The Encryption That Will Survive Quantum Computers

The numbers that protect your encrypted messages today are, in a meaningful sense, not very large. A standard RSA-2048 public key is a 617-digit integer. Factoring it into its two primes would take a classical computer roughly 300 trillion years using the best known algorithms. A sufficiently large quantum computer running Shor's algorithm could crack the same key in a matter of hours, maybe faster. That single fact has set off the largest cryptographic migration in the history of computing, one that must be mostly complete before the first fault-tolerant quantum machine reaches a few thousand logical qubits.

The threat is not speculative in the way that fusion power or flying cars remain speculative. Researchers at Google, IBM, and a dozen university labs have been steadily driving down the error rates in superconducting qubit systems. The timeline estimates vary, but the consensus among cryptographers has shifted from "sometime in the distant future" to "possibly within a decade." That shift matters because replacing the cryptographic foundations of the internet is measured in years, not weeks. If a capable quantum computer arrives before the migration finishes, every encrypted communication recorded today could be retroactively decrypted.

Why Quantum Computers Break the Math We Rely On

The reason RSA and Elliptic Curve Cryptography (ECC) are vulnerable is not complicated, though it requires sitting with one uncomfortable idea for a moment. Classical computers factor large numbers by trying divisors sequentially, a method that scales exponentially with the size of the number. Quantum computers, using a phenomenon called superposition, can evaluate many possible factorizations simultaneously. Peter Shor proved in 1994 that a quantum computer could factor an integer in polynomial time, meaning the problem goes from effectively impossible to entirely tractable as the computer scales up.

The same logic applies to the discrete logarithm problem that undergirds ECC, which secures everything from TLS connections to Bitcoin wallets. These two mathematical problems, factoring and discrete logarithms, are the load-bearing walls of modern public-key cryptography. Knock them down, and the entire structure collapses.

What does not collapse is symmetric cryptography, the kind used for AES encryption and hashing functions like SHA-256. Grover's algorithm can speed up brute-force searches against symmetric keys, but only quadratically. Doubling the key length from 128 bits to 256 bits neutralizes that threat neatly. The hard problem is asymmetric cryptography: the key exchange and digital signature schemes that establish trust between two parties who have never met.

The Long Road to Standardized Replacements

The National Institute of Standards and Technology (NIST) began a public competition in 2016 to select post-quantum cryptographic algorithms, following the same rigorous process it used to select AES in the late 1990s. Seventy-one candidates entered round one. After years of cryptanalysis, performance benchmarking, and elimination rounds, NIST announced its first finalized standards in 2024.

The selected algorithms come from three families of hard mathematical problems that are believed to resist quantum attacks. The first is lattice-based cryptography, which relies on the difficulty of finding short vectors in high-dimensional lattices. The second is hash-based signatures, which use the one-way nature of hash functions as their security foundation. The third is code-based cryptography, which leans on the hardness of decoding random linear codes, a problem that has resisted efficient algorithms for decades.

NIST standardized three primary algorithms in its first batch. The first is ML-KEM, formerly known as CRYSTALS-Kyber, a key encapsulation mechanism designed for general encryption and key exchange. The second is ML-DSA, formerly CRYSTALS-Dilithium, a digital signature scheme. The third is SLH-DSA, formerly SPHINCS+, a stateless hash-based signature scheme that offers different security trade-offs from ML-DSA.

Each of these algorithms replaces a specific function currently handled by RSA or ECC. ML-KEM fills the role of ECDH for key exchange. ML-DSA and SLH-DSA replace ECDSA and RSA for digital signatures. The important detail is that these are not drop-in replacements. The key sizes are larger, the computation is heavier, and the protocol integration requires careful engineering. An ML-KEM public key is roughly 1,200 bytes, compared to 32 bytes for an equivalent ECC key. That matters when every byte counts in a TLS handshake.

The Hard Work of Replacing the Internet's Plumbing

Standardizing algorithms is the easy part. Deploying them across the global internet is where the real difficulty lives. The TLS protocol that secures HTTPS connections must be updated to negotiate post-quantum key exchanges. Certificate authorities must issue new certificates using post-quantum signatures. Browsers, operating systems, VPNs, email clients, SSH implementations, and every piece of hardware that terminates an encrypted connection must be patched.

Google took an early step in 2023 when Chrome began experimenting with X25519Kyber768, a hybrid key exchange that combines a traditional ECC curve with ML-KEM. The "hybrid" approach is critical for the transition period because it ensures that security is at least as strong as the weaker of the two schemes. If someone later breaks ML-KEM but not ECC, or vice versa, the connection remains secure. Cloudflare followed with support on its edge network, allowing millions of existing connections to begin testing post-quantum key exchange without changing the security model.

