Curated further reading on post-quantum and modern security
Deeper dives worth your time — the classic threat-model paper, background on the algorithms, and the practitioner guidance that goes beyond the standards themselves.
Where to go deeper
Once you have the primary sources, these readings fill in the why and the how — the threat-model reasoning behind the urgency, background on how the algorithms work and why some candidates failed, and practitioner guidance on actually migrating. Curated, not exhaustive.
Understanding the threat and the timing
- M. Mosca — 'Cybersecurity in an era with quantum computers: will we be ready?' — the paper behind the X + Y > Z inequality that frames why you must act before Q-Day is known.
- Wikipedia — Harvest now, decrypt later — a readable overview of the record-now, decrypt-later threat model.
- Wikipedia — Shor's algorithm — what actually breaks RSA and elliptic-curve cryptography, and why symmetric crypto is far less affected.
The algorithms and the standardization story
- NIST — Post-Quantum Cryptography FAQs — clear answers on algorithm choices, timelines, and what the standards mean in practice.
- Wikipedia — Post-quantum cryptography — a survey of the algorithm families (lattice, hash-based, code-based) and the trade-offs between them.
- Wikipedia — Supersingular isogeny key exchange — a cautionary tale: a promising PQC candidate (SIKE/SIDH) broken in 2022, illustrating why the multi-year public scrutiny in standardization matters.
Practitioner guidance on migrating
- NIST NCCoE — Migration to Post-Quantum Cryptography — the practical playbook on discovery, crypto-agility, and phased migration.
- IETF — post-quantum work (e.g. hybrid key exchange in TLS) — where the protocol-level integration of PQC is being standardized.
- Open Quantum Safe project — open-source implementations and test tooling for experimenting with PQC and hybrid modes before you commit.
Community wikis are a starting point, not a citation
General-reference pages are great for orientation and terminology, but for anything load-bearing — an algorithm's status, a standard's scope, a deadline — confirm it against the NIST or CISA primary source. Use the further reading to build intuition, then verify the specifics.