What is post-quantum cryptography?
Post-quantum cryptography (PQC) is cryptography designed to withstand attack by quantum computers. Today's public-key algorithms - RSA and elliptic curve - break when a sufficiently capable quantum computer runs Shor's algorithm; symmetric encryption like AES-256 largely survives. NIST has standardized quantum-resistant replacements, and migration starts now because long-lived data encrypted today can be harvested and decrypted later.
Post-quantum cryptography (PQC) is cryptography built to remain secure against attack by quantum computers. It is not exotic future technology - it is standardized, available, and being deployed now - because the threat it addresses has an unusual timeline: the defense must be in place before the attack is possible, since data encrypted today can be captured and broken later.
What breaks and what survives
The quantum threat is specific, and understanding its scope keeps the problem bounded:
- Public-key cryptography breaks. RSA, elliptic-curve schemes, and finite-field Diffie-Hellman rely on mathematical problems that a sufficiently capable quantum computer solves efficiently using Shor’s algorithm. This is the cryptography that protects data in transit and establishes digital trust - so its failure is consequential.
- Symmetric cryptography largely survives. AES-256 and modern hash functions are only modestly weakened by quantum algorithms and remain secure at adequate key sizes.
The practical upshot: the migration targets key establishment, digital signatures, and the certificate estate - not everything. That bound is what makes the problem tractable.
The standardized replacements
After a multi-year evaluation, NIST has finalized the first post-quantum standards: ML-KEM for key encapsulation (the replacement for classical key exchange), and ML-DSA and SLH-DSA for digital signatures. These are the destinations of a migration. For internet-facing traffic, the emerging practice is hybrid key exchange - combining a classical algorithm with a post-quantum one so that breaking the session requires breaking both, which hedges against a future quantum computer and against any weakness discovered in the newer algorithms at once. The engineering detail of the standards is worth reading for teams planning adoption.
Why the deadline is already here
The counterintuitive part of PQC is the urgency, given that large quantum computers do not yet exist. The reason is harvest-now-decrypt-later: an adversary records encrypted data today - intercepted traffic, stolen archives - and stores it until quantum capability arrives to decrypt it retroactively. If your data must remain confidential for a decade, and quantum capability might arrive within that window, the attack against it has effectively already begun.
Layer on the fact that migration itself takes years, and the timing inequality is clear: if the confidentiality lifetime of your data plus the time to migrate exceeds the time until capable quantum computers exist, you are already late. This is why government timelines are published and regulated sectors are expected to follow.
Migration starts with inventory
Every PQC migration begins with the same unglamorous step, and it is the step most organizations cannot yet do: know where your cryptography is. You cannot migrate what you have not enumerated, and cryptography hides far beyond TLS settings - in application code, configuration, certificates, and compiled binaries. The inventory is a CBOM, the readiness verdict computed over it is a QBOM, and the inventory-first migration method turns the whole thing from a slogan into schedulable engineering work.
BOMNexa builds that cryptographic inventory from real artifacts, classifies every asset against current NIST standards, and tracks the readiness posture as a number over time - the foundation on which any real migration stands, delivered entirely offline.
Frequently asked questions
What exactly breaks under quantum computing?
Public-key cryptography: RSA, elliptic-curve signatures and key exchange, and finite-field Diffie-Hellman. These rely on math problems a large quantum computer solves efficiently with Shor's algorithm. Symmetric cryptography such as AES and hash functions are only mildly weakened and remain secure at adequate key sizes, so the migration is bounded to key exchange, signatures, and certificates.
What are the post-quantum replacements?
NIST has finalized standards including ML-KEM for key encapsulation and ML-DSA and SLH-DSA for digital signatures. These are the quantum-resistant algorithms to migrate toward. For internet traffic, hybrid modes that combine a classical algorithm with a post-quantum one are the emerging default, hedging against both threats at once.
Why migrate before quantum computers exist?
Because of harvest-now-decrypt-later: an adversary can record encrypted data today and decrypt it once quantum capability arrives. If your data must stay confidential for years, the attack against it has effectively already begun. And migration itself takes years, so the deadline is set by your data's lifetime plus your migration time, not by the arrival of the hardware.