Post-quantum cryptography is moving from a research topic into a practical cybersecurity priority. Governments, technology companies, researchers and enterprise security teams are preparing for a future in which sufficiently powerful quantum computers could threaten some of the public-key cryptography that protects digital communications today.
The transition will not happen overnight. Updating encryption across websites, applications, cloud platforms, financial systems, software and connected devices can take years. That is why the development of quantum-resistant standards has become an important part of long-term cybersecurity planning.
NIST has already finalized three post-quantum cryptography standards: FIPS 203, FIPS 204 and FIPS 205. The standards cover key establishment and digital signatures and are designed to withstand future attacks from quantum computers.
This article examines the most important developments in post-quantum cryptography, including NIST’s standards, enterprise migration, quantum-resistant protocols, fully homomorphic encryption and zero-knowledge proofs.
What Is Post-Quantum Cryptography?
Post-quantum cryptography, often abbreviated as PQC, refers to cryptographic algorithms designed to remain secure against attacks from both conventional computers and future cryptographically relevant quantum computers.
Modern internet security depends heavily on public-key cryptography. Technologies based on RSA, elliptic-curve cryptography and related mathematical problems are widely used for secure communication, authentication and digital signatures.
A sufficiently capable quantum computer could change that security equation. Shor’s algorithm, for example, provides a theoretical method for efficiently solving the mathematical problems underlying widely used public-key systems.
Post-quantum cryptography takes a different approach. Instead of relying on mathematical problems that are vulnerable to known quantum algorithms, PQC uses alternative mathematical structures that are currently believed to resist both classical and quantum attacks.
The goal is not to wait until a powerful quantum computer exists. Organizations need to prepare before that point because replacing cryptographic infrastructure can involve lengthy software, hardware and vendor dependencies.
Why Post-Quantum Cryptography Matters Now
One of the biggest concerns is commonly described as “harvest now, decrypt later.”
An attacker can collect encrypted communications today even if they cannot decrypt them with current technology. If quantum computing eventually makes the underlying cryptography breakable, previously captured information could potentially become readable.
This creates a particular concern for information that needs to remain confidential for many years.
Examples include:
- Financial records
- Government information
- Healthcare data
- Intellectual property
- Long-term business communications
- Identity information
- Sensitive research
- National-security information
For organizations handling information with a long confidentiality lifespan, migration planning can therefore be important even before large-scale quantum computers become available.
NIST’s Post-Quantum Cryptography Standards
The National Institute of Standards and Technology finalized its first three post-quantum cryptography standards in August 2024.
These standards are:
FIPS 203: ML-KEM
ML-KEM, specified in FIPS 203, is a key-encapsulation mechanism derived from CRYSTALS-Kyber.
Its primary purpose is establishing shared secret keys between parties communicating over a public channel. This makes it relevant to secure communications and other systems that need to establish encryption keys.
FIPS 204: ML-DSA
ML-DSA, specified in FIPS 204, is a digital signature standard derived from CRYSTALS-Dilithium.
Digital signatures help verify the identity of a signer and detect unauthorized changes to signed information. They can therefore play an important role in software updates, authentication and document-signing systems.
FIPS 205: SLH-DSA
SLH-DSA, specified in FIPS 205, is a stateless hash-based digital signature standard derived from SPHINCS+.
Its mathematical foundation differs from the lattice-based approach used by ML-DSA. That diversity is valuable because maintaining alternatives based on different mathematical assumptions can provide additional resilience if weaknesses are discovered in one approach.
NIST says the three finalized standards are ready for implementation, making migration a current engineering and planning issue rather than a purely theoretical exercise.
NIST’s Next Step: HQC
The post-quantum cryptography standards process has continued beyond the three finalized standards.
In March 2025, NIST selected HQC as an additional algorithm for standardization. HQC is intended to provide a backup option for general encryption alongside ML-KEM.
Unlike ML-KEM, which is based on structured lattices, HQC uses error-correcting codes. The different mathematical foundation gives organizations another potential defense if a future weakness were discovered in the primary key-establishment approach.
NIST has stated that organizations should continue migrating to the standards finalized in 2024 while HQC moves through the standardization process.
This distinction is important: HQC is not a replacement for ML-KEM today. It is being developed as an additional option for future resilience.
How Organizations Can Prepare for Post-Quantum Cryptography
Migration to post-quantum cryptography involves more than installing a new algorithm.
Organizations first need to understand where cryptography is being used.
1. Build a Cryptographic Inventory
Companies should identify where RSA, ECC and other public-key technologies are deployed.
