Keys guides

RSA in plain language: what it does, why multiplying two primes protects anything, what a 2048-bit key really means, and why a quantum computer undoes all of it. With commands to generate a key on your own machine.

Elliptic curve cryptography in plain language: why a 256-bit ECC key replaced a 3072-bit RSA key, what ECDH and ECDSA each do, which curve to pick, and why a quantum computer breaks ECC before it breaks RSA.

ML-KEM in plain language: what a key encapsulation mechanism is, why it never encrypts your message, which parameter set to pick, what it costs in bytes, and how to generate a key and run an encapsulation yourself.

ML-DSA in plain language: what a digital signature proves, why the post-quantum version is fifty times bigger, which parameter set to pick, where the size actually hurts, and how to sign and verify something yourself.

The whole picture in one read: what a quantum computer actually breaks, what it leaves alone, the NIST standards that replace the broken parts, the deadlines that make it a program and not a project, and where to start. The on-ramp to everything else.

Why post-quantum deployments run a classical curve and a PQ KEM together and derive the session key from both, so the connection survives a quantum break of the curve or an undiscovered flaw in the young algorithm. How the combiner works, where hybrids are used, and when pure PQC is preferred instead.

A side-by-side of RSA and ECDH against ML-KEM: the hardness assumptions Shor's algorithm breaks, the encapsulate/decapsulate message pattern, key and ciphertext sizes, and performance, so you know exactly what changes in your systems, and what ML-KEM does not replace.

NIST standardised two post-quantum signature schemes with very different trade-offs. Which one to use where, why SLH-DSA exists at all, and the sizes that decide it.

Replacing classical key establishment with ML-KEM is more than a TLS change: key exchange lives in SSH, VPNs, email, messaging, and data at rest. What actually changes, hybrid vs pure, and how to stage the migration without stranding half your estate on classical crypto.