Also mentioned
RSARSARivest, Shamir and AdlemanA widely used public-key algorithm for encryption and digital signatures whose security relies on the difficulty of factoring large numbers.Read the full entry, ECDHECDHElliptic Curve Diffie-HellmanElliptic Curve Diffie-Hellman, a key-exchange method using elliptic-curve mathematics to establish a shared secret with smaller keys than classical Diffie-Hellman.Read the full entry, ECDSAECDSAElliptic Curve Digital Signature AlgorithmElliptic Curve Digital Signature Algorithm, a widely deployed signature scheme based on elliptic-curve cryptography, offering strong security with compact keys.Read the full entry, ML-KEMML-KEMModule-Lattice-based Key Encapsulation MechanismModule-Lattice-Based Key-Encapsulation Mechanism, the NIST-standardized post-quantum KEM derived from CRYSTALS-Kyber and specified in FIPS 203.Read the full entry, ML-DSAML-DSAModule-Lattice-based Digital Signature AlgorithmModule-Lattice-Based Digital Signature Algorithm, the NIST-standardized post-quantum signature scheme derived from CRYSTALS-Dilithium and specified in FIPS 204.Read the full entry, SLH-DSASLH-DSAStateless Hash-based Digital Signature AlgorithmStateless Hash-Based Digital Signature Algorithm, the NIST-standardized signature scheme derived from SPHINCS+ and specified in FIPS 205.Read the full entry, TLSTLSTransport Layer SecurityTransport Layer Security, the protocol that encrypts and authenticates most internet traffic, including HTTPS. It uses key exchange, certificates, and symmetric encryption to protect a session.Read the full entry, AESAESAdvanced Encryption StandardThe Advanced Encryption Standard, a symmetric block cipher standardized by NIST that encrypts data using shared secret keys of 128, 192, or 256 bits.Read the full entry, FIPSFIPSFederal Information Processing StandardFederal Information Processing Standards, publicly announced standards developed by NIST for use in U.S. government computer systems, including cryptographic algorithms and modules.Read the full entry, NISTNISTNational Institute of Standards and TechnologyThe U.S. National Institute of Standards and Technology, the agency that develops and publishes cryptographic standards, including the FIPS series and post-quantum algorithms.Read the full entry, CNSACNSACommercial National Security Algorithm SuiteThe Commercial National Security Algorithm Suite 2.0, the NSA's mandated algorithm set for US National Security Systems.Read the full entry are defined in the glossary.
The whole story in five sentences
A large-scale quantum computer running Shor's algorithm breaks the public-key cryptography (RSA, Diffie-Hellman, and elliptic curve) behind almost every secure connection. It does not meaningfully break symmetric encryption or hashes, so AES-256 and SHA-384/512 stay fine. NIST finalized the replacements in August 2024: ML-KEM for key exchange, ML-DSA and SLH-DSA for signatures. The deadlines are real: quantum-vulnerable algorithms are deprecated after 2030 and disallowed after 2035. Start by finding where the vulnerable crypto lives, because the work starts from a map, not from an intention.
Post-quantum cryptography is easy to over- and under-read. The maximalist version says quantum computers will break all encryption and everything must change; the dismissive version says the hardware is decades away, so ignore it. Both are wrong. The accurate version is narrow and specific: one class of algorithm is broken, standardized replacements already exist, and firm dates now govern the transition. This piece is the orientation, the shortest complete map before you go deeper into the standards landscape or a concrete plan.
What quantum computing actually threatens
A cryptographically-relevant quantum computer running Shor's algorithm efficiently solves the integer-factorization and discrete-logarithm problems that public-key cryptography relies on for its hardness. That is a full break, not a size bump: RSA, Diffie–Hellman, and the entire elliptic-curve family (ECDH for key exchange, ECDSA and EdDSA for signatures) fall together. These are the asymmetric algorithms that establish session keys and prove identity in essentially every TLS handshake, VPN tunnel, SSH session, and signed software update. The break is in the mathematics, so longer keys do not help.
What it does not threaten
Symmetric cryptography and hash functions survive. The best known quantum attack on them, Grover's algorithm, delivers only a quadratic speedup: it effectively halves the security level rather than collapsing it. So AES-256 retains roughly 128 bits of quantum security, and SHA-384/512 remain secure at their designed sizes. The practical takeaway reshapes the whole project: this is a migration of asymmetric cryptography, key exchange and signatures, not a rip-and-replace of your bulk encryption. Your AES-encrypted data is not the problem; the RSA or ECDH exchange that delivered the AES key is.
The NIST standards that replace the broken parts
After an eight-year public competition, NIST finalized its first three post-quantum standards on 13 August 2024. Each targets a specific job:
- FIPS 203, ML-KEM (Module-Lattice Key Encapsulation, from CRYSTALS-Kyber). Replaces RSA and ECDH key exchange. This is the one that matters most and first, because key exchange is where recorded traffic is exposed.
- FIPS 204, ML-DSA (Module-Lattice Digital Signature, from CRYSTALS-Dilithium). The general-purpose signature replacement for ECDSA/EdDSA.
- FIPS 205, SLH-DSA (Stateless Hash-Based Signature, from SPHINCS+). A conservative, hash-based signature alternative that relies on different mathematical assumptions than the lattice schemes.
- SP 800-208 stateful hash-based signatures (LMS, XMSS). Already-standardized and well suited to firmware and code signing, where a small number of long-lived keys sign many artifacts.
Together these cover the two asymmetric functions that Shor's algorithm breaks. For how they fit together and which to reach for when, see the standards landscape and the deeper contrast in RSA vs ML-KEM.
The deadlines
What makes this urgent is not a prediction about hardware but a set of committed policy dates, plus one threat that is present-tense regardless of when the hardware arrives.
The clock is already running: harvest now, decrypt later
Adversaries record encrypted traffic today and archive it to decrypt once a quantum computer exists. Storage is cheap and patience is free, so any secret whose value outlives the time-to-quantum is exposed the moment it crosses the wire: the decryption is in the future, but the harvesting is now. That is why waiting for Q-day is already too late. See harvest now, decrypt later.
- NIST IR 8547 deprecates quantum-vulnerable algorithms after 2030 and disallows them after 2035, the closest thing to an industry-wide end-of-life schedule.
- CNSA 2.0 requires exclusive use of post-quantum algorithms for US national-security systems by 2033, with earlier milestones for software and firmware signing.
- OMB M-23-02 sets a 2035 target for US federal agencies and, crucially, mandates an inventory first, because the government cannot migrate what it has not counted.
Where to start
Every serious framework converges on the same first move: you cannot migrate what you cannot see. Begin with a cryptographic inventory that finds where vulnerable key exchange and signatures actually live across your code, protocols, and certificates. Turn that inventory into a migration roadmap sequenced by data shelf life: long-lived secrets protected by quantum-vulnerable key exchange go first. Inventory before roadmap, roadmap before rollout; the order is not negotiable, and skipping the inventory is the most common way these programs stall.
Where to start once the orientation is done
This primer is the map; the terrain is your own systems. We run the cryptographic inventory that locates every quantum-vulnerable dependency, translate it into a migration roadmap sequenced by risk and shelf life, and train your engineers through structured education so post-quantum reasoning becomes part of how they design and review systems. Start with the inventory. It is the one step nothing downstream can proceed without.