What is post quantum era why it changes security landscapes

[QubitKnight]

TL;DR

• The post quantum era is the period in which we plan, build and run security on the assumption that large fault tolerant quantum computers will eventually exist
• Shor's algorithm (1994) would break RSA, Diffie-Hellman and elliptic curve cryptography on such a machine, while symmetric ciphers like AES-256 stay strong
• NIST published the first three post quantum standards on 13 August 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA)
• The real risk today is harvest now, decrypt later, where encrypted traffic is stored now and opened years from now
• Migration is already happening in browsers, SSH, messaging apps and crypto libraries, which is very good news for everyone
• The winning strategy is inventory, prioritise, adopt hybrids, and build crypto agility so the next change is easier than this one

Why this topic deserves a long read

Every few years the security world faces a shift that changes the rules for everyone at once. The move from plain HTTP to HTTPS was one of those moments, and so was the slow retirement of SHA-1 and old versions of TLS. The post quantum transition belongs in that same family, but it is larger, slower and more interesting than any of them. It touches every system that uses public key cryptography, which in practice means almost every system that talks to anything else

This article is written for the Qday.forum community as a reference you can return to, quote and argue with. I have tried to keep claims anchored to named standards, dates and published results so that anyone citing it can trace the original source. Where something is still an estimate or a roadmap, I say so plainly. The aim is to leave you more confident and less anxious, because the story here is mostly one of good planning and steady progress

Defining the post quantum era

The phrase post quantum does not mean that quantum computers have already broken everything. It describes the era in which we design security assuming that a cryptographically relevant quantum computer, often shortened to CRQC, will one day be built. That machine would need enough high quality, error corrected qubits to run Shor's algorithm against real key sizes. Nobody has one today, and credible estimates still place it years away

A helpful way to think about it is that we are living in the planning window. The threat has a name, the mathematics is well understood, and the replacement tools are standardised. What remains is the long, practical job of swapping the cryptography inside billions of devices, certificates, protocols and contracts. That job is the post quantum era, and we are well into its early chapters

The term Q-Day is the community's shorthand for the moment a CRQC becomes available to someone who wants to use it against classical public key systems. It is a useful rallying point, and it gives this forum its name. Still, it is worth remembering that Q-Day may not be a single dramatic headline. It could arrive quietly inside a well funded lab long before anyone announces it publicly, which is exactly why preparation cannot wait for a press release

What quantum computers break and what they do not

Shor's algorithm, published by Peter Shor in 1994, solves integer factoring and discrete logarithms efficiently on a quantum computer. Those two problems are the foundation of RSA, classic Diffie-Hellman and elliptic curve schemes such as ECDH and ECDSA. If a large enough machine runs Shor's algorithm, the private keys behind those systems can be recovered from public information. That is the core reason the security landscape changes

Symmetric cryptography is a much calmer story. Grover's algorithm, published by Lov Grover in 1996, offers at best a quadratic speedup for brute force search. In practice that means a 256 bit key keeps a very comfortable margin, which is why guidance from bodies such as NIST and the UK NCSC treats AES-256 and SHA-256 or SHA-384 as fine for the long term. Grover also parallelises poorly, so the real world impact is smaller than the headline maths suggests

This split matters a great deal for planning. Your bulk data encryption, disk encryption and message authentication are not the emergency. The pressure point is key establishment and digital signatures, the handshake moments where two parties agree on secrets or prove who they are. Fix those, and most of the post quantum risk is addressed

Harvest now, decrypt later

The most important idea for anyone new to this field is harvest now, decrypt later. An adversary with access to network traffic can record encrypted sessions today and simply store them. Storage is cheap and patient. If that traffic was protected by classical key exchange, a future CRQC could recover the session keys and read everything

This is why the post quantum era has already started for data with a long shelf life. Medical records, state secrets, intellectual property, legal files and personal identity data can stay sensitive for decades. If those secrets travel across a network today under RSA or elliptic curve key exchange, their protection has an expiry date that nobody can see. Moving key exchange to post quantum algorithms is the fix, and it is the reason browsers moved first