The inventory can include:
- Websites and APIs
- VPN infrastructure
- Cloud services
- Internal applications
- Databases
- Mobile applications
- Digital certificates
- Software-signing systems
- Third-party products
- Connected devices
Without this inventory, organizations may struggle to determine which systems need to be upgraded first.
2. Identify Long-Lived Sensitive Data
Not every system carries the same level of risk.
Security teams should identify information that must remain confidential for many years and prioritize systems protecting that information.
3. Work With Technology Vendors
Many organizations rely on third-party cloud providers, software vendors and hardware manufacturers.
Security teams should ask vendors about their post-quantum cryptography roadmaps, supported algorithms, upgrade plans and compatibility requirements.
4. Build Cryptographic Agility
Cryptographic agility means designing systems so cryptographic algorithms can be replaced without rebuilding an entire application.
This can make future migrations significantly easier because algorithms can evolve as cryptographic research and standards develop.
Post-Quantum Cryptography in Consumer Technology
The transition is not limited to government and enterprise systems.
Technology companies have also introduced post-quantum protections into consumer communications.
Apple introduced its PQ3 protocol for iMessage in 2024. The company described PQ3 as a post-quantum cryptographic protocol designed to protect messaging against future quantum threats.
Signal has also introduced PQXDH, a protocol that combines traditional public-key cryptography with a post-quantum key-establishment mechanism.
These approaches demonstrate an important principle of the transition: organizations do not necessarily have to abandon existing cryptographic systems immediately. Hybrid approaches can combine established algorithms with post-quantum mechanisms during the migration period.
Fully Homomorphic Encryption and Data Privacy
Post-quantum cryptography is only one part of the broader evolution in modern cryptography.
Fully Homomorphic Encryption (FHE) addresses a different problem: protecting data while it is being processed.
Traditional encrypted data generally needs to be decrypted before conventional software can perform useful calculations on it. That creates a point at which sensitive information exists in plaintext.
FHE is designed to allow computations to be performed directly on encrypted data.
A simplified workflow looks like this:
Data → Encryption → Computation on encrypted data → Encrypted result → Decryption
This approach could be particularly useful in areas such as healthcare, financial services and cloud computing, where organizations may want to use external computing resources without exposing sensitive underlying information.
FHE remains considerably more computationally demanding than conventional processing, but continuing research and specialized hardware are aimed at reducing that overhead.
Zero-Knowledge Proofs and Digital Privacy
Zero-Knowledge Proofs (ZKPs) provide another important cryptographic capability.
A zero-knowledge proof allows one party to demonstrate that a statement is true without revealing the underlying information used to prove it.
For example, a system could theoretically allow a person to prove that they meet an age requirement without requiring the verifier to receive their exact date of birth.
ZKPs have become particularly prominent in blockchain and Web3 systems, including zero-knowledge rollups. Their potential applications also extend to digital identity and privacy-preserving verification.
The broader principle is simple: verify what needs to be verified while minimizing the amount of sensitive information that must be disclosed.
Cryptographic Security Still Depends on Implementation
Moving to stronger algorithms does not automatically make a system secure.
Cryptographic implementations can contain software bugs, configuration errors and side-channel vulnerabilities even when the underlying mathematical algorithm is considered secure.
Side-channel attacks, for example, attempt to extract information by observing characteristics such as execution timing, power consumption or other physical signals.
The GoFetch research highlighted how microarchitectural behavior can create risks for cryptographic implementations. The Terrapin attack demonstrated a different class of weakness involving the SSH protocol and how protocol manipulation can affect security properties.
These examples reinforce an important lesson: quantum-resistant algorithms are one part of a larger security architecture.
Organizations still need secure implementations, appropriate key management, software updates, access controls, monitoring and vulnerability management.
Post-Quantum Cryptography vs. FHE vs. ZKPs
These technologies solve different security problems.
| Technology | Main Purpose | Key Benefit |
|---|---|---|
| Post-Quantum Cryptography | Protect communications and signatures from future quantum attacks | Designed to resist quantum-enabled attacks |
| Fully Homomorphic Encryption | Process data while it remains encrypted | Reduces exposure of sensitive data during computation |
| Zero-Knowledge Proofs | Verify information without revealing the underlying data | Enables privacy-preserving verification |
Understanding these differences is important because the technologies are complementary rather than direct substitutes.
What Post-Quantum Cryptography Means for Businesses
For businesses, the transition is likely to be a multi-year technology project rather than a single software update.
