Post-quantum cryptography

Post-quantum cryptography (PQC), sometimes referred to as quantum-proof, quantum-safe, or quantum-resistant, is the development of <a href="/facts/Cryptographic_primitive/fy6vq5YM">cryptographic</a> algorithms (usually <a href="/facts/Public-key_cryptosystem/gowoFTxS">public-key</a> algorithms) that are currently thought to be secure against a <a href="/facts/Cryptanalytic_attack/7CPEQlJI">cryptanalytic attack</a> by a <a href="/facts/Quantum_computing/nbbcgmvq">quantum computer</a>. Most widely-used public-key algorithms rely on the difficulty of one of three mathematical problems: the <a href="/facts/Integer_factorization_problem/EjMCTz2t">integer factorization problem</a>, the <a href="/facts/Discrete_logarithm_problem/k8TXh5bL">discrete logarithm problem</a> or the <a href="/facts/Elliptic-curve_discrete_logarithm_problem/YbjcXIWk">elliptic-curve discrete logarithm problem</a>. All of these problems could be easily solved on a sufficiently powerful quantum computer running <a href="/facts/Shor%2527s_algorithm/9JwEtznC">Shor's algorithm</a> or possibly alternatives.
As of 2024, quantum computers lack the <a href="/facts/Processing_power/td1qKox4">processing power</a> to break widely used cryptographic algorithms; however, because of the length of time required for migration to quantum-safe cryptography, cryptographers are already designing new algorithms to prepare for <a href="/facts/Y2Q/dHGSepgu">Y2Q</a> or Q-Day, the day when current algorithms will be vulnerable to quantum computing attacks. <a href="/facts/Mosca%2527s_theorem/aMu3ceFt">Mosca's theorem</a> provides the risk analysis framework that helps organizations identify how quickly they need to start migrating.
Their work has gained attention from academics and industry through the PQCrypto <a href="/facts/Academic_conference/0YAVfxe3">conference</a> series hosted since 2006, several workshops on Quantum Safe Cryptography hosted by the <a href="/facts/ETSI/8rJbbhPg">European Telecommunications Standards Institute</a> (ETSI), and the <a href="/facts/Institute_for_Quantum_Computing/t4VjsQJQ">Institute for Quantum Computing</a>. The rumoured existence of widespread <a href="/facts/Harvest_now%2c_decrypt_later/dHGSepgu">harvest now, decrypt later</a> programs has also been seen as a motivation for the early introduction of post-quantum algorithms, as data recorded now may still remain sensitive many years into the future.
In contrast to the threat quantum computing poses to current public-key algorithms, most current <a href="/facts/Symmetric_cipher/5zfe0b76">symmetric cryptographic algorithms</a> and <a href="/facts/Hash_function/rk6MlCt3">hash functions</a> are considered to be relatively secure against attacks by quantum computers. While the quantum <a href="/facts/Grover%2527s_algorithm/SJuxBPpA">Grover's algorithm</a> does speed up attacks against symmetric ciphers, doubling the key size can effectively counteract these attacks. Thus post-quantum symmetric cryptography does not need to differ significantly from current symmetric cryptography.
In 2024, the U.S. <a href="/facts/National_Institute_of_Standards_and_Technology/gr9Fnh85">National Institute of Standards and Technology</a> (NIST) released final versions of its first three Post-Quantum Cryptography Standards.

Post-quantum cryptography open-in-new

Post-quantum cryptography