Post-Quantum Cryptography Explained: Quantum-Safe Algorithms for Beginners

Post-quantum cryptography (PQC) is encryption designed to resist attacks from quantum computers. Current public-key systems like RSA and ECC will be broken by quantum machines running Shor’s algorithm. NIST finalised the first PQC standards in August 2024, including ML-KEM and ML-DSA, giving organisations a clear, actionable migration path to quantum-safe security.

• Key Takeaway 1: RSA and ECC, which protect most of the internet right now, will become breakable once large-scale quantum computers arrive.
• Key Takeaway 2: NIST finalised its first PQC standards in August 2024, including ML-KEM (Kyber) and ML-DSA (Dilithium).
• Key Takeaway 3: The harvest-now-decrypt-later threat means adversaries are already collecting encrypted data today to decrypt it later with a quantum computer.
• Key Takeaway 4: You do not need a maths PhD to understand PQC. The core ideas map to problems you can picture intuitively.
• Key Takeaway 5: Migration to quantum-safe cryptography is not optional for regulated industries. It is a timeline question, not an if question.

Why Your Current Encryption Is Already at Risk

Most public-key cryptography today relies on two hard maths problems: factoring very large numbers (RSA) and computing discrete logarithms on elliptic curves (ECC). A classical computer would take millions of years to crack a 2048-bit RSA key. A quantum computer running Shor’s algorithm could do it in hours or minutes once hardware matures.

That is not science fiction. IBM’s quantum roadmap targets 100,000+ qubit systems by 2033, and Google claimed quantum supremacy on a specific task back in 2019. The cryptographically relevant threshold is different from supremacy benchmarks, but the direction of travel is clear. According to the Global Risk Institute’s 2023 Quantum Threat Timeline Report, there is a 50% probability of a cryptographically relevant quantum computer existing within 15 years.

The harvest-now-decrypt-later attack makes this urgent right now. Nation-state actors are intercepting and storing encrypted government communications, banking data, and sensitive IP today. Once a quantum computer is available, that stored data gets decrypted retroactively. India’s defence communications, Aadhaar-linked systems, and UPI transaction logs are exactly the kind of high-value targets this threat applies to.

Symmetric encryption like AES-256 is far less vulnerable. Grover’s algorithm, the quantum attack relevant to symmetric keys, only halves the effective key length, so AES-256 effectively becomes AES-128 strength. That is still acceptable. The real crisis is in public-key infrastructure, digital signatures, and key exchange protocols.

Post-Quantum Cryptography vs Traditional Cryptography

Traditional public-key cryptography is built on number theory: factoring, discrete logarithms, elliptic curves. These problems are hard for classical computers but collapse under quantum attack. Post-quantum cryptography swaps those foundations for problems that even quantum computers cannot solve quickly.

The most important of these new foundations is lattice-based cryptography. A lattice is a grid of points in very high-dimensional space. Finding the shortest vector in that grid, or solving the Learning With Errors (LWE) problem derived from lattices, is believed to be hard for both classical and quantum machines. That is the mathematical engine behind Kyber and Dilithium.

Other foundations include hash-based cryptography (used in SPHINCS+), code-based cryptography, and isogeny-based cryptography. Each trades different properties around key size, signature size, and computational speed. There is no single winner for every use case, which is why NIST standardised a portfolio rather than one algorithm.

How Key Sizes and Performance Compare

Algorithm	Type	Public Key Size	Security Basis	Quantum Safe?
RSA-2048	Key Exchange / Encryption	256 bytes	Integer Factorisation	No
ECC-256 (ECDSA)	Digital Signature	64 bytes	Elliptic Curve Discrete Log	No
ML-KEM-768 (Kyber)	Key Encapsulation	1,184 bytes	Module Learning With Errors	Yes
ML-DSA-65 (Dilithium)	Digital Signature	1,952 bytes	Module Lattice	Yes
SPHINCS+-128s	Digital Signature	32 bytes	Hash Functions	Yes

PQC keys are bigger. That is the honest trade-off. ML-KEM-768’s public key is about 4.6x larger than RSA-2048’s. For most modern systems, that is manageable. For constrained IoT devices or satellite links, it needs careful engineering.

The good news is that PQC algorithms are generally faster in software than RSA at equivalent security levels, because lattice operations involve simple arithmetic on smaller integers rather than modular exponentiation of huge numbers. Cloudflare’s 2022 experiments showed that hybrid TLS handshakes using Kyber added less than 1ms of latency in most cases.

The NIST PQC Standards: Kyber, Dilithium, and SPHINCS+ Explained

NIST ran its PQC standardisation competition for seven years, starting in 2016. In August 2024, it published three final standards under FIPS 203, 204, and 205. These are the algorithms organisations should be planning to adopt now.

ML-KEM (FIPS 203), Previously Known as Kyber

ML-KEM’s job is key encapsulation: it lets two parties securely agree on a shared secret over an untrusted channel. Think of it as the quantum-safe replacement for the Diffie-Hellman key exchange that underlies HTTPS today.

It comes in three variants: ML-KEM-512, ML-KEM-768, and ML-KEM-1024, offering increasing security levels. NIST recommends ML-KEM-768 for most general-purpose applications. Google began testing Kyber in Chrome’s TLS 1.3 connections in 2023, and the X25519Kyber768 hybrid was deployed to millions of users as part of that experiment.