Signatures face a different timeline. A forged signature only matters once the attacker can forge it, so there is no harvest now risk for authentication in the same way. However, signatures live inside long lived systems such as firmware roots of trust, smart cards, vehicles and industrial controllers. Some of those devices will still be in service when a CRQC appears, so their signature schemes need planning now even if the attack comes later

Mosca's inequality, the planning formula everyone quotes

Michele Mosca, a researcher at the University of Waterloo, popularised a simple way to reason about urgency. Let X be how long your data must stay secret, let Y be how long it will take you to migrate, and let Z be how long until a CRQC exists. If X plus Y is greater than Z, you already have a problem. The beauty of the formula is that it turns an abstract fear into a planning conversation

Most organisations underestimate Y. Migration is not just changing a line in a configuration file. It involves finding every place cryptography is used, updating libraries, testing interoperability, renewing certificates, replacing hardware security modules and sometimes renegotiating vendor contracts. Large enterprises that have done cryptographic inventories often report that the discovery work alone took longer than expected

The standards that define the era

The single biggest milestone so far came on 13 August 2024, when NIST published three Federal Information Processing Standards. FIPS 203 specifies ML-KEM, a key encapsulation mechanism derived from CRYSTALS-Kyber. FIPS 204 specifies ML-DSA, a lattice based signature scheme derived from CRYSTALS-Dilithium. FIPS 205 specifies SLH-DSA, a stateless hash based signature scheme derived from SPHINCS+

Those three standards were the result of a public competition that NIST launched in 2016. Teams from around the world submitted candidates, and cryptographers spent years attacking them in the open. Some candidates fell along the way, which is exactly how the process is supposed to work. The survivors earned their place through scrutiny rather than marketing

The work did not stop in 2024. On 11 March 2025, NIST selected HQC, a code based key encapsulation mechanism, as a backup to ML-KEM, with a draft standard expected in 2026 and a final standard expected around 2027. A further signature standard based on FALCON, to be called FN-DSA in FIPS 206, has also been in development. The idea is diversity, so that if one mathematical family ever shows weakness, a well tested alternative is ready

Timelines for retiring classical algorithms are also taking shape. NIST's draft report IR 8547, released in November 2024, proposed deprecating quantum vulnerable algorithms at the 112 bit security level after 2030 and disallowing them after 2035. In the UK, the NCSC published migration milestones in March 2025 that point to discovery and planning by 2028, priority migration by 2031 and completion by 2035. These dates give organisations something concrete to plan against, which is a big improvement on vague warnings

How the security landscape is already shifting

The encouraging part is how much has moved already. Google Chrome enabled the hybrid X25519MLKEM768 key exchange by default in late 2024, and other major browsers and content delivery networks followed. Cloudflare has published data showing a large and rising share of the human web traffic it serves now uses post quantum key agreement. For millions of ordinary users, the first step of the transition happened silently in a browser update

Open source infrastructure has kept pace. OpenSSH 10.0, released in April 2025, made a hybrid ML-KEM key exchange its default. OpenSSL 3.5, also released in April 2025, added ML-KEM, ML-DSA and SLH-DSA. Messaging has moved too, with Signal adding the PQXDH protocol in 2023 and Apple introducing PQ3 for iMessage in 2024. These are the building blocks that everyone else depends on

Hybrids deserve a special mention because they explain how the industry is managing risk. A hybrid key exchange combines a classical algorithm such as X25519 with a post quantum one such as ML-KEM. An attacker would need to break both to recover the secret. That approach protects against a future quantum computer and against the possibility that a newer algorithm hides an undiscovered flaw, which is a very sensible belt and braces design

New trade offs: size, speed and plumbing

Post quantum algorithms are not drop in replacements in every sense. An ML-KEM-768 public key is 1,184 bytes, compared with 32 bytes for an X25519 key. An ML-DSA-65 signature is 3,309 bytes, while an ECDSA P-256 signature is around 64 bytes. These sizes ripple through network packets, certificate chains, embedded devices with tight memory and protocols that assumed small messages

Speed is often better than people expect. ML-KEM is fast, frequently comparable to or quicker than classical elliptic curve operations on modern hardware. The harder engineering problems tend to be bandwidth, legacy middleboxes that choke on larger handshakes, and constrained hardware such as smart cards. Those are solvable problems, and the first wave of deployments has already ironed out many of them

