Your bank, your email, your medical records: all of it travels encrypted today using algorithms that have worked for decades and, until recently, were considered unbreakable. The safety of that traffic does not depend on nobody intercepting it, but on the key being impossible to compute in a reasonable time. And that assumption has an expiry date: the day a quantum computer able to run Shor’s algorithm at the required scale exists. The awkward part is that this day does not have to be today. It is enough that somebody is storing copies right now.
A mathematical problem with an expiry date
RSA rests on the difficulty of factoring a huge number into its primes; Diffie-Hellman key exchange and elliptic-curve cryptography (ECDH, ECDSA) rest on the discrete logarithm problem over a curve defined on a finite field. The best known classical algorithms need a time that grows sub-exponentially, and at sensible key sizes the gap between what can be computed today and what would have to be computed is measured in billions of years.
Shor’s algorithm, published in 1994, changes the scale: it solves factoring and discrete logarithms in polynomial time. It is not a theoretical trick, it is a proven result; the obstacle is engineering, and it is enormous. The most cited estimate for breaking RSA-2048 speaks of about 20 million physical qubits running for eight hours, assuming large-scale error correction. Twenty million, against the few hundred or few thousand noisy qubits today’s machines handle.
Two clarifications are worth making. First, the effect on symmetric cryptography is far smaller: Grover’s algorithm halves the effective security, so AES-256 keeps an equivalent level of 128 bits, still comfortably enough. Second, the danger is not Shor alone: any serious advance against lattices or against error-correcting codes would force the plan to be revised, which is why the standards are designed with margin and with independent alternatives.
Store now, decrypt later
Here comes the truly urgent part. Long-term confidentiality does not break when the machine arrives, but when the traffic is recorded. Since storing bytes is ridiculously cheap and intercepting a communication is cheap too, there is an attack with its own name: harvest now, decrypt later. Today’s encrypted traffic is captured and kept until the capacity to decrypt it exists.
The key lies in the useful life of the secret, not of the data. A banking session that expires in minutes is not a concern; a medical record, an identity document, an industrial project or a diplomatic message that must remain secret in 2045, is. The forward secrecy of TLS 1.3 protects against a future leak of the server’s static keys, but not against the ephemeral key exchange itself becoming attackable within twenty years: if the whole handshake was stored, everything needed to derive the session key was stored too.
The replacements: lattices, hashes and codes
The new generation rests on problems for which no quantum shortcut is known. The most prominent is LWE (Learning With Errors): picture a system of linear equations with many variables, everything modulo a number q, where each equation carries a small added error. Without noise, solving it is school algebra; with noise, the problem becomes so hard that it works as a cryptographic base, and it is also proven to be at least as hard as certain worst-case lattice problems. The MLWE variant works over modules, that is, lattices with algebraic structure, which keeps keys and operations manageable.
In August 2024 NIST closed an eight-year process with three standards: FIPS 203 (ML-KEM, derived from Kyber) for key exchange and encryption; FIPS 204 (ML-DSA, derived from Dilithium) for digital signatures; and FIPS 205 (SLH-DSA, built on SPHINCS+) for signatures based only on hash functions, a deliberately conservative option in case lattices fall.
The price to pay is size. An X25519 public key takes 32 bytes; an ML-KEM-768 one takes 1184, and its ciphertext 1088. For signatures the jump is bigger: an ECDSA signature fits in 64 bytes, while an ML-DSA-65 runs to about 2420. That growth is the source of almost every practical problem in the migration.
How it is already deployed: hybrid key exchange
The strategy that has won out is not to replace but to add. The handshake runs the classical and the post-quantum algorithm at the same time, and the session key is derived from both pieces of material combined through HKDF. The property being sought is that the result stays secure as long as one of the two holds: if lattices break, X25519 remains; if a classical attack appears against the exchange, the lattices remain.
That is already happening in production: TLS 1.3 with the hybrid group X25519MLKEM768, named after the order of its components; OpenSSH with sntrup761x25519 since version 9.0; Signal’s PQXDH protocol; Apple’s PQ3 in iMessage; and recent versions of Chrome and of the main web services, which already negotiate this group by default. Measurable adoption by the big CDN operators is now above a third of TLS 1.3 connections.
The fine detail is in the network. A ClientHello carrying a public key of more than a kilobyte, plus the rest of the extensions, exceeds the typical size of a TCP segment (about 1500 bytes) and forces fragmentation or an extra round trip. That is why browsers predict which groups to offer ahead of time and servers keep many precomputed keys to answer without a HelloRetryRequest.
Signatures are the hard part
Key exchange is the easy side because it is ephemeral: it is enough for both ends to be new. Signatures are a different story, because they live for years inside certificates, trust chains, firmware images, secure boot and code signing, and many of them sit on devices that cannot be updated. Add to that the security modules (HSM, TPM) that must support the new algorithms, certificate chains that grow by tens of kilobytes, and hardware with tightly counted space, such as smart cards or industrial sensors.
Official timelines already point at real operation: the NSA, in its CNSA 2.0 suite, sets post-quantum signatures in software and firmware for 2025-2030, the transition of browsers and web services for 2030-2033, and exclusive use from 2033. NIST, in its transition guidance, marks the retirement of 112-bit RSA and elliptic curves for 2030 and their complete prohibition for 2035.
What to look at in your own system
The practical recipe is not to rush into changing everything, but to know what you have. Inventory where cryptography lives, what is known as a CBOM or cryptographic bill of materials; prioritise long-lived secrets; turn on hybrid key exchange wherever browser and server allow it; demand cryptographic agility from suppliers; and check the available room on channels where size is critical. The post-quantum transition will not be a switch: it is a change of coexistence in which both worlds must be supported for years. And the reason to start with transport encryption is not the quantum computer, but that the copying clock has already started ticking.