ML-DSA (FIPS 204), Previously Known as Dilithium

ML-DSA’s job is digital signatures: it proves that a message or document genuinely came from a specific sender and has not been altered. This is what authenticates software updates, code signing certificates, email, and TLS certificates.

Dilithium was chosen as the primary signature scheme because it balances small key and signature sizes with fast signing and verification. Its security relies on the hardness of finding short vectors in module lattices. For India’s PKI infrastructure and Aadhaar authentication layers, ML-DSA is the most directly relevant standard to watch.

SPHINCS+ (FIPS 205)

SPHINCS+ is a hash-based digital signature scheme, meaning its security rests entirely on the security of cryptographic hash functions like SHA-256. It is a conservative backup option: if lattice-based cryptography ever gets broken, SPHINCS+ still stands.

The trade-off is signature size. SPHINCS+ signatures can be 8-50KB depending on the parameter set, compared to 3.3KB for ML-DSA-65. That makes it impractical for high-frequency signing but ideal for long-lived certificates or firmware signing where signature size matters less than long-term trust.

How to Migrate to Post-Quantum Cryptography: A Phased Timeline

Crypto-agility means designing your systems so you can swap cryptographic algorithms without rebuilding everything from scratch. It is the principle that every security architect should bake into systems right now, regardless of which PQC algorithm wins long-term. The 2021 SolarWinds attack showed how deeply embedded cryptographic dependencies can be in enterprise software. Organisations that build crypto-agility today will migrate to PQC in months. Those that do not will take years.

CERT-In, India’s national cybersecurity agency, has referenced the need for quantum-readiness in its advisories. The Reserve Bank of India’s IT risk framework discussions increasingly include post-quantum preparedness as a forward-looking concern for financial institutions. India’s National Quantum Mission, backed by Rs 6,003 crore approved in 2023, signals that government-level quantum capability is a national priority, making PQC readiness urgent for Indian enterprises handling sensitive data.

The US government’s CNSA 2.0 suite mandates PQC adoption across national security systems by 2030. For commercial organisations, the timeline is less rigid but the logic is the same. If your data has a secrecy requirement beyond 10 years, you are already in the harvest-now-decrypt-later window.

A phased approach works best: inventory your cryptographic assets first, identify where RSA and ECC are in use, then prioritise TLS and code signing for early migration. According to a 2023 Ponemon Institute survey, only 40% of organisations had begun any quantum readiness assessment. That gap is a genuine risk for CISOs to close.

If you want to build the skills to lead that migration, understanding which cybersecurity skills companies are actively hiring for right now is a smart starting point. PQC engineering and cryptographic assessment are appearing in job descriptions at financial services firms, cloud providers, and defence contractors.

Frequently Asked Questions

What is post-quantum cryptography?

Post-quantum cryptography refers to cryptographic algorithms designed to be secure against attacks from both classical and quantum computers. Unlike RSA or ECC, which quantum computers can break using Shor’s algorithm, PQC algorithms rely on mathematical problems, like lattice problems or hash functions, that are believed to resist quantum attacks. NIST published its first PQC standards in August 2024.

What is quantum-safe cryptography?

Quantum-safe cryptography is another term for post-quantum cryptography. It describes any encryption or authentication scheme that remains secure even when an attacker has access to a large-scale quantum computer. The terms are interchangeable in most industry and government documents, including NIST and ETSI publications. ML-KEM and ML-DSA are the leading quantum-safe standards today.

How is PQC different from traditional cryptography?

Traditional public-key cryptography relies on integer factorisation (RSA) or elliptic curve discrete logarithms (ECC), which quantum computers can solve efficiently using Shor’s algorithm. PQC replaces those with lattice problems, hash functions, or error-correcting codes that quantum computers cannot solve fast. The core job of encryption and signatures stays the same. The maths underneath changes completely.

What are Kyber and Dilithium?

Kyber (now standardised as ML-KEM under FIPS 203) is a key encapsulation mechanism used to establish shared secrets securely, replacing Diffie-Hellman in protocols like TLS. Dilithium (now ML-DSA under FIPS 204) is a digital signature scheme, replacing ECDSA for authenticating data and software. Both are lattice-based and were selected by NIST after a seven-year global competition.

When should organisations migrate to post-quantum cryptography standards?

Organisations handling data with long-term sensitivity should start now. The harvest-now-decrypt-later threat means adversaries are collecting encrypted data today. US government systems must adopt PQC by 2030 under CNSA 2.0. A practical first step is a cryptographic inventory: find every place RSA or ECC is deployed, then prioritise TLS handshakes and code-signing certificates for early replacement.

Post-quantum cryptography is not a distant academic concern. It is an active engineering problem with real standards, real deployment timelines, and real career opportunities attached to it. The organisations that understand it now will be the ones setting the security standards for the next decade.

If you are a student, IT professional, or career switcher looking to build practical, industry-ready skills in cryptography, ethical hacking, AI, or blockchain, explore 3.0 University’s online certification courses. The curriculum is built for people who want to work in the field, not just read about it.

Last updated: June 2025. Reviewed by the 3University editorial team.