Post-Quantum Cryptography: Why the Real Challenge Is Migration

Editorial image generated by the author.

Quantum computers are often described as machines that will eventually break encryption. The more precise threat is narrower and, in some ways, more consequential. Shor’s algorithm threatens RSA, Diffie-Hellman and elliptic-curve cryptography, while much of the symmetric encryption protecting the actual contents of our communications remains far more resilient. The first post-quantum replacements are already standardised and beginning to be deployed; the difficult part is replacing the old systems everywhere they have become infrastructure.

That changes the nature of the quantum-security problem. It is not primarily a race to invent new encryption after quantum computers arrive. It is a migration that has to begin before anyone knows exactly when a cryptanalytically relevant quantum computer will exist.

What Quantum Computers Actually Break

Modern public-key cryptography frequently exploits mathematical operations that are easy to perform in one direction and extremely difficult to reverse. Take two enormous prime numbers and multiply them together and a computer can produce the result quickly. Give a conventional computer only the result and ask it to recover the original primes, and the problem becomes much harder as the numbers grow. RSA turns that asymmetry into a cryptographic tool. Elliptic-curve cryptography uses different mathematics but follows a similar principle: legitimate operations are computationally manageable while reversing them without the secret information is prohibitively expensive.

The security has never come from these calculations being mathematically impossible. It comes from an assumption about computational difficulty: an attacker cannot perform the necessary work within a useful amount of time. In 1994, Peter Shor developed a quantum algorithm capable of efficiently solving integer factorisation and discrete logarithm problems on a sufficiently capable quantum computer. Those are precisely the kinds of problems underneath RSA, traditional Diffie-Hellman and elliptic-curve cryptography.

This is more serious than simply making ordinary computation faster. If a classical attack becomes ten or a thousand times faster, increasing the size of a key may restore an adequate safety margin. Shor attacks the structure on which the system depends. Making an RSA key larger does not repair the underlying problem once an attacker can run the algorithm at the necessary scale.

Today’s quantum computers cannot do this against useful cryptographic keys. A successful attack would require a large fault-tolerant machine capable of maintaining enough reliable logical qubits and performing an enormous number of quantum operations. The important threshold is therefore not when quantum computers become commercially useful for chemistry, materials science or other specialised tasks. It is the arrival of what NIST calls a cryptanalytically relevant quantum computer, or CRQC. Nobody knows exactly when such a machine will exist, which makes guessing the date a poor foundation for security planning.

What Survives a Quantum Attack

The popular claim that quantum computers will “break encryption” becomes misleading once symmetric cryptography enters the picture. AES does not depend on factoring or discrete logarithms, so Shor’s algorithm offers no comparable shortcut. The relevant quantum algorithm is Grover’s algorithm, which can accelerate an exhaustive search through possible keys. In an idealised treatment, searching a space of 2ⁿ possibilities can be reduced to something on the order of 2^n/2 quantum operations.

This is why AES-256 is sometimes described as offering roughly 128 bits of security against an idealised quantum brute-force attack. The practical picture is less dramatic. Grover requires a vast sequence of quantum operations, is difficult to parallelise in the same way as classical brute force, and would itself have to operate on fault-tolerant hardware. NIST currently concludes that Grover is likely to provide little or no practical advantage against AES and sees no quantum-driven reason to migrate away from AES-128, AES-192 or AES-256.

Public-key cryptography and symmetric encryption also usually perform different jobs. When a browser establishes a secure connection to a website, public-key techniques help authenticate the participants and establish a shared secret. Fast symmetric encryption then protects the bulk of the data travelling between them. Quantum computing therefore attacks some of the machinery used to establish trust and exchange secrets far more severely than it attacks the encryption subsequently protecting the data.

At the theoretical extreme, even unlimited computation does not abolish secrecy. A properly implemented one-time pad is information-theoretically secure; its problem has always been the need to distribute a truly random secret key as long as the message itself. Quantum computing changes which computational shortcuts are available to an attacker. It does not repeal information theory.

The Replacement Is Already Being Deployed

Post-quantum cryptography does not normally mean encrypting information with quantum computers. It means using ordinary computers with cryptographic systems based on mathematical problems for which no sufficiently efficient quantum attack is known.

