Post-Quantum Security

The threat in one line

Almost every secure connection online rests on two hard maths problems: factoring large numbers (RSA) and the elliptic-curve discrete logarithm (ECDSA, ECDH). A sufficiently large, fault-tolerant quantum computer running Shor's algorithm would solve both efficiently, breaking the key exchange and digital signatures that protect web traffic, software updates, messaging and most of the crypto economy. Symmetric encryption such as AES and hash functions are only weakened, not broken (Grover's algorithm), and a doubled key size restores their strength. The public-key layer is the exposed part.

Why the deadline is already here: harvest now, decrypt later

No quantum computer can break RSA today. That is not the point. Adversaries can record encrypted traffic and stored ciphertext now and simply wait, decrypting it once the hardware arrives. Anything that must stay confidential for a decade, health records, state secrets, long-lived keys, is already exposed. The migration deadline is not the day a quantum computer is switched on. For long-lived secrets, it has already passed.

The replacement standards

After an eight-year public competition, NIST finalised its first post-quantum standards on 13 August 2024. They are built on maths (structured lattices and hashes) that no known quantum algorithm breaks:

• FIPS 203 (ML-KEM), from CRYSTALS-Kyber, is a key-encapsulation mechanism. It replaces RSA and elliptic-curve key exchange, for example the handshake that starts a TLS connection.
• FIPS 204 (ML-DSA), from CRYSTALS-Dilithium, is the general-purpose digital signature, the replacement for ECDSA in most systems.
• FIPS 205 (SLH-DSA), from SPHINCS+, is a hash-based signature with more conservative security assumptions, meant for long-lived, high-assurance signing such as PKI root certificates and firmware.
• FIPS 206 (FN-DSA), from FALCON, a compact lattice signature, is expected later in 2026 to round out the set.

The migration timeline

The standards are the easy part. Replacing cryptography across the world's software, hardware and protocols is a decade-long programme, and the deadlines are now firm:

• NIST IR 8547 sets a two-stage sunset: RSA-2048 and ECC P-256 are deprecated by 2030 and disallowed, with every quantum-vulnerable algorithm removed from NIST standards, by 2035.
• A June 2026 US federal executive order requires high-value civilian systems to move key establishment by 2030 and signatures by 2031.
• The NSA's CNSA 2.0 suite mandates post-quantum algorithms for new national-security systems from 2027.
• The near-term default is hybrid: run a classical and a post-quantum algorithm together, so a break in either alone is not enough.

Where it stands in 2026

Deployment is further along than most people realise. By late October 2025 more than half of human-initiated web traffic through Cloudflare was already protected by the hybrid X25519MLKEM768 key exchange. Major browsers, Signal and Apple's iMessage (PQ3) have all shipped post-quantum protections. The hard remaining work is not the cryptography, it is the inventory: finding every place a system uses vulnerable crypto, and rebuilding the long-lived hardware and embedded systems that cannot simply be updated over the air.

What it means for crypto

Bitcoin, Ethereum and most blockchains sign transactions with elliptic-curve schemes (ECDSA, Schnorr) that a quantum computer would break. The practical risk is a reused or otherwise exposed public key, since an unspent output whose public key is visible could be spent by an attacker who can derive the private key. Quantum-resistant signature schemes and migration paths are active research across the major chains, and it is the clearest reason the quantum desk and the security desk overlap. For the wider picture, see ourQuantum Explained hub.