The encryption protecting your bank account, medical records, and private messages rests on a mathematical problem that classical computers cannot solve in any practical timeframe: factoring the product of two large prime numbers. RSA-2048, the standard underpinning much of the internet’s security infrastructure, would take a classical computer longer than the age of the universe to crack.
A sufficiently powerful quantum computer running Shor’s algorithm could do it in hours.
That quantum computer does not yet exist. But security experts are not waiting. The threat is not future — it is already operational. Nation-state actors and sophisticated adversaries are harvesting encrypted internet traffic today, storing it in massive data archives with a single intention: decrypt it later, once the quantum hardware exists. Classified diplomatic communications, commercial trade secrets, long-lived personal data — all of it is potentially sitting in someone’s archive right now, waiting.
This is the “harvest now, decrypt later” attack, and it is the reason the world’s cryptographic infrastructure is undergoing the most significant overhaul in the history of the internet.
Why Quantum Computers Break RSA
The security of RSA depends on integer factorisation: given a number N = p × q (where p and q are large primes), finding p and q is computationally hard for classical machines. RSA-2048 uses numbers with 617 decimal digits. The best classical algorithms would require billions of years of computation.
In 1994, mathematician Peter Shor published an algorithm that runs on a quantum computer and factors integers in polynomial time — exponentially faster than any known classical method. For RSA-2048, a fault-tolerant quantum computer with roughly four thousand logical qubits could complete the factorisation in a matter of hours.
The same vulnerability applies to elliptic-curve cryptography (ECC), which secures TLS, SSH, and the vast majority of modern internet connections. Shor’s algorithm breaks it too. The scope is total: every public-key cryptographic system in widespread use today is vulnerable to a sufficiently capable quantum computer. Symmetric encryption such as AES is less affected — Grover’s algorithm halves its effective key length, a problem addressed simply by doubling key sizes — but the public-key layer that underpins authentication and key exchange faces existential threat.
The Threat Is Already Operational
A full-scale quantum cryptographic attack requires hardware that does not yet exist at the required scale. But adversaries do not need a quantum computer today. They need only storage — and storage is cheap.
Intelligence services, nation-state hacking operations, and well-resourced criminal enterprises are capturing and archiving encrypted network traffic right now. Diplomatic cables, financial transactions, medical records transmitted with today’s encryption are all candidates. When — not if — a cryptographically-relevant quantum computer emerges, the archive can be opened retroactively. Any data that must remain secret for ten, twenty, or thirty years is already exposed if it has crossed a compromised network.
This is why security agencies worldwide have been issuing urgent guidance since 2022. The NSA, the UK National Cyber Security Centre, the EU’s ENISA, and equivalent bodies in Australia and Canada have all warned that organisations handling sensitive long-lived data must begin migration planning immediately, regardless of when quantum hardware actually arrives.
NIST’s Six-Year Competition
Recognising that standardising new cryptographic algorithms takes years of public analysis and global consensus, the US National Institute of Standards and Technology launched an open competition in 2016. Sixty-nine candidate algorithms were submitted from research teams in twenty-five countries. After six years of cryptanalysis, performance benchmarking, and public review, NIST published its first finalised post-quantum cryptographic standards in August 2024.
The winning algorithms are built on mathematical problems believed to be hard for both classical and quantum computers — a critical distinction, since the threat model includes adversaries with access to both.
The lattice-based algorithms rely on the Learning With Errors problem: finding a hidden linear structure in a cloud of randomly noisy data. This problem has been studied extensively since the 1990s and no efficient quantum algorithm is known to solve it. SLH-DSA (SPHINCS+) takes a maximally conservative approach: its security reduces entirely to the collision resistance of cryptographic hash functions, which are not threatened by Shor’s algorithm and have resisted decades of cryptanalytic pressure.
The Transition Is Harder Than It Looks
Replacing cryptographic algorithms sounds like a software update. It is not.
Performance overheads are real. Post-quantum public keys and ciphertexts are substantially larger than their classical equivalents. An ML-KEM public key is roughly 1,184 bytes; a comparable ECC P-256 key is 64 bytes. In bandwidth-constrained environments — embedded systems, IoT sensors, satellite uplinks — this overhead is operationally significant.
Legacy systems are ubiquitous. Industrial control systems, medical devices, and critical infrastructure equipment often run on hardware and firmware that cannot be straightforwardly updated. Many have operational lifetimes measured in decades.
Cryptographic agility is now a requirement. The lesson of the past decade’s cryptographic breaks — MD5, SHA-1, early elliptic curves — is that no algorithm can be assumed permanent. Systems must be built to swap cryptographic primitives without architectural overhaul, a property called cryptographic agility that most deployed systems currently lack entirely.
The supply chain multiplies complexity. Every library, framework, hardware security module, and certificate authority in the global public-key infrastructure must be updated in a coordinated sequence. The coordination challenge dwarfs any previous infrastructure migration.
The Migration Timeline
The US government has mandated that federal agencies complete migration to post-quantum standards by 2035. The EU’s ENISA and the UK’s NCSC have issued equivalent frameworks. For organisations whose data carries long confidentiality requirements — healthcare, defence, financial services, critical infrastructure — the effective deadline is considerably earlier. Data harvested in 2024 may be decrypted in 2032.
What Responsible Organisations Are Doing Now
The practical first steps do not require waiting for full post-quantum deployment.
Begin a cryptographic inventory — cataloguing every system, protocol, certificate, and library that uses public-key cryptography. You cannot migrate what you have not mapped. This inventory exercise alone typically reveals legacy dependencies and shadow IT that security teams did not know existed.
Deploy hybrid key exchange immediately for high-value connections. Combining ECDH with ML-KEM in parallel means that if the post-quantum component is later broken, classical security holds; if a quantum computer threatens the classical component, the PQC layer protects. Hybrid TLS is already supported in major browsers and is the recommended transition architecture.
Engage vendors and cloud providers on their PQC roadmaps. Hardware security modules, certificate authorities, and platform providers all operate on different timelines. Organisations that surface these dependencies now avoid supply chain surprises at migration time.
Build cryptographic agility into every new system. Any software written today should treat cryptographic primitives as configurable parameters, not hardcoded constants. The standards finalised in 2024 will not be the last ones needed.
The Long View
Post-quantum cryptography is not the final answer. It is the next answer. History strongly implies that the algorithms standardised today will eventually be superseded — through improved cryptanalysis, new mathematical insights, or computational advances not yet imagined. What changes with each transition is not the requirement for cryptographic security, but the mathematics on which it rests.
The organisations that navigate this transition most successfully will not just be the ones that deploy ML-KEM on schedule. They will be the ones that built systems capable of absorbing the transition that comes after, and the one after that. In modern cryptography, agility is not an engineering feature. It is a survival trait.
Sources & Further Reading
- Post-Quantum Cryptography Standards (FIPS 203, 204, 205). NIST Post-Quantum Cryptography Project (2024)
- Cybersecurity in an Era with Quantum Computers: Will We Be Ready?. IEEE Security & Privacy 16(5); IACR ePrint 2015/1075 (2018)
- Announcing the Commercial National Security Algorithm Suite 2.0 (CNSA 2.0). NSA Cybersecurity Advisory (2022)
Discussion