After an international evaluation process beginning in 2016, NIST finalised its first three post-quantum standards in August 2024. ML-KEM provides a mechanism for key establishment, while ML-DSA and SLH-DSA provide digital signatures. ML-KEM and ML-DSA rely on hard problems involving structured lattices and noisy mathematical relations; SLH-DSA takes a substantially different route and constructs signatures around cryptographic hash functions.

NIST has also selected HQC for standardisation as an additional key-establishment mechanism, although that standardisation process is still underway. HQC is based on error-correcting codes rather than the lattice constructions behind ML-KEM. The point of maintaining different families is not simply to accumulate algorithms. It reduces the chance that one unexpected mathematical breakthrough compromises the entire replacement architecture.

Diversification has costs: every additional algorithm means more implementations to test, more code to maintain and more opportunities for mistakes. An entire global transition built on a single mathematical family, however, would create a different and potentially more dangerous concentration of risk.

There is already evidence of what practical migration looks like. In September 2026, Cloudflare reported that post-quantum TLS 1.3 traffic across the origins in its currently scanned cohort had grown to roughly 45 billion connections per day. Its Automatic Key Exchange system probes origins to discover which key-agreement methods they actually support and, where possible, prefers the hybrid X25519MLKEM768 exchange automatically.

The significance is not that Cloudflare’s network represents the whole internet. It is that the example exposes the migration problem in miniature. A new cryptographic algorithm has to coexist with old servers, libraries, middleboxes and configurations that upgrade on different schedules. Cloudflare’s solution is not simply “use ML-KEM”; it discovers what each origin supports, checks whether the network path can handle the larger exchange, selects the strongest compatible option and falls back rather than breaking the connection. Post-quantum cryptography has already moved from a mathematical problem into an operational one.

The same standardisation process also shows why quantum-resistant should not be confused with permanently safe. There is no proof that future quantum computers can never break the algorithms being standardised today. What cryptographers can say is that no sufficiently efficient classical or quantum attack is currently known against their underlying problems at the parameters being deployed. RSA itself survived for decades not because efficient factorisation had been proved impossible, but because repeated attempts failed to find a practical attack against properly chosen keys on classical machines.

The value of prolonged scrutiny became unusually visible in 2026. HAWK, a lattice-based digital-signature proposal under consideration by NIST, was found to contain a mathematical vulnerability after Anthropic used an AI model to analyse it. The development team subsequently withdrew HAWK. NIST states that the weakness does not affect its finalised ML-KEM or ML-DSA standards, which use different constructions.

The HAWK episode is therefore not merely evidence that post-quantum cryptography can fail. It is evidence for why candidate algorithms are attacked for years before infrastructure is rebuilt around them. The weakness was found before HAWK became a standard and before billions of systems depended on it. The sensible objective is not to discover mathematics that will remain safe forever, but to avoid constructing another technological world in which replacing the mathematics becomes prohibitively difficult.

The Deadline Comes Before the Quantum Computer

The absence of a cryptanalytically relevant quantum computer today does not mean the confidentiality problem begins when one is finally built. An intelligence service or criminal organisation can intercept encrypted information without being able to read it and simply store the ciphertext. If sufficiently powerful quantum computers arrive fifteen years later, information collected today can be attacked then. This strategy is usually called harvest now, decrypt later.

The relevant migration deadline can therefore be thought of roughly as:

time until quantum decryption becomes possible
minus migration time
minus the period the information must remain secret.

A system generating information that must remain confidential for twenty years may already have a quantum problem even if the dangerous machine itself remains a decade or more away. That is why official transition schedules do not wait for “Q-Day.” Under NIST’s current transition timeline, quantum-vulnerable algorithms are to be deprecated and ultimately removed from its standards by 2035, with high-risk systems expected to move earlier. Lower-strength legacy schemes are already on a path towards deprecation after 2030.

The dates may change as technology and implementation experience develop. Their significance lies less in predicting when a quantum computer will arrive than in acknowledging how long infrastructure takes to replace. The transition clock and the attack clock are not the same clock.

Replacing Mathematics Is Easier Than Replacing Infrastructure

On paper, the migration can look almost trivial. Replace a vulnerable key exchange with ML-KEM. Replace RSA or elliptic-curve signatures with a post-quantum signature. Keep strong symmetric encryption for the actual data. That description assumes a blank sheet of paper.