Organizations should consider:
- Mapping existing cryptographic dependencies
- Identifying systems that use RSA and ECC
- Reviewing third-party vendor roadmaps
- Prioritizing long-lived sensitive information
- Testing post-quantum algorithms
- Developing cryptographic agility
- Evaluating hybrid implementations
- Monitoring NIST standards and migration guidance
- Training security and engineering teams
Companies that understand their cryptographic dependencies early will have more information available when replacement decisions need to be made.
7 Key Developments to Watch
1. Wider Adoption of NIST Standards
The three finalized NIST standards provide a foundation for organizations beginning their post-quantum migration.
2. Continued Standardization
HQC demonstrates that the PQC standards process is continuing and that additional mathematical approaches are being evaluated.
3. Hybrid Cryptography
During migration, systems may use classical and post-quantum mechanisms together to balance compatibility and emerging quantum resistance.
4. Cryptographic Agility
The ability to replace algorithms efficiently will become increasingly important as standards and threat models evolve.
5. Quantum-Safe Consumer Communications
Messaging and other consumer services are already experimenting with post-quantum protection.
6. Privacy-Preserving Computation
FHE and related technologies could expand the ability to process sensitive information without exposing raw data.
7. Implementation Security
Organizations will need to protect not only the mathematics but also the software, hardware and protocols implementing those algorithms.
Key Takeaways
Post-quantum cryptography is no longer only a theoretical research area. NIST finalized FIPS 203, FIPS 204 and FIPS 205 in 2024, creating a standardized foundation for quantum-resistant key establishment and digital signatures.
The next stage is migration.
Businesses and technology providers need to understand where vulnerable cryptography is being used, determine which information requires long-term protection and build systems that can adapt as standards evolve.
At the same time, developments in FHE and zero-knowledge proofs are expanding what modern cryptography can do for privacy and secure computation.
The most important lesson is that quantum readiness is not simply about choosing a new encryption algorithm. It requires visibility, planning, testing, vendor coordination and the ability to adapt as cryptographic standards continue to develop.
Frequently Asked Questions
What is post-quantum cryptography?
Post-quantum cryptography refers to cryptographic algorithms designed to protect systems against attacks from future quantum computers while remaining usable on conventional computing systems.
Has quantum computing already broken modern encryption?
No. Current quantum computers are not capable of breaking widely used public-key cryptography at the scale required for such attacks. The concern is future quantum capability and the possibility that encrypted information collected today could be targeted later.
What are NIST’s post-quantum cryptography standards?
NIST finalized three standards in August 2024: FIPS 203 for ML-KEM, FIPS 204 for ML-DSA and FIPS 205 for SLH-DSA.
What is ML-KEM?
ML-KEM is a key-encapsulation mechanism specified in FIPS 203. It is designed to establish shared secret keys over public communication channels and is NIST’s primary standardized approach for general encryption.
What is ML-DSA?
ML-DSA is a lattice-based digital signature standard specified in FIPS 204. Digital signatures can authenticate the signer and help detect unauthorized modification of signed information.
What is SLH-DSA?
SLH-DSA is a stateless hash-based digital signature standard specified in FIPS 205. It provides an alternative mathematical approach to the lattice-based ML-DSA.
What is HQC in post-quantum cryptography?
HQC is an algorithm selected by NIST in 2025 for future standardization as a backup for ML-KEM. It is based on error-correcting codes rather than the structured-lattice approach used by ML-KEM.
When should businesses start preparing for post-quantum cryptography?
Organizations should begin migration planning now. Building a cryptographic inventory, identifying vulnerable systems and coordinating with vendors can take significant time. NIST’s migration work specifically focuses on helping organizations move from quantum-vulnerable algorithms to standardized post-quantum cryptography.
Is post-quantum cryptography the same as quantum encryption?
No. Post-quantum cryptography uses mathematical algorithms designed to resist attacks from quantum computers and can run on conventional computers. Quantum cryptography uses quantum-mechanical phenomena as part of the security mechanism.
Final Thoughts
The move toward post-quantum cryptography represents a major change in how organizations think about long-term digital security.
NIST’s finalized standards provide a practical foundation, while continuing work on additional algorithms such as HQC shows that the standards landscape will keep evolving.
For businesses, the priority is not to predict exactly when a cryptographically relevant quantum computer will arrive. The practical task is to understand current cryptographic dependencies, prioritize sensitive systems and build the flexibility needed to migrate securely.
The organizations that treat cryptographic migration as a long-term infrastructure project will be better positioned to respond as quantum computing and cybersecurity continue to develop.
