What Is Post-Quantum Cryptography and Why It Matters

When talking about cybersecurity, we often think first of visible actions: typing a password, receiving a verification code, opening a secure web page, or approving a banking transaction. A much larger part of security, however, happens before the user sees anything. Each time two systems communicate over the Internet, cryptographic mechanisms are used to protect confidentiality, verify identities, and make sure that the information has not been modified along the way.

For this reason, cryptography can be considered one of the quiet infrastructures of digital life. It is rarely noticed when it works correctly, but a very large number of services depend on it: electronic payments, cloud platforms, software updates, digital signatures, health records, satellite links, and industrial systems.

During the last decades, this infrastructure has relied heavily on public-key cryptography, in particular on schemes such as RSA and elliptic-curve cryptography. These techniques were designed for a world of classical computers. They are considered secure today because the mathematical problems behind them would require an unrealistic amount of time to solve with conventional computers, provided that appropriate key sizes are used.

Quantum computing changes this assumption.

What post-quantum cryptography means

Post-quantum cryptography, usually abbreviated as PQC, studies cryptographic algorithms that can run on ordinary computers but are designed to resist attacks performed with both classical and quantum computers.

At this point, it is useful to distinguish two ideas that are sometimes confused. The word “quantum” may suggest that new quantum devices are needed everywhere, but this is not the case for post-quantum cryptography. In a PQC migration, the computers and networks remain classical but we change the cryptographic algorithms used inside them. The aim is to replace, or in some cases to combine, today’s vulnerable public-key schemes with alternatives whose security is based on mathematical problems for which no efficient quantum attack is currently known.

In other words, PQC is not about making every computer quantum. It is about preparing classical digital systems for a future in which attackers may have quantum capabilities.

Why quantum computers are a problem for current public-key cryptography

Public-key cryptography works because of a useful asymmetry. Some operations are easy to perform if one has the correct information, but extremely difficult to reverse without a secret key. In RSA, this difficulty is related to factoring very large numbers. In elliptic-curve cryptography, it is related to the discrete logarithm problem on elliptic curves.

These problems are not impossible in an absolute sense. Their security comes from the fact that classical computers cannot solve them in a feasible amount of time with the key sizes used in real systems.

The situation is different if a sufficiently large and fault-tolerant quantum computer becomes available. The key observation, known since Peter Shor’s work published in 1994, is that quantum computers can solve exactly these classes of problems much more efficiently than classical computers. Therefore, the quantum threat is not a generic fear that “future computers will be faster”. It is a precise weakness in the mathematical foundations of many public-key systems that are used today for secure web connections, VPNs, digital signatures, secure email, authentication, and software distribution. NIST similarly frames the problem as a future quantum threat to many widely used cryptographic systems.

Symmetric encryption and hash functions are affected in a different way and can usually be adapted by choosing stronger parameters. The more delicate issue is public-key cryptography, because it is the part that allows unknown parties to establish trust over an open network.

Why the transition cannot wait for “Q-Day”

At first sight, post-quantum cryptography may seem to be a problem for the future. Cryptographically Relevant Quantum Computers (CRQC) are not publicly available today, and nobody can give an exact date for their arrival. However, this is not the right way to measure the risk.

The first reason is practical. Cryptographic transitions are slow. Algorithms must be standardised, implemented in libraries, integrated into protocols, tested in products, certified where necessary, and finally deployed across infrastructures that often contain old software and hardware. NIST released its first three final post-quantum cryptographic standards in 2024: ML-KEM for key establishment, ML-DSA for digital signatures, and SLH-DSA as a hash-based signature scheme. NIST also recommends that organisations start preparing their migration now, because products, services, and protocols will need updates.

The second reason is even more uncomfortable: encrypted data can be stored. An attacker does not need to decrypt a sensitive communication immediately in order to benefit from it later. It may be sufficient to collect the encrypted traffic now, archive it, and wait until better decryption capabilities become available.

Not all data has the same lifetime. A temporary access code or a meeting link may lose value very quickly. On the contrary, medical records, genomic information, diplomatic communications, intellectual property, financial investigations, and critical infrastructure data can remain sensitive for many years. Some information, once exposed, cannot be changed like a password.

