Quick answer: Post-quantum cryptography (PQC) uses encryption based on problems that remain hard even for a powerful quantum computer, instead of problems such a machine could solve. Today's public key algorithms like RSA, ECC and Diffie Hellman become breakable once large scale quantum computers exist. In 2024 NIST published its first PQC standards (FIPS 203, FIPS 204, FIPS 205). Organizations should build a cryptographic inventory now to counter the "harvest now, decrypt later" threat and begin a phased migration.

Why the quantum threat matters today

It is uncertain when quantum computers will reach the scale needed to break today's encryption. Even so, the risk starts now because of the "harvest now, decrypt later" scenario. An attacker records encrypted traffic today, stores it, and decrypts it retroactively once enough quantum power exists.

For organizations that protect data with long lived confidentiality, calling the threat purely theoretical is a mistake. Health records, state secrets, long term contracts, intellectual property and identity data stay valuable a decade later. Data considered safe today because it is encrypted still carries a future decryption risk.

What breaks and what stays safe?

The quantum threat does not affect all cryptography equally. Peter Shor's algorithm targets public key (asymmetric) algorithms. Grover's algorithm only weakens symmetric encryption and hash functions, it does not fully break them.

Algorithm type Example Quantum risk Recommended approach
Asymmetric key exchange RSA, ECDH, Diffie Hellman High, broken by Shor Replace with PQC (ML-KEM)
Asymmetric signature RSA signature, ECDSA High, broken by Shor Move to PQC signatures (ML-DSA, SLH-DSA)
Symmetric encryption AES-128 Medium, Grover effect Increase key size (AES-256)
Symmetric encryption AES-256 Low Considered adequate for now
Hash function SHA-256, SHA-3 Low Safe at adequate length

The practical conclusion is that in the symmetric world, larger key sizes are largely enough. The urgent problem is the public key layer, because TLS, VPN, digital signatures and key exchange all depend on it.

NIST PQC standards: FIPS 203, 204 and 205

After a multi year evaluation, NIST finalized its first quantum resistant standards in 2024. They provide a common reference for vendors and organizations.

Standard Algorithm Based on Use
FIPS 203 ML-KEM CRYSTALS-Kyber Key encapsulation, key exchange
FIPS 204 ML-DSA CRYSTALS-Dilithium Digital signatures (general purpose)
FIPS 205 SLH-DSA SPHINCS+ Hash based backup signatures

ML-KEM is a lattice based key encapsulation method designed to protect key exchange in protocols such as TLS. ML-DSA is the primary choice for general purpose signatures. SLH-DSA relies on a different mathematical basis (hash functions), so it provides a backup should a weakness later appear in lattice based methods. NIST also continues work on additional signature standards such as FN-DSA (FALCON).

Enterprise migration roadmap

A quantum resistant migration is not finished by installing one product. It is a phased, inventory driven process.

  1. Build a cryptographic inventory. Answer which system, protocol and application uses which algorithm. List everywhere RSA and ECC appear. Hidden dependencies (libraries, certificates, embedded devices) are usually the hardest part.
  2. Establish crypto-agility. Instead of hard coding an algorithm, make it replaceable. A future update then becomes a configuration change rather than a rewrite.
  3. Prioritize by data lifetime. Data that must stay confidential for a long time comes first. Short lived session data is less urgent.
  4. Prefer hybrid mode. During the transition, hybrid key exchange combining classical and PQC algorithms protects you even if one method turns out to be weak.
  5. Question your vendors. Ask your cloud provider, VPN vendor and hardware supplier for their PQC roadmap.

When should you act?

The right time is to start today with an inventory. The standards are ready and product support is growing quickly. If you hold data that needs long lived confidentiality, the "harvest now, decrypt later" threat makes delay costly. At the same time this is not a panic, it is a planned modernization. A rushed, untested crypto change can itself become a source of risk.

The KAOS and DSET approach

DSET helps organizations build their cryptographic inventory and prioritize a quantum resistant migration plan by risk. Our KAOS security engine detects and reports weak or outdated cryptography (such as hard coded keys or obsolete TLS configurations) during source code and infrastructure scans. Our goal is an evidence based migration plan, not a marketing promise. See our articles on source code security review and leaked API keys and secrets management.

Related reading: encryption and cryptography fundamentals, password, 2FA and passkey security, VPN security and ZTNA, AI risk management and NIST frameworks.

Frequently asked questions

When will a quantum computer break RSA? No exact date is known and estimates vary widely. However, because the "harvest now, decrypt later" attack targets decrypting today's captured data in the future, the risk starts now for long lived confidential data. That is why inventory and planning are recommended over waiting.

Is AES-256 safe against quantum? Symmetric encryption is far less affected by Grover's algorithm than asymmetric algorithms. Based on current knowledge, AES-256 provides an adequate security margin. The real weakness is in public key algorithms like RSA and ECC, so migration should prioritize those.

As a small company, where do I start with PQC migration? The first step is not buying a new product, it is building a cryptographic inventory. You cannot plan a migration without knowing which system uses which encryption. Crypto-agility and questioning vendor PQC roadmaps come next.

Sources

To build your cryptographic inventory and prioritize a quantum resistant migration plan by risk, you can talk to our team at Ankara Hacettepe Technopark. Contact DSET.