The whole story in five sentences
A large-scale quantum computer running Shor's algorithm breaks the public-key cryptography — RSA, Diffie–Hellman, and elliptic curve — behind almost every secure connection. It does not meaningfully break symmetric encryption or hashes, so AES-256 and SHA-384/512 stay fine. NIST finalized the replacements in August 2024: ML-KEM for key exchange, ML-DSA and SLH-DSA for signatures. The deadlines are real — quantum-vulnerable algorithms are deprecated after 2030 and disallowed after 2035. Start by finding where the vulnerable crypto lives, because you cannot migrate what you cannot see.
Post-quantum cryptography is easy to over- and under-read. The maximalist version says quantum computers will break all encryption and everything must change; the dismissive version says the hardware is decades away, so ignore it. Both are wrong. The accurate version is narrow and specific: one class of algorithm is broken, standardized replacements already exist, and firm dates now govern the transition. This piece is the orientation — the shortest complete map before you go deeper into the standards landscape or a concrete plan.
What quantum computing actually threatens
A cryptographically-relevant quantum computer running Shor's algorithm efficiently solves the integer-factorization and discrete-logarithm problems that public-key cryptography relies on for its hardness. That is a full break, not a size bump: RSA, Diffie–Hellman, and the entire elliptic-curve family (ECDH for key exchange, ECDSA and EdDSA for signatures) fall together. These are the asymmetric algorithms that establish session keys and prove identity in essentially every TLS handshake, VPN tunnel, SSH session, and signed software update. The break is in the mathematics, so longer keys do not help.
What it does not threaten
Symmetric cryptography and hash functions survive. The best known quantum attack on them, Grover's algorithm, delivers only a quadratic speedup — it effectively halves the security level rather than collapsing it. So AES-256 retains roughly 128 bits of quantum security, and SHA-384/512 remain secure at their designed sizes. The practical takeaway reshapes the whole project: this is a migration of asymmetric cryptography — key exchange and signatures — not a rip-and-replace of your bulk encryption. Your AES-encrypted data is not the problem; the RSA or ECDH exchange that delivered the AES key is.
The NIST standards that replace the broken parts
After an eight-year public competition, NIST finalized its first three post-quantum standards on 13 August 2024. Each targets a specific job:
- **FIPS 203 — ML-KEM** (Module-Lattice Key Encapsulation, from CRYSTALS-Kyber). Replaces RSA and ECDH key exchange. This is the one that matters most and first, because key exchange is where recorded traffic is exposed.
- **FIPS 204 — ML-DSA** (Module-Lattice Digital Signature, from CRYSTALS-Dilithium). The general-purpose signature replacement for ECDSA/EdDSA.
- **FIPS 205 — SLH-DSA** (Stateless Hash-Based Signature, from SPHINCS+). A conservative, hash-based signature alternative that relies on different mathematical assumptions than the lattice schemes.
- **SP 800-208** stateful hash-based signatures (LMS, XMSS). Already-standardized and well suited to firmware and code signing, where a small number of long-lived keys sign many artifacts.
Together these cover the two asymmetric functions that Shor's algorithm breaks. For how they fit together and which to reach for when, see the standards landscape and the deeper contrast in RSA vs ML-KEM.
The deadlines
What makes this urgent is not a prediction about hardware but a set of committed policy dates — and one threat that is present-tense regardless of when the hardware arrives.
The clock is already running: harvest now, decrypt later
Adversaries record encrypted traffic today and archive it to decrypt once a quantum computer exists. Storage is cheap and patience is free, so any secret whose value outlives the time-to-quantum is exposed the moment it crosses the wire — the decryption is in the future, but the harvesting is now. That is why waiting for Q-day is already too late. See harvest now, decrypt later.
- **NIST IR 8547** deprecates quantum-vulnerable algorithms after 2030 and disallows them after 2035 — the closest thing to an industry-wide end-of-life schedule.
- **CNSA 2.0** requires exclusive use of post-quantum algorithms for US national-security systems by 2033, with earlier milestones for software and firmware signing.
- **OMB M-23-02** sets a 2035 target for US federal agencies and — crucially — mandates an inventory first, because the government cannot migrate what it has not counted.
Where to start
Every serious framework converges on the same first move: you cannot migrate what you cannot see. Begin with a cryptographic inventory that finds where vulnerable key exchange and signatures actually live across your code, protocols, and certificates. Turn that inventory into a migration roadmap sequenced by data shelf life — long-lived secrets protected by quantum-vulnerable key exchange go first. Inventory before roadmap, roadmap before rollout; the order is not negotiable, and skipping the inventory is the most common way these programs stall.
How quantakrypto helps
This primer is the map; the terrain is your own systems. We run the cryptographic inventory that locates every quantum-vulnerable dependency, translate it into a migration roadmap sequenced by risk and shelf life, and train your engineers through structured education so post-quantum reasoning becomes part of how they design and review systems. Start with the inventory — it is the one step nothing downstream can proceed without.