For years we have heard that quantum computers will "break cryptography". The statement is only partly true and, above all, it does not affect all cryptography in the same way. What is certain is that the international community has already defined new algorithms, called post-quantum, and that their adoption has begun. Let us look at why, and what it means in practice.
What a quantum computer really threatens
A quantum computer is not simply a faster computer. For certain specific problems, by exploiting phenomena of quantum mechanics, it can run algorithms that have no efficient equivalent on classical computers.
Two algorithms matter for cryptography.
- Shor's algorithm (1994) efficiently solves factorisation and the discrete logarithm. These are exactly the problems on which RSA, Diffie-Hellman and elliptic curve cryptography rely. A sufficiently large and reliable quantum computer would make them insecure.
- Grover's algorithm (1996) speeds up exhaustive search, but to a much more limited extent: in practice it halves the effective security of a symmetric key. That is why AES-256 remains adequate, and hash functions with long outputs, such as SHA-256 and SHA-384, keep a good margin.
In short: what is mainly at risk is public-key cryptography, meaning key exchange and digital signatures. Symmetric encryption at most needs longer keys.
If they do not exist yet, why worry now?
Today there is no quantum computer capable of breaking RSA or elliptic curves at the sizes used in practice, and nobody knows for sure when there will be one. There are, however, two good reasons to act early.
Harvest now, decrypt later
An adversary can record encrypted communications today and store them, waiting until they can be decrypted in the future. For information that must remain confidential for many years, such as health data, trade secrets or diplomatic communications, the risk is already real.
Migrations take years
Replacing a cryptographic algorithm across all of an organisation's systems, devices, protocols and certificates is a long job. Experience with retiring SHA-1 or old versions of TLS shows that it takes years. Starting late would mean arriving unprepared.
The new standards
In 2016 the US standards body NIST launched a public process, similar to the one that led to AES, to select algorithms resistant to quantum computers. Researchers from around the world proposed and attacked dozens of candidates. In August 2024 the first three standards were published:
| Standard | Name | Function | Mathematical basis |
|---|---|---|---|
| FIPS 203 | ML-KEM (derived from Kyber) | Key exchange | Lattices |
| FIPS 204 | ML-DSA (derived from Dilithium) | Digital signature | Lattices |
| FIPS 205 | SLH-DSA (derived from SPHINCS+) | Digital signature | Hash functions |
Lattice-based algorithms offer good performance, but keys and signatures larger than elliptic curve ones. SLH-DSA relies only on the security of hash functions: it is considered very conservative, but produces considerably bulkier signatures.
The process also showed how important caution is: some promising candidates were broken during the selection by attacks run on ordinary classical computers. A new algorithm needs years of analysis before it deserves trust.
The transition strategy: the hybrid approach
Precisely because post-quantum algorithms are young, many systems adopt a hybrid scheme: the key exchange combines a proven classical algorithm, such as X25519, with a post-quantum one, such as ML-KEM. The final key is derived from both, so an attacker would have to break both to defeat it.
This approach is already in use. The main browsers and several large web services support hybrid key exchanges in TLS, and some encrypted messaging apps have updated their protocols to include a post-quantum component.
How to prepare
For a company or professional running IT systems, the concrete steps are these:
- cryptographic inventory: know where RSA, Diffie-Hellman and elliptic curves are used, in protocols, certificates, VPNs, software signatures and devices;
- priority for long-lived data: protect first the data that must stay confidential for many years;
- crypto agility: design systems so that changing algorithm is a configuration change rather than a rewrite;
- updates: keep operating systems, browsers and libraries up to date, as they are introducing support for the new algorithms;
- long symmetric keys: prefer AES-256 where possible.
In short
- Quantum computers mainly threaten RSA, Diffie-Hellman and elliptic curves, because of Shor's algorithm.
- Symmetric encryption holds up with long keys: AES-256 remains adequate.
- The ML-KEM, ML-DSA and SLH-DSA standards were published in 2024.
- The "harvest now, decrypt later" risk makes the transition urgent for long-lived data.
- The most prudent path is the hybrid approach, together with an inventory and crypto agility.