Civilisation does not run on a new software project.

Public-key cryptography is embedded in browsers, operating systems, banking systems, payment networks, telecom infrastructure, identity systems, government networks, cloud services, industrial equipment, software-update mechanisms, certificates, hardware security modules and countless embedded devices. Some systems update every few weeks. Others were installed decades ago and are expected to remain operational for decades more.

A browser can receive a new cryptographic library through an automatic update. An industrial controller buried inside a production system is different. So is a satellite already in orbit, an identity programme with millions of issued credentials, a vehicle expected to remain on the road for fifteen years, or a payment system whose participants cannot all change protocols on the same afternoon. Once a technology is embedded in surrounding systems, replacement cost increasingly lies in everything that has adapted around it.

Post-quantum algorithms also behave differently from the systems they replace. Public keys, ciphertexts or signatures can be larger. Network protocols designed around existing packet sizes may encounter old hardware that reacts badly to larger exchanges, while small devices may have limited memory or processing capacity. Every compatibility problem creates another reason to operate old and new cryptography in parallel for a while, which makes the transition more complicated.

Before anything can be replaced, organisations also have to find it. A large company may use RSA or elliptic curves inside thousands of applications, appliances, certificates, vendor products, APIs and pieces of embedded hardware. Some dependencies will be documented; others will have disappeared into systems nobody has touched for years. NIST’s migration work consequently puts substantial emphasis on cryptographic inventories, discovery and interoperability, not merely on choosing replacement algorithms.

The difficult part of post-quantum cryptography may therefore turn out not to be cryptography itself. It is knowing what depends on it, deciding what must move first, and changing it without breaking the systems that still have to work tomorrow morning.

Encryption Is Only Half the Problem

The language of “breaking encryption” obscures another part of the threat. Public-key cryptography is used not only to keep information secret but to establish authenticity. Digital signatures allow a computer to verify that software really came from its publisher, that a certificate really belongs to a bank, or that a financial transaction was authorised by the holder of a private key. RSA and elliptic-curve signatures are exposed to the same underlying quantum threat as vulnerable key exchange.

This can be more dangerous than reading an old message. If an attacker can recover a signing key, the problem becomes the ability to create convincing new messages, certificates or transactions that appear to come from someone else. Software distribution makes the stakes obvious: the digital signature on an operating-system update is part of what allows the machine to distinguish legitimate software from code supplied by an attacker. Compromising that trust mechanism offers something more useful than passive eavesdropping—the ability to impersonate a trusted party.

Cryptocurrencies expose the same issue in a particularly unforgiving form. Bitcoin is not secured primarily by hiding the contents of its blockchain; ownership depends on cryptographic signatures. For Bitcoin outputs whose public keys are exposed, a sufficiently capable quantum attacker could in principle derive the corresponding private key and forge a valid spend. Post-quantum signature systems provide a route away from that vulnerability, but only if assets and protocols can be migrated before the old signatures become unsafe.

The mathematics provides an answer. Coordination is harder.

Cryptographic Agility Is the More Durable Lesson

Fault-tolerant quantum computing may develop more slowly than its advocates expect, or progress may accelerate unexpectedly. Security planning cannot depend on correctly forecasting which year a machine capable of running a practical Shor attack will arrive. What can be controlled is the architecture built around that uncertainty.

The quantum transition exposes a weakness in the way technological systems are often constructed. We choose an algorithm because it is secure today, embed it deeply into software and hardware, allow other systems to organise themselves around it, and gradually turn a mathematical assumption into infrastructure. Twenty years later, replacing the assumption can require changing half the surrounding world.

Cryptographic agility is an attempt to make the next transition less painful. Algorithms should be identifiable and replaceable. Protocols should not assume one cryptographic primitive will survive forever. Organisations should know where cryptography is used, and systems expected to last for decades should be designed with the possibility that their original algorithms will not.

Quantum computing may force us to change the locks. The more important engineering lesson is to stop building doors whose locks cannot readily be changed.

A sufficiently powerful quantum computer may eventually force the largest cryptographic migration the digital world has experienced. Yet we do not need to wait for that machine to discover the solution, and in some parts of the internet the replacement has already begun.

The uncomfortable part is that knowing how to replace the mathematics may turn out to have been the easy bit.