Also mentioned
RSARSARivest, Shamir and AdlemanA widely used public-key algorithm for encryption and digital signatures whose security relies on the difficulty of factoring large numbers.Read the full entry (new tab), ML-KEMML-KEMModule-Lattice-based Key Encapsulation MechanismModule-Lattice-Based Key-Encapsulation Mechanism, the NIST-standardized post-quantum KEM derived from CRYSTALS-Kyber and specified in FIPS 203.Read the full entry (new tab), ML-DSAML-DSAModule-Lattice-based Digital Signature AlgorithmModule-Lattice-Based Digital Signature Algorithm, the NIST-standardized post-quantum signature scheme derived from CRYSTALS-Dilithium and specified in FIPS 204.Read the full entry (new tab), SLH-DSASLH-DSAStateless Hash-based Digital Signature AlgorithmStateless Hash-Based Digital Signature Algorithm, the NIST-standardized signature scheme derived from SPHINCS+ and specified in FIPS 205.Read the full entry (new tab), TLSTLSTransport Layer SecurityTransport Layer Security, the protocol that encrypts and authenticates most internet traffic, including HTTPS. It uses key exchange, certificates, and symmetric encryption to protect a session.Read the full entry (new tab), FIPSFIPSFederal Information Processing StandardFederal Information Processing Standards, publicly announced standards developed by NIST for use in U.S. government computer systems, including cryptographic algorithms and modules.Read the full entry (new tab), NISTNISTNational Institute of Standards and TechnologyThe U.S. National Institute of Standards and Technology, the agency that develops and publishes cryptographic standards, including the FIPS series and post-quantum algorithms.Read the full entry (new tab), PKIPKIpublic key infrastructurePublic Key Infrastructure, the framework of certificate authorities, certificates, and policies that binds public keys to identities and enables trust in TLS, code signing, and email.Read the full entry (new tab), CNSACNSACommercial National Security Algorithm SuiteThe Commercial National Security Algorithm Suite 2.0, the NSA's mandated algorithm set for US National Security Systems.Read the full entry (new tab) are defined in the glossary.
The most common reason organizations delay post-quantum work is also the weakest: "a quantum computer that can break RSA doesn't exist yet." That's true. It's also beside the point. The threat to confidentiality doesn't begin when the machine arrives: it begins the moment someone records your traffic.
Harvest now, decrypt later
Recording encrypted data is cheap and passive. An adversary captures your TLS sessions, your VPN tunnels, your backups today, and stores them. When a cryptographically-relevant quantum computer exists, Shor's algorithm breaks the RSA or elliptic-curve key exchange that protected them, and the plaintext falls out, retroactively. Anything that must stay confidential past that horizon is, in effect, already exposed.
Authentication is different: a forged online signature only matters at the moment of forgery, so interactive-authentication signatures are a more deferrable migration. Confidentiality is not. The exception is long-lived signatures (firmware, code signing, PKI roots, signed documents) which stay verifiable for years and can be forged retroactively once the key falls; that is exactly why CNSA 2.0 puts hash-based firmware signing (LMS/XMSS) first. That asymmetry is the whole reason key exchange comes first.
A clock you already own
You don't need to predict Q-day to decide what to do. Mosca's inequality makes it concrete: if the number of years your data must stay secret (X) plus the number of years your migration will take (Y) is greater than the years until a capable quantum computer exists (Z), you have a gap. You already know X and Y. You don't need a precise Z to know whether X + Y is large.
The wrong question
"When does the quantum computer arrive?" is uncertain and outside your control. "How long must my data stay secret, and how long will migrating take?" is knowable today, and it's the one that sets your roadmap.
What's already settled
- NIST finalized three standards on 13 August 2024: ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205).
- The IETF/industry near-term target is a hybrid key exchange, X25519MLKEM768, secure if either the classical or the lattice half holds. (Notably, NSA's CNSA 2.0 does not require hybrids.)
- NSA's CNSA 2.0 names ML-KEM-1024 and ML-DSA-87, not SLH-DSA, plus LMS/XMSS for firmware signing, and requires national-security systems to use them exclusively by 2033.
So the math is settled and the targets are named. What's left is the work: inventory your cryptography, rank it by confidentiality lifetime, and migrate the longest-lived surfaces to hybrid first. That's what we're here to help you do, and it starts with seeing where you stand.
References
- NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA): the three standards finalised on 13 August 2024.
- NSA CNSA 2.0 FAQ: the ML-KEM-1024 and ML-DSA-87 selections, and why hybrids are not required for national-security systems.
- draft-ietf-tls-ecdhe-mlkem: the hybrid key exchange the industry actually deploys.