Post-quantum cryptography

Also known as PQC, Quantum-safe cryptography, Quantum-resistant cryptography

Post-quantum cryptography is a set of new encryption and signature methods designed to stay secure if large quantum computers are built. NIST finalised its first three standards in August 2024, and governments such as the UK have set migration targets running to 2035.

CommercialDemonstratedReviewed 21 Oct 2026
AI illustration · Illustrative scene, not a photograph of the specific device or experiment.

In plain language

Most encryption on the internet today relies on maths problems that ordinary computers find very hard to solve. A large, working quantum computer could solve some of these problems much faster, which would make today's locks unsafe. Post-quantum cryptography uses different maths problems that are believed to be hard for both ordinary and quantum computers. It is a software change, so it can run on normal phones, laptops and servers.

The main concern is what is often called harvest now, decrypt later. An attacker can record encrypted traffic today and wait until a quantum computer can read it. NCSC guidance asks organisations to record how long their data must stay secret, and to start migrating early rather than waiting for a quantum computer to appear. The UK's National Cyber Security Centre (NCSC) sets 2035 as the target for finishing this work across all systems, services and products.

Technical explanation

The US National Institute of Standards and Technology (NIST) began selecting and standardising quantum-resistant algorithms in 2015, with a public call for proposals in 2016. On 13 August 2024 it published its first three finalised standards: FIPS 203, which specifies ML-KEM for general encryption and key establishment; FIPS 204, which specifies ML-DSA for digital signatures; and FIPS 205, which specifies SLH-DSA, a hash-based signature scheme. NIST describes ML-KEM and ML-DSA as based on CRYSTALS-Kyber and CRYSTALS-Dilithium, and SLH-DSA as based on SPHINCS+. NIST describes SLH-DSA as intended as a backup in case ML-DSA proves vulnerable, because it relies on a different mathematical approach.

Deployment has mostly used hybrid key exchange, which combines a classical elliptic-curve method with a post-quantum method, so that the connection stays secure if either one is broken. Google's Chrome 124 stable release, dated 16 April 2024, enabled X25519Kyber768 for TLS traffic on desktop, described as protecting current Chrome TLS traffic against future quantum cryptanalysis. Signal's PQXDH protocol, published on 19 September 2023, combines X25519 with CRYSTALS-Kyber, so that an attacker must break both to recover the shared secret.

On 11 March 2025 NIST selected HQC as a backup key-establishment method to ML-KEM. HQC is built on error-correcting codes, a different mathematical basis from the lattice-based design of ML-KEM. NIST said it planned to release a draft standard in about a year and to finalise it in 2027. Migration of digital signatures in certificates, firmware and long-lived devices is a separate task from key exchange, and the sources reviewed here do not give a timetable for it.

What the evidence says

Each statement is typed by the strength of its evidence and linked to the source that supports it.

Demonstrated Shown in a published experiment, test or shipping product.

NIST published its first three finalised post-quantum standards, FIPS 203, FIPS 204 and FIPS 205, on 13 August 2024.

Sources: [1], [2] · Release date; FIPS 203 publication date

FIPS 203 specifies ML-KEM, a key-encapsulation mechanism, and NIST describes it as based on CRYSTALS-Kyber. FIPS 204 specifies ML-DSA for digital signatures, based on CRYSTALS-Dilithium.

Sources: [1], [2] · Standard titles and release summary

NIST describes FIPS 205 (SLH-DSA) as intended as a backup method in case ML-DSA proves vulnerable, because it uses a different mathematical approach.

Sources: [1] · Release summary

On 11 March 2025 NIST selected HQC, which is built on error-correcting codes, as a backup to ML-KEM. NIST said it planned a draft standard in about a year and a final standard in 2027.

Sources: [3] · Announcement text

NSM-10, issued on 4 May 2022, sets the goal of mitigating as much of the quantum risk as is feasible by 2035 and requires the Secretary of Commerce, through the NIST Director, to release a proposed timeline for phasing out quantum-vulnerable cryptography within 90 days of the release of the first NIST quantum-resistant standards.

Sources: [5] · Section 3(a) and 3(c)(vii)

Signal's PQXDH, published on 19 September 2023, combines X25519 with CRYSTALS-Kyber so that an attacker must break both to recover the shared secret, and is designed to protect against future quantum attacks such as harvest now, decrypt later.

Sources: [6] · Protocol description and threat model

Signal states that PQXDH does not protect against an attacker who has a quantum computer at the time of the communication.

Sources: [6] · Limitations section

Chrome 124 reached stable release on 16 April 2024 and enabled X25519Kyber768, a hybrid X25519 and Kyber768 key agreement, which Google describes as protecting current Chrome TLS traffic against future quantum cryptanalysis.

