What Is Post-Quantum Cryptography — and Why Does It Matter Now?

Post-quantum cryptography is a new generation of encryption and digital-signature methods, built to stay secure even against an attack from a future quantum computer. It isn’t quantum hardware itself — it’s ordinary software running on today’s computers, based on math problems that are hard for both classical and quantum computers to solve. The goal is to replace the cryptography that currently protects nearly everything sent over the internet, from bank transfers to private messages, before a quantum computer capable of breaking it actually exists.

What “post-quantum” means

Nearly all of today’s internet security — HTTPS, VPNs, secure messaging, software updates — relies on a small number of math problems that are extremely hard for ordinary computers to solve: factoring very large numbers (the basis of RSA) or finding a specific point on an elliptic curve (ECC). No classical computer can do this fast enough to matter. A sufficiently powerful quantum computer, though, could — and “post-quantum” algorithms are designed to keep working even after one exists.

How quantum computers threaten today’s encryption

In 1994, mathematician Peter Shor showed that a large-scale quantum computer could factor huge numbers and solve the related discrete-logarithm problem in a fraction of the time any classical computer would need. Shor’s algorithm would, in principle, break RSA and elliptic-curve cryptography outright. No quantum computer today is powerful or stable enough to run it against real-world key sizes — but the timing problem is real: data encrypted today can be captured and stored, then decrypted later once such a machine exists. Security researchers call this “harvest now, decrypt later,” and it’s already a live risk for anything that needs to stay secret for years, such as medical records or state secrets.

How post-quantum algorithms defend against it

Instead of factoring or elliptic curves, most post-quantum schemes lean on different hard problems — most commonly lattice-based cryptography, which bases its security on finding specific points inside a high-dimensional geometric grid, a problem quantum computers aren’t currently known to solve efficiently. In August 2024, the U.S. National Institute of Standards and Technology (NIST) finalized its first three post-quantum standards after an eight-year public review of 82 candidate algorithms: ML-KEM for encrypting data in transit, ML-DSA for digital signatures, and a hash-based backup signature scheme, SLH-DSA. Other lattice-based candidates, including a compact signature scheme called HAWK, are still working through NIST’s review process as the agency builds out a fuller set of options. Major browsers, cloud providers, and messaging apps have already begun deploying these algorithms, usually layered on top of classical encryption during the transition.

Why it matters now

Replacing the cryptography underneath a global internet — in browsers, servers, certificates, and embedded devices — takes years, which is why NIST has urged organizations to start integrating the new standards immediately rather than waiting. Governments are setting hard deadlines: the U.S. National Security Agency has set 2030 as its target for national-security systems to finish migrating. For most people, the change will be invisible, arriving through routine software updates. But it’s one of the largest coordinated overhauls in the history of computer security — driven by a threat that remains hypothetical today but is judged too consequential to leave until it isn’t.

In the news

The stakes of getting these algorithms right were on display when Anthropic’s Claude Mythos model discovered a mathematical weakness in HAWK, the lattice-based signature scheme still under NIST review — see our report on the discovery. The flaw doesn’t break HAWK outright, but it roughly halves its effective key strength — exactly the kind of issue NIST’s public review process exists to catch before a scheme becomes a standard. It’s one example of a broader pattern of AI systems being turned on cybersecurity problems themselves; see our explainer on how AI is changing cybersecurity for both defenders and attackers.