decryption if the underlying public-key mechanism eventually becomes breakable by a sufficiently capable quantum computer. This is particularly relevant for information requiring confidentiality over many years, such as government records, intellectual property, strategic research and certain personal data. The threat does not require a quantum computer to exist at the moment the information is collected. Organisations therefore need to consider both the estimated arrival of relevant quantum capabilities and the confidentiality lifetime of their data. This creates a migration problem where long-lived information may require protection before a cryptographically relevant quantum computer is available.
Symmetric cryptography is affected differently by quantum computing. Grover's algorithm provides a quadratic speed-up for generic brute-force search, meaning the effective security of an ideal n-bit symmetric key can be viewed as roughly halved under that particular generic quantum attack model. Increasing key sizes can therefore provide substantial additional margin. Hash functions similarly require security analysis against quantum search and collision-related algorithms, but they are not threatened in the same direct way as RSA and elliptic-curve public-key systems by Shor's algorithm. Consequently, post-quantum migration does not mean abandoning all existing cryptography. It involves identifying which primitives are quantum-vulnerable, selecting suitable replacements and adjusting security parameters where appropriate.
Hybrid cryptographic approaches can combine classical and post-quantum mechanisms during migration. A hybrid key-establishment protocol can require both a classical shared secret and a post-quantum shared secret, combining them through a secure key derivation process so that an attacker generally needs to defeat both components to recover the final session key, assuming the hybrid construction is correctly designed. Hybrid deployment can reduce transition risk because a new post-quantum algorithm may have less operational history than established classical algorithms, while classical systems remain useful for interoperability. However, hybridisation adds complexity, increases message sizes and requires careful protocol design; combining algorithms without a defined security construction does not automatically produce stronger security.
Post-quantum algorithms can introduce practical trade-offs. Compared with conventional elliptic-curve cryptography, some post-quantum schemes have larger public keys, ciphertexts or signatures and may require different computational resources. These differences affect bandwidth, certificate sizes, embedded systems, mobile devices, high-volume authentication and constrained networks. Implementations also require attention to side-channel resistance, constant-time techniques where applicable, secure randomness and fault handling. Algorithm performance cannot be assessed solely by counting mathematical operations because network overhead and memory consumption may dominate in real deployments. Migration planning therefore needs both cryptographic analysis and systems engineering.
Post-quantum cryptography represents an ongoing transition rather than a single replacement algorithm. Organisations need to identify where RSA, Diffie-Hellman, elliptic curves and related primitives occur, including certificates, VPNs, TLS, SSH, software-signing systems, identity infrastructure, devices and proprietary protocols. Cryptographic inventories and algorithm-agility mechanisms can make future migration easier. Long-lived systems should avoid hard-coding cryptographic assumptions that prevent replacement. Post-quantum security also depends on implementation quality, standard maturity and continued cryptanalysis, so algorithm selection should follow established standards and authoritative guidance rather than speculative claims about a particular construction.