As discussed in our previous blog post The Quantum Time Bomb: Understanding the “Harvest Now, Decrypt Later” Cyber Threat, the risk begins when the data is transmitted, not only when the quantum computer is finally built. Its urgency can be summarised through Mosca’s inequality. Let Y be the time needed to complete the migration to quantum-resistant cryptography, Z the estimated time until a CRQC becomes available, and X the confidentiality lifetime of the last data protected with quantum-vulnerable cryptography before the migration is completed. If X + Y > Z, the required confidentiality period extends beyond Q-Day: data collected before the migration is completed could later be decrypted, creating a security gap (Figure 1).

Figure 1. Mosca’s inequality and the HNDL risk. During the migration period (Y), some data may still be protected by quantum-vulnerable cryptography. If the last such data must remain confidential for X years, but a CRQC may arrive within Z years, then X + Y > Z indicates that the migration is already urgent.

From algorithms to real systems

The publication of post-quantum standards is an important step, but it is not the end of the work. In real infrastructures, cryptography is not an isolated mathematical object. It is embedded in protocols, software libraries, certificates, devices, update mechanisms, authentication systems, cloud platforms, and operational procedures.

For this reason, a post-quantum migration should start with a very concrete question: where is cryptography used in the system? Without this inventory, it is difficult to know which services rely on RSA, elliptic-curve key exchange, or vulnerable signature schemes. It is also difficult to decide which parts should be migrated first.

A useful concept here is crypto-agility. A crypto-agile system is designed so that cryptographic algorithms can be replaced or upgraded without redesigning the whole application. This is important because the transition to PQC will not happen in a single step. Some systems will use hybrid solutions for a certain period, combining classical and post-quantum mechanisms. Others will require longer testing because they operate under strict constraints, as in IoT devices, embedded systems, satellites, or industrial platforms.

In this sense, the post-quantum transition is not only a cryptographic problem. It is also an engineering problem, an interoperability problem, and a governance problem. A secure algorithm is necessary, but it is not sufficient if it cannot be deployed correctly in the systems that need it.

The role of Q-FENCE

This is the type of challenge that Q-FENCE addresses. The project does not consider PQC only as a theoretical replacement of one algorithm with another. It also examines how quantum-resistant mechanisms can be introduced into existing digital infrastructures while remaining compatible with the technologies already in use.

For this purpose, Q-FENCE is developing a dual-layer cryptographic framework for critical European sectors. The project integrates classical cryptography with post-quantum and quantum techniques. In particular, the solutions considered include Ring-LWE and Module-LWE schemes, Quantum Random Number Generators, hardware-accelerated cryptographic primitives, and protocols designed to limit energy consumption. Its validation activities involve sectors such as finance, healthcare, IoT, satellite networks, and digital infrastructures.

This practical orientation is important. Banks, hospitals, smart-city platforms, enterprise networks, and satellite systems cannot simply stop operating while their cryptographic foundations are redesigned. For these systems, the transition has to be gradual. Legacy components will remain in use for some time, and new mechanisms must be introduced without interrupting essential services.

This is one of the reasons why the Q-FENCE approach is interesting. By considering classical and post-quantum mechanisms together, the project follows a realistic migration path rather than assuming an immediate replacement of existing infrastructures. In this perspective, the dual-layer framework is not only a security choice, but also a way to make the transition manageable for sectors where continuity of service is a strict requirement.

A necessary maintenance of digital trust

PQC should not be understood as a panic reaction to a distant technological event. It is better seen as a necessary maintenance operation on digital trust.

The Internet and modern digital services were built over many years, and their security mechanisms cannot be replaced overnight. The transition will require standards, implementation work, testing, coordination among vendors, and awareness among organisations that manage long-lived sensitive data.

The encouraging element is that this transition is no longer only theoretical. The first standards are available, the main risks are clearer than a few years ago, and projects such as Q-FENCE are addressing the practical question of how these techniques can be introduced into real systems.

Starting early does not mean assuming that today’s cryptography will fail tomorrow. It means taking seriously the fact that some data exchanged today will still be sensitive in ten, twenty, or even thirty years. For this type of information, waiting until the threat becomes immediate would already be too late.

In cybersecurity, the best moment to strengthen the foundations is not after the storm reaches the building. It is while the structure is still standing, the lights are still on, and there is still time to do the work properly.