Post-quantum cryptography designs cryptographic systems that resist quantum-computer attacks while running on conventional infrastructure. It responds mainly to Shor’s algorithm, which threatens RSA and other widely used asymmetric systems, while Grover’s algorithm weakens 128-bit symmetric security. section 14.0 section 14.5
A practical transition involves several choices:
- Plan early: replacing public-key encryption, key exchange, and digital signatures is unlikely to be a simple drop-in upgrade. section 14.1.4
- Protect long-lived information first, because data captured today could be decrypted after scalable quantum computers appear. section 14.1.4 section 14.4
- Know the main families: hash-based signatures, lattice-based systems, code-based systems, isogenies, multivariate polynomials, and strengthened symmetric cryptography. section 14.5
A cautious migration decision
An organization holding confidential data for decades need not panic about uncertain quantum-computer timelines, but should assess its protection horizon and prepare for post-quantum replacements. Lattice-based candidates illustrate the tradeoff: Kyber supports encryption and key exchange, while Dilithium supports signatures. section 14.4 section 14.5
NIST began a post-quantum standardization effort in 2016. Prominent candidates include XMSS and SPHINCS+ for hash-based signatures, plus lattice-based Kyber and Dilithium; standards and attacks can continue to evolve. section 14.1.4 section 14.5
