Post-quantum cryptography

In short: A sufficiently large quantum computer could break RSA and elliptic curves. Post-quantum methods are new algorithms considered secure even against quantum attacks.

In more detail: Shor’s algorithm factors large numbers and solves discrete logarithms efficiently, which threatens RSA, DH and ECC. Symmetric methods (AES) and hashes are hardly affected; you just double the key length (AES-256). NIST has standardised lattice-based methods (ML-KEM, ML-DSA) and hash-based signatures.

In Depth

• “Harvest now, decrypt later”: Attackers store encrypted data today to break it later.
• ML-KEM (Kyber): Key exchange, lattice-based.
• ML-DSA (Dilithium), SLH-DSA (SPHINCS+): Signatures.
• Hybrid methods: Classical plus post-quantum so a flaw in one does not destroy everything.
• Larger keys/signatures: More data, affects protocols.
• Crypto agility: Keep methods replaceable.
• Timeline: Plan the migration even though quantum computers are not there yet.

See also: Elliptic curves and digital signatures, Diffie-Hellman and forward secrecy