Post-quantum cryptography (PQC)

Cryptography that survives quantum computers: ML-KEM, ML-DSA and SLH-DSA, why key exchange is urgent first, and what migration means for signatures.

Algorithms designed to stay secure against an attacker with a large quantum computer. The threat is specific: Shor's algorithm breaks the mathematics that RSA and elliptic curve cryptography rest on, so those keys do not become weaker, they become worthless. Symmetric algorithms and hash functions are affected far less.

NIST finished the first standards in 2024: ML-KEM for key establishment (FIPS 203) and ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for signatures. Names still circulate from the competition - Kyber, Dilithium, SPHINCS+ - but the standardised names are the ones a certificate profile or a protection profile will cite. Those three were the first, not the last: NIST selected HQC for standardisation in March 2025 as a backup key-establishment mechanism built on different mathematics, and FIPS 206 is in development. Read any list of post-quantum algorithms as a snapshot.

Confidentiality and signatures need different reasoning. Encrypted traffic captured today can be stored until a quantum computer exists, which makes key exchange urgent now. A signature, by contrast, is verified in the present: the risk is not that it is broken today but that evidence made with today's algorithms has to keep standing for decades. That is why the migration story for a QTSP is mostly about being able to re-protect old evidence with archive timestamps and about being able to change algorithms at all - crypto-agility in certificate profiles, HSM firmware, chains and key ceremonies, rather than a single switch to flip.