Cryptography, post-quantum, and why it matters.

Cryptography protects three things: confidentiality (only the intended party can read the data), integrity (the data hasn't been altered), and authenticity (you're really talking to who you think you are). Nearly every modern system relies on two very different families of algorithms working together.

Symmetric cryptography — one shared key

The same secret key both encrypts and decrypts. It is fast and used for the bulk of actual data encryption. The workhorse is AES (with key sizes 128 or 256 bits); message integrity comes from MACs such as HMAC, and hashing from the SHA-2 and SHA-3 families. The catch: both parties must already share the secret key.

Asymmetric (public-key) cryptography — a key pair

Each party has a public key (shared freely) and a private key (kept secret). This solves the "how do two strangers agree on a secret over an open network?" problem and enables digital signatures. It underpins:

• Key exchange / establishment — Diffie-Hellman (DH) and ECDH let two parties derive a shared symmetric key over a public channel.
• Digital signatures — RSA, ECDSA, and EdDSA prove authenticity and integrity (code signing, certificates, documents).
• Encryption of small secrets — e.g. RSA encrypting a symmetric session key.

Why it's secure today: hard math problems

Public-key security rests on math problems that are easy to compute one way but believed to be infeasible to reverse on classical computers:

Where cryptography lives in the enterprise

It is everywhere — often invisibly, inside products you don't control:

Because the same primitives (RSA, ECC, DH) are embedded in all of these, a single algorithm becoming breakable has enormous blast radius — which is exactly the post-quantum problem.

Post-Quantum Cryptography (PQC) — also called quantum-resistant or quantum-safe cryptography — is a new generation of algorithms designed to run on today's ordinary computers while resisting attacks from both classical and future quantum computers. It is not quantum key distribution (QKD), which needs special hardware; PQC is just new math you deploy in software.

Why quantum computers break today's public-key crypto

Two quantum algorithms matter, and they matter very differently:

The families of post-quantum math

PQC replaces "factoring is hard" with other problems believed hard even for quantum computers:

The NIST standards you'll actually deploy

In August 2024 NIST finalized the first three post-quantum standards, and selected a backup KEM in March 2025:

Also in the pipeline: HQC (a code-based backup KEM selected March 2025, standard expected ~2027) and FN-DSA / FIPS 206 (Falcon, a compact lattice signature, still in draft). Treat these as forthcoming, not yet deployable.

Practical realities of PQC

• It runs on today's hardware. No quantum computer or special hardware required to use PQC — it's software.
• Keys and signatures are bigger. ML-KEM/ML-DSA keys and messages are larger than ECC's. This can stress protocols, packet sizes, buffers, smartcards, and constrained devices — expect testing.
• Hybrid is the safe first step. "Hybrid" here means combining a classical algorithm (e.g. X25519) with a PQC one (e.g. ML-KEM-768) so you're protected even if one is later found weak. TLS is already deploying X25519MLKEM768.
• Crypto-agility is the real goal. Build systems so the algorithm can be swapped without re-engineering — because standards will keep evolving.

No cryptographically-relevant quantum computer exists yet. So why is every major government and cloud provider telling enterprises to start today? Three reasons.

1 · Harvest Now, Decrypt Later (HNDL)

An adversary doesn't need a quantum computer today to attack you today. They can capture and store your encrypted traffic now — VPN sessions, database backups, TLS flows — and simply wait. When a quantum computer arrives, they decrypt the archive retroactively. This means any data with a long confidentiality lifetime is already at risk right now: health records, financial and legal data, government secrets, intellectual property, biometrics, and long-lived keys.

2 · Q-Day is uncertain — and timelines are compressing

"Q-Day" is the hypothetical day a quantum computer can break RSA-2048. Estimates range widely, but the direction of travel is what matters: authorities and vendors report that credible timelines have been pulled forward from the classic "2035+" figure, and the consistent official message is plan now, don't wait. You cannot schedule a multi-year migration around a threat whose arrival date you don't control.

3 · Mosca's inequality — you may already be late

Cryptographer Michele Mosca framed the risk as a simple inequality. Let:

If X + Y > Z, you have a problem: some of your data will still need protecting after the point at which it can be broken. Because you control only Y — the migration — the only lever you have is to start early and shrink it.

The compliance clock is also running

Beyond the threat itself, mandates are turning PQC into a hard requirement — see the deadline timeline and the migration guide for detail. In brief:

Even organizations outside these mandates inherit them through the supply chain: customers, partners, and procurement gates increasingly push PQC requirements downstream.

Why the migration is slow — so start now

• Crypto is embedded everywhere, often invisibly inside third-party products, libraries, appliances, and certificates you don't fully control.
• Deep dependencies — PKI hierarchies, hardware roots of trust, and protocol negotiation all have to move together, and larger PQC keys break assumptions.
• Hardware limits — HSMs, smartcards, TPMs, and embedded/OT devices may need firmware updates or physical replacement; some legacy gear simply can't be upgraded.
• Decades of tech debt — hard-coded algorithms and unmanaged keys make this a multi-year program, not a patch.