What is post-quantum cryptography?
Post-quantum cryptography (PQC), also called quantum-resistant or quantum-safe cryptography, is a family of public-key algorithms designed to stay secure against an attacker who has a large, error-corrected quantum computer. The algorithms themselves run on ordinary computers and networks today. Their job is to replace RSA, Diffie-Hellman and elliptic curve cryptography, which protect nearly every key exchange and digital signature in use, before quantum computers become able to break them.
Why quantum computers threaten today's public-key algorithms
In 1994 Peter Shor published a quantum algorithm that factors large numbers and computes discrete logarithms efficiently. Those are exactly the problems RSA, Diffie-Hellman and ECC depend on, so a big enough quantum computer running Shor's algorithm could derive private keys from public ones, whatever their length. Symmetric cryptography is in much better shape. Grover's algorithm speeds up key search only quadratically, which roughly halves effective strength, so AES-256 keeps a comfortable margin and SHA-256 and SHA-384 remain usable.
No publicly known quantum computer can break real RSA or ECC keys today, and forecasts of when one might arrive vary widely. The urgency comes from data that has to stay secret for a long time.
Harvest now, decrypt later
An adversary can record encrypted traffic now, store it, and decrypt it years later once a capable quantum computer exists. Forward secrecy doesn't help, because the attacker would break the recorded Diffie-Hellman exchange itself. Anything that must stay confidential for ten or twenty years, such as health records, government secrets, trade secrets and long-term financial data, is already exposed if its key exchange is quantum-vulnerable. That is why migration starts with key establishment. Signatures are less urgent for most uses, since forging one needs the quantum computer to exist at the moment of forgery, although long-lived anchors such as firmware signing keys and root CA keys need early planning.
The NIST post-quantum standards
After a public competition that opened in 2016, NIST published its first three post-quantum standards in August 2024:
| Standard | Algorithm | Job | Developed from |
|---|---|---|---|
| FIPS 203 | ML-KEM | Key encapsulation, to establish a shared key | CRYSTALS-Kyber |
| FIPS 204 | ML-DSA | Digital signatures | CRYSTALS-Dilithium |
| FIPS 205 | SLH-DSA | Digital signatures, hash-based | SPHINCS+ |
ML-KEM and ML-DSA rest on hard problems involving mathematical lattices. SLH-DSA depends only on the security of hash functions, which makes it a conservative fallback with larger, slower signatures. In March 2025 NIST also selected HQC, a key encapsulation method built on error-correcting codes, as a backup to ML-KEM, so key establishment doesn't rest on a single mathematical approach.
What migration involves
The new algorithms have bigger keys and outputs. An X25519 public key is 32 bytes, while an ML-KEM-768 public key is 1,184 bytes and its ciphertext 1,088 bytes. An ML-DSA-65 signature is 3,309 bytes, compared with 64 bytes for ECDSA on P-256. Protocols, certificates and small devices all have to absorb that growth.
To avoid betting everything on newer mathematics, early deployments use hybrid key exchange, combining a classical algorithm with a post-quantum one so an attacker has to break both. Current Chrome and Firefox releases offer a TLS 1.3 group named X25519MLKEM768, and recent OpenSSH releases use a similar hybrid by default. Organizations preparing to migrate start with an inventory of where RSA and ECC are used, in certificates, VPNs, code signing, hardware tokens and vendor products, and aim for crypto agility: systems where an algorithm can be swapped through configuration instead of a rewrite. U.S. federal policy sets 2035 as the target for moving systems off quantum-vulnerable algorithms.
Post-quantum cryptography vs. quantum cryptography
The names are easy to mix up. Post-quantum cryptography is ordinary software and mathematics designed to resist quantum attackers. Quantum key distribution (QKD) uses quantum physics, sending photons over dedicated fiber or free-space links, to share a key in a way that reveals eavesdropping. QKD needs special hardware, doesn't authenticate the parties by itself and is not what NIST standardized. Quantum-resistant algorithms running on existing systems are post-quantum cryptography.
Post-quantum cryptography on the CompTIA Security+ exam
Post-quantum cryptography is taught with asymmetric encryption and key exchange under SY0-801 objective 1.3, the cryptographic solutions objective, where the quantum threat explains why long-lived secrets favor AES-256 and why key exchange is changing. Wording such as "adversaries are recording encrypted traffic to decrypt it in the future" or "protect data against future quantum computers" points to post-quantum or hybrid key exchange. Distractors include longer RSA keys, which don't survive Shor's algorithm, perfect forward secrecy, which doesn't stop a recorded exchange from being broken later, and quantum key distribution.