Quantum computers have been a laboratory promise for decades, but cryptography is already preparing for them as if they were arriving tomorrow. That is not paranoia: in August 2024 the NIST (the US standards institute) published the first three official post-quantum algorithms —ML-KEM, ML-DSA and SLH-DSA— and since then browsers, mail servers and messaging apps have started adopting them. The question is no longer whether cryptography must change, but how to carry out that transition without breaking the internet along the way.
The problem: an algorithm that brings down RSA
Current asymmetric cryptography rests on the difficulty of two mathematical problems: factoring large numbers (the basis of RSA) and computing discrete logarithms over elliptic curves (the basis of ECDH and ECDSA, used in TLS, SSH and almost everything else). In 1994, mathematician Peter Shor proved that a quantum computer with enough qubits could solve both problems in polynomial time: what would take a classical machine billions of years would take a quantum one hours.
Not everything falls: symmetric algorithms such as AES survive better. Grover’s algorithm, which speeds up searches over large spaces, cuts the effective security of AES in half; AES-256 would be left with around 128 bits, which is still sufficient. The real problem lies in public-key cryptography, the part that enables secure key exchange and digital signatures.
The answer: the hardness of lattices
The three NIST standards share a mathematical family: lattices, geometric structures of points arranged periodically in a high-dimensional space. Security relies on the LWE problem (Learning With Errors): given a system of linear equations to which small random errors have been added, recovering the solution is computationally intractable. It is believed —though not yet proven— that no efficient quantum algorithm exists for it, and that is precisely the bet of post-quantum cryptography.
ML-KEM (standard FIPS 203, evolved from the Kyber algorithm) is a Key Encapsulation Mechanism (KEM): it lets two parties agree on a shared secret key without a spy being able to deduce it, playing the same role as Diffie-Hellman key exchange in TLS. Its operations are only matrix and vector multiplications, which makes it fast even on modest hardware.
ML-DSA (FIPS 204, formerly Dilithium) covers digital signatures, and SLH-DSA (FIPS 205, formerly SPHINCS+) is the conservative option: its security does not rely on lattices but only on the strength of hash functions such as SHA-256, a much better-studied foundation. The price is size: while an RSA-2048 signature takes 256 bytes, an SLH-DSA signature can exceed 17 KB, and an ML-DSA one is around 2.4 KB.
The hidden cost: fatter keys and certificates
Migrating is not just swapping one algorithm for another: it changes the economics of connections. An RSA-2048 public key takes 256 bytes; an ML-KEM-768 one takes about 1,184 bytes, and the associated ciphertexts also grow. In a TLS handshake, bigger certificates and keys mean more bytes to transmit in the first round trip, which is noticeable on connections with fragmented packets or slow networks. That is why early deployments use hybrid encryption: they combine a classical algorithm (X25519) with a post-quantum one (ML-KEM-768) in the same handshake, so the connection is only vulnerable if both are broken at once.
That hybrid approach is already in production: Chrome enabled X25519Kyber768 in TLS since mid-2023, Signal uses the PQXDH protocol, Apple’s iMessage includes PQ3, and the major CDNs and cloud services negotiate these algorithms transparently when both ends support them.
The timeline and what remains
The United States set the roadmap with the CNSA 2.0 directive: from 2030, software and firmware signatures must be post-quantum, and by 2033 so will all national security systems. The EU follows a similar schedule. The difficulty is not in browsers, which update themselves, but in the long tail: root certificates of PKI infrastructures, boot signatures of millions of devices, protocols with embedded hardware that has no room for larger keys, or data encrypted today that must remain secret twenty years from now.
That last point explains the rush: the “harvest now, decrypt later” attack consists of storing encrypted traffic today with the expectation of decrypting it once useful quantum computers exist. Any sensitive data with a long shelf life —medical records, industrial secrets, diplomatic communications— potentially falls into that category. Post-quantum cryptography is not a cosmetic upgrade: it is the insurance that what you encrypt today stays confidential when the next generation of computing arrives.
