Post‑Quantum Cryptography: Threats, Algorithms & Migration

Quantum computers that can break today’s encryption do not exist yet. The largest error‑corrected machines hover around 50 qubits, and estimates place a truly powerful device many decades away. Even so, the “harvest now, decrypt later” approach encourages attackers to capture encrypted traffic today and store it for future decryption once quantum hardware matures. This forward‑looking threat motivates the search for quantum‑resistant security long before the hardware arrives.

Algorithmic Impacts

Grover’s algorithm gives a quadratic speedup for unstructured search, effectively halving the bit‑security of symmetric keys. Under Grover, AES‑128 drops to an effective 2^64 security level, while AES‑256 retains about 2^128. The simple fix is to adopt larger symmetric keys, such as AES‑256, to preserve a comfortable margin.

Shor’s algorithm, by contrast, solves integer factorization and discrete logarithms in polynomial time. A successful run would dismantle RSA, Diffie‑Hellman, and elliptic‑curve cryptography. Estimates suggest roughly 4,000 qubits are needed for Shor to break a typical RSA key, a far cry from today’s 50‑qubit machines but a clear target for future development.

Transitioning to Post‑Quantum

Since 2016, NIST has run a competition to standardize quantum‑resistant algorithms. The process has already eliminated vulnerable candidates; for example, the SIKE (Super‑singular Isogeny Key Exchange) scheme was broken in 2022. Modern TLS implementations now often employ hybrid key exchanges, pairing a classic elliptic‑curve method like X25519 with a post‑quantum scheme such as Kyber (ML‑KEM 768). This dual approach lets existing infrastructure continue to work while adding a lattice‑based layer that relies on the hardness of finding the nearest point in a high‑dimensional grid.

Hash‑based signature schemes also earn a place in the post‑quantum toolbox because they depend only on the one‑way nature of hash functions, a property that remains solid against quantum attacks. Together, lattice‑based key encapsulation and hash‑based signatures form a practical migration path for securing data well into the quantum era.

Sponsor Note

The conversation is brought to you by Jane Street, a trading firm that supports research into future‑proof cryptography. Their involvement underscores the industry‑wide recognition that preparing for quantum threats is not a speculative exercise but a prudent risk‑management strategy.