The hybrid strategy reveals something important about how cryptographers think about risk. Nobody is certain that the new lattice-based algorithms are invulnerable. Cryptanalysis of ML-KEM is still an active area of research, and new attacks on lattice problems appear regularly, even if none have broken the chosen parameter sets. The hybrid approach buys time and confidence simultaneously.

This migration comes with a cost that the tech industry is only beginning to reckon with. Post-quantum algorithms are computationally heavier than their classical predecessors. An ML-DSA signature verification can require ten times the CPU cycles of an equivalent ECDSA verification. For a high-volume API server handling tens of thousands of requests per second, that cost adds up in both latency and power consumption. Mobile devices with limited battery life will feel the difference first. The question of whether hardware acceleration will be necessary, or whether algorithmic improvements will close the gap, remains open.

The Harvest Now, Decrypt Later Problem

There is a deadline hidden in this timeline that makes the migration more urgent than it appears. Intelligence agencies and well-funded adversaries have been collecting encrypted internet traffic for years, storing it in the expectation that future quantum computers will be able to decrypt it. This is called "harvest now, decrypt later." A TLS handshake recorded in 2023 that used ECDH key exchange could be retroactively decrypted in 2033, revealing the session keys and the entire encrypted conversation.

For data with a short shelf life, this is not a concern. But for state secrets, trade secrets, medical records, and other information that must remain confidential for decades, the threat is already active. The encryption used today will not protect that data against a future quantum adversary. The only solution is to begin using post-quantum encryption now, before the recordings are made. The European Union's cybersecurity agency ENISA has explicitly warned that organizations handling long-lived sensitive data should begin transitioning immediately, not when the standards are finalized.

The U.S. National Security Agency made a similar recommendation in its CNSA 2.0 suite, published in 2022, which mandates a transition to post-quantum algorithms across all National Security Systems by 2035. The timeline is aggressive by government standards, but many security researchers argue it is still too slow given the harvest-now threat.

The Protocols That Need to Change

The full migration touches more than just TLS. Code signing, which ensures that software updates come from legitimate developers, uses digital signatures that will be vulnerable. Firmware updates for embedded devices, from medical implants to car control systems, rely on signature verification that must be updated. DNSSEC, the system that authenticates DNS records, uses ECDSA signatures today. Even blockchain systems, which depend on ECDSA for transaction signing, will need to migrate if they expect their security to hold beyond the quantum threshold.

Each of these use cases has different performance requirements and different update cycles. A cloud server can be patched in minutes. A satellite launched in 2022 may have a firmware lifespan of fifteen years with no update path. A smart meter deployed across a country might use a cryptographic library that was frozen in 2018. The migration will not happen all at once. It will happen in layers, starting with internet-facing infrastructure and working outward to embedded systems, with some devices simply aging out of service before their encryption becomes exploitable.

The Algorithms That Didn't Make the Cut

The NIST competition produced more than just the winners. A fourth track, focused on additional signature schemes, led to the selection of FN-DSA, formerly FALCON, which offers smaller signatures than ML-DSA at the cost of a much more complex implementation. The FALCON signature scheme has been called the "most difficult algorithm to implement correctly" among the finalists, because it requires careful floating-point arithmetic that is hard to make constant-time and side-channel resistant.

Side-channel attacks are a persistent worry for these new algorithms. A lattice-based implementation that leaks timing information through its memory access patterns could be broken in ways that the underlying mathematics would resist. The history of cryptography is full of algorithms that were mathematically sound but practically broken because their implementations leaked secrets through power consumption, electromagnetic emissions, or cache timing. Each of the new post-quantum algorithms must be implemented with constant-time execution, which adds another layer of difficulty to the already challenging migration.

The Lingering Question of Security Margins

Here is the honest problem that keeps cryptographers awake. Lattice-based cryptography is the leading candidate for post-quantum security, but the underlying mathematical problems have not been studied for as long as the factoring problem that RSA relies on. RSA has been under sustained cryptanalytic attack since 1977, nearly fifty years. The Learning With Errors problem that underlies ML-KEM has been studied since 2005, barely two decades. The security assumptions are trusted, but the trust is based on a shorter track record.

There is no guarantee that a new algorithmic breakthrough will not weaken the lattice problems that ML-KEM and ML-DSA depend on. The community has built in conservative parameter choices, but the history of cryptography is a history of surprises. The Data Encryption Standard was considered secure until differential cryptanalysis was published in 1990. MD5 was considered safe until collision attacks emerged. SHA-1 survived for a decade past its expected lifetime before practical collisions ended its use. The question is not whether new attacks on lattice cryptography will appear. The question is whether they will appear before the current migration is complete, leaving the internet in a position where it must migrate again, this time under duress.