Also mentioned
ML-KEMML-KEMModule-Lattice-based Key Encapsulation MechanismModule-Lattice-Based Key-Encapsulation Mechanism, the NIST-standardized post-quantum KEM derived from CRYSTALS-Kyber and specified in FIPS 203.Read the full entry (new tab), TLSTLSTransport Layer SecurityTransport Layer Security, the protocol that encrypts and authenticates most internet traffic, including HTTPS. It uses key exchange, certificates, and symmetric encryption to protect a session.Read the full entry (new tab), NISTNISTNational Institute of Standards and TechnologyThe U.S. National Institute of Standards and Technology, the agency that develops and publishes cryptographic standards, including the FIPS series and post-quantum algorithms.Read the full entry (new tab), PQCPQCpost-quantum cryptographyCryptographic algorithms designed to run on today's classical computers while remaining secure against attacks by both classical and future quantum computers.Read the full entry (new tab) are defined in the glossary.
Read this first
The case for migrating now does not depend on a quantum timeline. It depends on the asymmetry of consequences: migrating early is recoverable engineering overhead; migrating late is unrecoverable. Decide against the asymmetry, not the date.
Most post-quantum conversations stall on the same question: when does the quantum computer actually arrive? It is the wrong question to organise around, because it invites a bet on a date nobody can call, and then treats the migration as optional until that date is near.
The two failure modes are not equal
If migration turns out to be premature, the cost is engineering overhead: larger keys, larger signatures, more bandwidth, more complex protocol negotiation. These costs are real, but they are recoverable. If migration is late, the consequences are categorically different: private keys become extractable, signatures become forgeable, and traffic encrypted today is decrypted retroactively.
The first failure mode is engineering debt; the second is unrecoverable.
What to do this quarter
Begin a cryptographic inventory now and enable hybrid key exchange (X25519MLKEM768) on TLS-terminating services behind a flag. Both are the cheap end of a post-quantum migration. Neither step requires certainty about timelines, and both reduce the unrecoverable side of the asymmetry.
Harvest-now-decrypt-later makes the asymmetry concrete today. An adversary does not need a quantum computer now to benefit from one later; they only need to store your ciphertext now and wait. For anything with a long confidentiality lifetime, the clock has already started, and which of your systems carry one is the question an audit exists to answer.
Don't wait for the factoring record
Treating a public quantum milestone as the trigger to start assumes migration is instantaneous. It is not: for most organisations it is a multi-year programme. By the time the milestone lands, the migration should already be well underway.
The asymmetry is stark once you price it. The cheap side has already been paid at internet scale: hybrid X25519MLKEM768 adds roughly 1.2 KB each way to a TLS handshake (ML-KEM-768's encapsulation key is 1184 bytes and its ciphertext 1088 bytes) and is now the default in major browsers with negligible fallout. The expensive side is the bet on a date nobody can call, and the 2025 expert survey puts the likelihood of a cryptographically-relevant quantum computer within 15 years at 51–70%. That is not even a long-odds date.
References
- Wikipedia: Harvest now, decrypt later (the store-now/decrypt-later adversary the asymmetry rests on) and Shor's algorithm (why late migration is categorically unrecoverable).
- IETF: RFC 9954: Hybrid Key Exchange in TLS 1.3 and draft-ietf-tls-ecdhe-mlkem: the X25519MLKEM768 the recommendation names.
- NIST: the first three finalized PQC standards (2024): the migration destination exists and is final. Parameter sizes: ML-KEM (Wikipedia).
- Global Risk Institute: Quantum Threat Timeline Report 2025: the expert probabilities that quantify the timeline bet. Michele Mosca, eprint 2015/1075: the X + Y > Z formalization of the same asymmetry.