The quantum threat is real, not theoretical
Shor's algorithm proves that a sufficiently powerful quantum computer can break RSA and ECC encryption orders of magnitude faster than any classical computer. With enough qubits and error correction, it's not a matter of if, but when.
The scarier part? Adversaries are already collecting encrypted data now, betting they'll be able to decrypt it once quantum computers mature. This is the "harvest now, decrypt later" threat. Anything with long-term confidentiality requirements (government secrets, medical records, financial data) is vulnerable today.
What breaks and what doesn't
Vulnerable to quantum attacks:
- RSA (all key sizes)
- Elliptic Curve Cryptography (ECC)
- Diffie-Hellman key exchange
- ECDSA digital signatures
Quantum-resistant:
- Symmetric encryption (AES still works)
- Hash functions (SHA still works, but cut key length in half)
- Lattice-based cryptography (CRYSTALS-Kyber, CRYSTALS-Dilithium)
- Hash-based signatures (SPHINCS+)
- Multivariate polynomial equations
NIST standardized the solutions in 2024
The U.S. National Institute of Standards and Technology (NIST) finalized post-quantum cryptography standards in August 2024. These algorithms are production-ready and battle-tested:
- CRYSTALS-Kyber (ML-KEM) — Key encapsulation for secure key exchange. Small ciphertexts, fast operations.
- CRYSTALS-Dilithium (ML-DSA) — Digital signatures. Small signatures, fast verification.
- SPHINCS+ — Hash-based signatures. Slower but extremely conservative, mathematically simple.
- SLH-DSA — NIST's official name for SPHINCS+. The backup for when you want mathematical certainty.
What organizations should do right now
You don't need to migrate everything overnight. But you need a plan:
- Inventory your cryptography — Find all RSA, ECC, and Diffie-Hellman usage. Identify systems with long-term confidentiality needs.
- Hybrid deployments — Start using post-quantum and classical algorithms together. If one is broken, the other still protects you.
- Test NIST standards — Libraries like liboqs-python, liboqs-c++, and Google's open-source tools are ready today.
- Plan for cryptographic agility — Design systems so you can swap algorithms without burning everything down.
- Apply to certificates now — If you issue long-lived certificates (years), consider adding post-quantum signatures.
The timeline matters
Quantum computers with sufficient qubits aren't here yet. Estimates range from 5-15 years. But the migration will take longer than that. Organizations with complex infrastructure might need 10+ years. So the time to start is now.
Note: NIST's post-quantum standards aren't a "maybe" — they're the future. The transition is already happening in government contracts and defense systems. Private sector adoption follows.