Crypto agility, the lasting lesson

If the post quantum era teaches one durable lesson, it is crypto agility. Systems that hard coded a single algorithm are now expensive to fix, while systems designed to swap algorithms through configuration are adapting quickly. Agility means abstraction layers in code, an accurate inventory of where cryptography lives, and processes for rotating keys and certificates without drama. It is good engineering whether or not quantum computers arrive on schedule

A cryptographic bill of materials, often called a CBOM, is becoming a practical tool for this. The CycloneDX 1.6 specification added support for describing cryptographic assets, which lets teams track algorithms, key sizes and libraries the same way they track software dependencies. Once you can see your cryptography, you can manage it. Visibility turns a frightening unknown into a list of tasks

A balanced view of the timeline

Estimates for when a CRQC might exist keep moving, and in recent years they have generally moved closer. In May 2025, Craig Gidney of Google Quantum AI published a preprint estimating that RSA-2048 could be factored with fewer than one million noisy qubits in under a week, down from an earlier 2019 estimate of around 20 million qubits. Hardware has improved too, with Google's Willow chip demonstrating below threshold error correction in late 2024. None of this means Q-Day is imminent, but it does mean the margin for complacency is shrinking

It is equally important not to overstate the threat. Today's machines have hundreds to a few thousand physical qubits, and the logical, error corrected qubits needed for Shor's algorithm at scale are still being engineered. Claims that RSA has already been broken by a quantum computer should be treated with great scepticism, because none so far has survived expert review. Calm, steady preparation is the right response, not panic

Why this is a positive story

It would be easy to frame the post quantum era as doom, but the evidence points the other way. The cryptographic community saw the threat decades early, ran an open global competition, and produced standards before the attack exists. Major platforms are deploying protections that most users never notice. That is the security world working the way we always hoped it would

For forum members, the opportunity is to be part of that story. Asking vendors about their post quantum roadmap, checking which protocols your own projects use, and sharing what you learn all push the transition forward. The post quantum era rewards curiosity and steady effort far more than it rewards fear. That is a landscape worth getting excited about


Key references for citation

• NIST FIPS 203, FIPS 204 and FIPS 205, published 13 August 2024 (csrc.nist.gov)
• NIST selection of HQC for standardisation, announced 11 March 2025
• NIST IR 8547 initial public draft, Transition to Post-Quantum Cryptography Standards, November 2024
• UK NCSC, Timelines for migration to post-quantum cryptography, March 2025
• Peter Shor, Algorithms for quantum computation, 1994, and Lov Grover, A fast quantum mechanical algorithm for database search, 1996
• Craig Gidney, How to factor 2048 bit RSA integers with less than a million noisy qubits, arXiv preprint, May 2025

[SuperPosition78]

The "collect now, decrypt later" threat is not just a theoretical worry; it is currently reshaping how we handle state secrets and long-term data retention. Banks and governments are already migrating to hybrid encryption schemes that blend classical RSA with new quantum-resistant algorithms like CRYSTALS-Kyber because waiting for actual quantum hardware to hit the market could mean our 2030 patient records are readable in 2040, which feels deeply unsettling when you consider how slowly bureaucratic IT departments actually move.

[TeddyWhelan]

Let us give credit where it is due: the anxiety here is slightly misplaced for most small businesses. Unless you are storing data intended to remain confidential for thirty years or more, standard AES-256 is going to hold up fine against Grover's algorithm, which only halves key strength. Chasing every new post-quantum standard for a local coffee shop's inventory system is overkill; stick to solid TLS implementations and you will be safer than 99% of the industry that is panicking without purpose.

[GradientPiston]

Mosca's inequality is my favourite tool in this whole area. It takes a vague worry and turns it into three numbers you can argue about in a meeting. Even rough guesses for X, Y and Z usually produce an answer that surprises people. In my experience Y is always the number that gets revised upward

Our team did a first pass inventory last year and found crypto in places nobody expected. There were hard coded RSA keys in an old billing integration and a vendor appliance that could not be upgraded at all. Neither would have shown up without a proper search

So I would add one practical tip to the article. Start the inventory before you start reading algorithm specifications