Sources: [7] · Chrome 124 release notes

Proposed A design or plan that has not yet been built or tested.

The UK NCSC sets milestones of building an initial migration plan by 2028, carrying out the highest-priority migration activities by 2031, and completing migration of all systems, services and products by 2035.

Sources: [4] · Milestone wording

Limitations and open problems

  • Migration targets are policy goals. The NCSC sets 2028, 2031 and 2035 milestones, but the sources reviewed here do not show how far any organisation has progressed against them.
  • The NCSC warns that a small set of rarely used technologies may be harder to migrate by 2035, and that some sectors will be affected more than others.
  • The newest standards are young. Signal notes that an attack on one NIST candidate suggests these options should be integrated cautiously, and it keeps elliptic-curve cryptography alongside Kyber rather than replacing it.
  • Hybrid key exchange protects against future decryption, but Signal states that PQXDH does not cover an attacker who holds a quantum computer at the time of the communication.
  • HQC was not yet a final standard at the time of writing. NIST's 2025 timing was a draft in about a year and a final standard in 2027.
  • The sources reviewed here do not state when a quantum computer able to break current public-key encryption is expected, so the urgency of each deadline cannot be judged from them alone.

Possible future uses

Speculative

Ideas, not predictions. None of these has been demonstrated.

  • Long-lived signing keys for firmware and industrial devices that may remain in service for decades, using hash-based signatures such as SLH-DSA.
  • Re-encryption of archives of sensitive government or medical records that must stay confidential for many years.
  • Post-quantum key exchange built into low-power sensors and implanted devices, where key and message sizes may be a constraint.

Timeline

  1. 4 May 2022US National Security Memorandum 10 (NSM-10) sets the goal of mitigating as much of the quantum risk as is feasible by 2035. Sources: [5]
  2. 19 Sept 2023Signal publishes PQXDH, a post-quantum upgrade to its key agreement protocol that combines X25519 with CRYSTALS-Kyber. Sources: [6]
  3. 16 Apr 2024Chrome 124 reaches stable release with X25519Kyber768 hybrid key agreement for TLS. Sources: [7]
  4. 13 Aug 2024NIST publishes FIPS 203, FIPS 204 and FIPS 205, its first three finalised post-quantum standards. Sources: [1], [2]
  5. 11 Mar 2025NIST selects HQC as a backup key-establishment method to ML-KEM. Sources: [3]
  6. 20 Mar 2025The UK NCSC publishes its timelines for migration to post-quantum cryptography, with milestones for 2028, 2031 and 2035. Sources: [4]

Futures this could help bring about

AI illustration
How far away?

An internet protected against quantum attacks

Scaling up · 3 of 8 steps done

Related breakthroughs

Glossary

Key encapsulation mechanism (KEM)
A method in which one party creates a secret key and wraps it so that only the holder of a private key can open it. ML-KEM is an example.
Harvest now, decrypt later
An attack in which encrypted data is stored now and decrypted once a quantum computer is powerful enough.
Hybrid key exchange
A key agreement that combines a classical method with a post-quantum method, so the result stays secure if either is broken.
Digital signature
A value that proves a message or file came from the holder of a private key and has not been changed.

Sources

  1. government report
    NIST Releases First 3 Finalized Post-Quantum Encryption Standards
    National Institute of Standards and Technology, 13 Aug 2024. Accessed 21 Oct 2026.
  2. standard
    Module-Lattice-Based Key-Encapsulation Mechanism Standard (FIPS 203)
    National Institute of Standards and Technology, 13 Aug 2024. DOI: 10.6028/NIST.FIPS.203. Accessed 21 Oct 2026.
  3. government report
    NIST Selects HQC as Fifth Algorithm for Post-Quantum Encryption
    National Institute of Standards and Technology, 11 Mar 2025. Accessed 21 Oct 2026.
  4. government report
    Timelines for migration to post-quantum cryptography
    UK National Cyber Security Centre, 20 Mar 2025. Accessed 21 Oct 2026.
  5. other
    National Security Memorandum on Promoting United States Leadership in Quantum Computing While Mitigating Risks to Vulnerable Cryptographic Systems (NSM-10)
    The White House (archived), 4 May 2022. Accessed 21 Oct 2026.
  6. company announcement
    PQXDH: Post-Quantum Extended Diffie-Hellman
    Signal, 19 Sept 2023. Accessed 21 Oct 2026.
  7. company announcement
    Chrome 124 release notes
    Google Chrome for Developers, 16 Apr 2024. Accessed 21 Oct 2026.

Revision history

3 changes since this profile was created.

Changes on 21 Oct 2026
Published on owner instruction (content loop iteration 24)f0449d2
Sources and claims re-checked against originalsfbb434c
Initial profile drafted from primary sources7e66249