In 1994 the mathematician Peter Shor proved something uncomfortable: if we ever build a large enough quantum computer, the asymmetric encryption algorithms that protect the Internet today —RSA, ECDSA, DH— collapse like a house of cards. Three decades later that computer does not exist yet, but cryptographers are no longer waiting: since 2024 post-quantum cryptography (PQC) has begun to roll out in browsers, email and operating systems.
This is not futurism. It is a train already in motion, and it is worth understanding how it was built before the station arrives.
Why a quantum computer breaks RSA
RSA, the asymmetric cipher that for decades signed TLS certificates, rests on a single fact: factoring a 2048-bit number into its two primes is so expensive that it is unfeasible. The best known classical algorithm, the general number field sieve (GNFS), needs subexponential time: doubling the key size makes the attack brutally more expensive.
A quantum computer with enough qubits breaks that balance with Shor’s algorithm, which factors in polynomial time regardless of key size. And here is the trap of time: an attacker can steal your encrypted traffic today, store it, and decrypt it in ten years when a capable quantum machine exists. This is the so-called harvest now, decrypt later attack, and it is why the migration cannot wait until the quantum computer is real.
Changing the mathematical substrate: from factoring to lattices
The answer was not to enlarge the keys of classical one-way functions, but to switch mathematical problems. The winning family is built on lattices: structures of points spread across a high-dimensional space over which the LWE problem (learning with errors) is defined — recovering a secret vector from equations polluted by small random errors. Solving it has proven hard in both the classical and the quantum model.
On that basis the NIST selected its first two final standards in 2024. For key exchange, ML-KEM (formerly Kyber), a key encapsulation mechanism that produces a shared secret by encrypting with the public key. For digital signatures, ML-DSA (formerly Dilithium), lighter on memory and without exposing the secret that signed, plus the hash-based SLH-DSA (formerly SPHINCS+) as a conservative backup.
The qubits that would solve the problem
To grasp the real risk you need magnitudes. Breaking RSA-2048 with Shor would require on the order of 20 million physical qubits (about 4,000 logical ones) of gate quality, and the best current processors, such as IBM’s or Google’s quantum line, hover around a few hundred qubits with still-high error rates. The key is quantum error correction: each logical qubit needs thousands of physical ones because superposition unravels under any noise. That places the threat on a realistic 10-to-20-year horizon, but not in fantasy.
It is already rolling out without you noticing
The good news is that the migration has already begun. The TLS 1.3 standard has supported the hybrid X25519 + ML-KEM exchange in major browsers since practice, and in 2024 it was enabled transparently for millions of users: traffic is encrypted with both a classical and a post-quantum exchange at once, so breaking the first still fails if the second stays intact. Email (OpenPGP), messaging (Signal), SSH and systems like Windows already offer hybrid modes.
That security is not free: PQC algorithms have larger public keys and signatures (for example, ML-DSA signatures exceed 2 KB versus the 64 bytes of ECDSA), which grows TLS handshake size and forces protocol optimization with things like ECH or message bundling. These are engineering details, but they explain why the rollout is not a simple binary swap.
What comes next
Post-quantum hardening is not a single global switch; it is a slow, layered transition with hybrid periods to guarantee backward compatibility. Meanwhile the race continues: every advance in quantum error correction moves the clock forward, and cryptography keeps hunting for problems that even the future quantum computer cannot bend.
The next time your browser negotiates a connection with ML-KEM, you may wonder about the computer that does not exist yet but already shapes the encryption you use today. That is probably the most honest definition of security: fitting the lock before the pick arrives.
