Go further · Chapter 13 · 13b · A step deeper
What is post-quantum cryptography, and when must we switch?
The short answer (tap to open)
Post-quantum cryptography is new public-key maths that quantum computers can't break, as far as anyone knows. It runs on ordinary devices. NIST published the first standards in 2024, mostly built on hard problems in many-dimensional grids called lattices. The UK's NCSC wants organisations to plan by 2028, move their most important systems by 2031, and finish by 2035.
What hard problems does it use?
Last checked: 2 October 2026.
RSA hides a pattern Shor's algorithm can find (page 13a). The new schemes use problems with no such pattern:
- Lattices (ML-KEM and ML-DSA): picture a vast grid of points in hundreds of dimensions, then a target point nudged slightly off the grid by random noise. Finding the nearest grid point is easy in two dimensions and, as far as anyone knows, hopeless in hundreds, for ordinary and quantum computers alike.
- Hash functions (SLH-DSA): signatures built only from one-way scrambling functions that already protect passwords. Slower and bigger, but resting on very well-tested ground.
- Error-correcting codes (HQC, the backup chosen in 2025): a message hidden under deliberate errors that only the key holder can strip away.
Tap the grid point nearest the target.
Points to check: 9
At a billion checks a second: instantly
Illustrative: about three nearby points to check in each dimension, multiplied together.
Search times by dimension, in a table
| Dimensions | At a billion checks a second |
|---|---|
| 2 | instantly |
| 3 | instantly |
| 10 | instantly |
| 100 | longer than the age of the universe |
| 500 | longer than the age of the universe |
Illustrative: about three nearby points to check in each dimension, multiplied together.
Easy to set, hard to solve: the same idea as RSA, with no hidden pattern for Shor's algorithm.
What did NIST publish?
- August 2024: FIPS 203 (ML-KEM, for agreeing keys), FIPS 204 (ML-DSA, signatures) and FIPS 205 (SLH-DSA, hash-based signatures).
- March 2025: HQC chosen as a backup for agreeing keys, on different maths. NIST said in 2025 it expects a final standard in 2027.
- Draft guidance: NIST proposes treating today's RSA and elliptic-curve keys as deprecated after 2030 and disallowed after 2035. That document is still a draft.
Why mix old and new?
The new schemes are younger, and young maths can fail. In 2022 two researchers broke SIKE, a late-stage candidate in the competition, in about an hour on one ordinary computer. So most systems today run a hybrid: they combine an old key exchange with a new one, and stay safe if either holds. Chrome, Firefox, Apple's systems and Cloudflare all use hybrids.
The new keys are also bigger. The ML-KEM key most systems use is over a thousand bytes, against 32 for today's common elliptic-curve key. That's fine for websites, and harder for tiny devices and smart cards.
What are the deadlines?
| Who | Plan or start | Most important systems | Finish |
|---|---|---|---|
| UK, NCSC (2025, reviewed Aug 2026) | 2028: find what you use, plan the switch | 2031 | 2035 |
| EU roadmap (Jun 2025) | End of 2026: national plans, first steps | 2030: high-risk uses | 2035, as far as feasible |
| US, Executive Order 14412 (Jun 2026) | 2027: NIST pilot | 2030: key exchange in federal high-value systems | 2031: signatures |
What does switching involve?
For most people: keep your browser, phone and apps updated, and the switch happens for you. For organisations it's a long job: list every place they use public-key cryptography, from websites to payment terminals to building badges; ask suppliers for their plans; and build systems that can swap algorithms easily next time (crypto-agility). That's why the deadlines run to 2035.
Check
Two quick ones
Collect
Your aha card
New maths for an old job.
Lattices replace factoring, hybrids hedge the bet, and the deadlines run to 2035.