Tech, ExplainedNetworking, infrastructure and security
Concept

Post-quantum cryptography

Locks built for computers that don't exist yet.

HOW IT WORKSToday's public-keymethods rest on mathsproblems that ordinarycomputers cannot solvein timeA large future quantumcomputer could solvethose problems quicklyAn attacker can recordencrypted data now, todecrypt it laterPost-quantum methodsuse different mathsproblems, hard forquantum computers tooSystems switchover, often runningthe old and newmethods togetherData recorded today may be decrypted tomorrow, so the switch to new methods has to start before thequantum computers exist.HOW IT WORKSToday'spublic-keymethods reston mathsproblems thatordinarycomputerscannot solvein timeA largefuturequantumcomputercould solvethoseproblemsquicklyAn attackercan recordencrypteddata now,to decryptit laterPost-quantummethods usedifferentmathsproblems,hard forquantumcomputers tooSystemsswitch over,often runningthe old andnew methodstogetherData recorded today may be decrypted tomorrow, so the switch to new methods has to start before thequantum computers exist.HOW IT WORKSToday's public-key methods rest on mathsproblems that ordinary computers cannotsolve in time↓A large future quantum computer couldsolve those problems quickly↓An attacker can record encrypted datanow, to decrypt it later↓Post-quantum methods use different mathsproblems, hard for quantum computers too↓Systems switch over, often running theold and new methods togetherData recorded today may be decrypted tomorrow, so theswitch to new methods has to start before the quantumcomputers exist.
Today's public-key methods rest on maths that a large quantum computer could solve, so systems move to new methods that rest on problems which are hard for quantum computers too.
opens a page inside this one a page in the same scene a page in another scene a concept page a label only, with no page

Post-quantum cryptography, also called quantum-safe cryptography, is a set of new encryption methods designed so that even a large future quantum computer cannot break them. A quantum computer uses quantum physics to solve certain kinds of problems far faster than an ordinary computer. Large enough quantum computers do not exist yet. But the methods that protect most of today's internet would be weak against them.

Here is how the problem arises. Websites, apps, VPNs and digital signatures use public-key cryptography. In it, each side has a public key that anyone may see and a private key that it keeps secret. Its safety rests on maths problems, such as finding the two prime numbers that were multiplied to make a very large number. An ordinary computer would take millions of years or more to solve them. A large quantum computer could solve them quickly, using a method published in 1994. Post-quantum methods rest on different maths problems, which are hard for quantum computers too. The ordinary scrambling of stored data, which uses one shared key, is less affected: a longer key is enough.

There is a reason to change now. An attacker can record encrypted data today and keep it until a quantum computer can decrypt it. This is called "harvest now, decrypt later". In 2024, NIST, the US standards institute, published the first standard post-quantum methods. One of them, ML-KEM, is used to agree keys. Two others, ML-DSA and SLH-DSA, are used for signatures. The switch-over is slow, because a company must first find every place where it uses cryptography. Encryption key management and certificate lifecycle management tools now help with this.

Take, for example, the padlock on a website. Many browsers now agree each connection's key using an old method and a post-quantum method together, so the connection stays safe if either one holds.

Consider a bank's records that must stay secret for twenty years. They need quantum-safe protection now, because data recorded today could be decrypted within that time.

Say a smart electricity meter is installed for fifteen years. The signatures that check its software updates must be replaceable while it is in use, or quantum-safe from the start.

How is post-quantum cryptography different from quantum key distribution? Quantum key distribution uses physics itself, with special equipment that sends single particles of light over fibre. Post-quantum cryptography is ordinary software that runs on today's computers and networks, so it can be added through updates. Both are different from public key infrastructure, which manages the certificates that these methods sign.

Appears in

Networking, infrastructure and security
Tech, Explained is a part of ingrid.fyi. Every page explains one piece of technology in plain words.