[{"data":1,"prerenderedAt":769},["ShallowReactive",2],{"blog-\u002Fblog\u002Fpost-quantum-cryptography-explained":3},{"id":4,"title":5,"author":6,"authorTitle":7,"authorUrl":7,"body":8,"canonical":7,"category":682,"date":683,"description":684,"draft":685,"extension":686,"faqs":687,"findingsSource":7,"geo":697,"howto":7,"howtoTitle":7,"image":7,"industries":699,"keyFindings":7,"meta":701,"modified":702,"navigation":703,"path":704,"pullquote":7,"recommendations":7,"references":705,"related":745,"seo":754,"seoTitle":755,"signposts":7,"slug":756,"stats":757,"stem":760,"tags":761,"tldr":767,"__hash__":768},"blog\u002Fblog\u002Fpost-quantum-cryptography-explained.md","Post-Quantum Cryptography Explained: What It Is and Why It Matters Now","ArcQubit Team",null,{"type":9,"value":10,"toc":663},"minimark",[11,16,43,47,53,57,66,70,149,162,166,181,194,208,217,221,259,270,274,294,298,301,316,319,322,354,358,361,395,399,425,428,432,435,472,476,479,522,526,569,573,576,656,660],[12,13,15],"h2",{"id":14},"the-answer-up-front","The answer, up front",[17,18,19,20,24,25,28,29,32,33,32,36,39,40,42],"p",{},"Post-quantum cryptography (PQC) is a family of encryption and digital signature algorithms built to resist attacks from both classical and quantum computers ",[21,22,23],"span",{},"1",". A large quantum computer could break RSA and elliptic-curve cryptography, which secure much internet traffic ",[21,26,27],{},"2",". NIST published three PQC standards in August 2024 ",[21,30,31],{},"3",", ",[21,34,35],{},"4",[21,37,38],{},"5",", and U.S. federal civilian systems face migration deadlines starting in 2030 ",[21,41,23],{},".",[12,44,46],{"id":45},"what-post-quantum-cryptography-is","What post-quantum cryptography is",[17,48,49,50,52],{},"PQC covers cryptographic algorithms designed to resist attack by both a quantum computer and a classical computer ",[21,51,23],{},". You do not need quantum hardware to use it. Servers, browsers, and chips run PQC as ordinary software and firmware.",[12,54,56],{"id":55},"the-threat-in-two-sentences","The threat in two sentences",[17,58,59,60,63,64,42],{},"Shor's algorithm lets a large quantum computer factor integers and compute discrete logarithms in polynomial time ",[21,61,62],{},"6",". That breaks RSA, Diffie-Hellman, and elliptic-curve cryptography, all of which OMB lists as quantum-vulnerable ",[21,65,27],{},[12,67,69],{"id":68},"the-three-nist-standards","The three NIST standards",[71,72,73,92],"table",{},[74,75,76],"thead",{},[77,78,79,83,86,89],"tr",{},[80,81,82],"th",{},"Standard",[80,84,85],{},"Algorithm",[80,87,88],{},"Job",[80,90,91],{},"Practical note",[93,94,95,114,132],"tbody",{},[77,96,97,103,106,109],{},[98,99,100,101],"td",{},"FIPS 203 ",[21,102,31],{},[98,104,105],{},"ML-KEM",[98,107,108],{},"Key establishment",[98,110,111,112],{},"Moderate key sizes and larger overhead than elliptic-curve cryptography ",[21,113,27],{},[77,115,116,121,124,127],{},[98,117,118,119],{},"FIPS 204 ",[21,120,35],{},[98,122,123],{},"ML-DSA",[98,125,126],{},"Digital signatures",[98,128,129,130],{},"Signatures of 2,420 to 4,627 bytes, depending on the parameter set ",[21,131,35],{},[77,133,134,139,142,144],{},[98,135,136,137],{},"FIPS 205 ",[21,138,38],{},[98,140,141],{},"SLH-DSA",[98,143,126],{},[98,145,146,147],{},"Hash-based fallback with signatures of 7,856 to 49,856 bytes, depending on the parameter set ",[21,148,38],{},[17,150,151,152,155,156,161],{},"NIST is still working on two more. FN-DSA (FIPS 206) offers compact signatures. It is in development at NIST, which has not published a public draft or announced a final date. HQC is a backup key-encapsulation mechanism that NIST selected in March 2025 because it rests on a different math approach than ML-KEM ",[21,153,154],{},"7",". NIST calls it a backup, so waiting for it gives you no reason to delay work on the three finished standards. ",[157,158,160],"a",{"href":159},"\u002Fblog\u002Fnist-pqc-standards-guide","NIST Post-Quantum Standards Guide"," covers each standard in detail.",[12,163,165],{"id":164},"why-it-matters-now","Why it matters now",[17,167,168,172,173,175,176,180],{},[169,170,171],"strong",{},"Attackers can collect data today."," The June 2026 executive order names the risk directly: adversaries may collect information now and decrypt it once large-scale quantum computers exist ",[21,174,23],{},". ",[157,177,179],{"href":178},"\u002Fblog\u002Fharvest-now-decrypt-later","Harvest Now, Decrypt Later"," explains how to test your own data against that risk.",[17,182,183,186,187,190,191,193],{},[169,184,185],{},"The cost estimates keep falling."," In 2019, Gidney and Ekera estimated that breaking 2048-bit RSA would take 20 million noisy qubits and about eight hours ",[21,188,189],{},"8",". Gidney's 2025 estimate cut the qubit count to under one million and put the runtime under a week ",[21,192,189],{},". That is a resource estimate, not a working machine.",[17,195,196,199,200,175,203,207],{},[169,197,198],{},"Experts see meaningful odds within a decade."," In the Global Risk Institute's 2025 survey of 26 experts, the averaged chance of a cryptographically relevant quantum computer within 10 years ranged from 28% to 49%, depending on how responses are read ",[21,201,202],{},"9",[157,204,206],{"href":205},"\u002Fblog\u002Fwhat-is-q-day","What Is Q-Day?"," walks through those figures.",[17,209,210,213,214,42],{},[169,211,212],{},"Migration takes years."," The UK NCSC expects large organizations to need two to three years just for discovery, strategy, and an initial plan, and another two to three years for early migration ",[21,215,216],{},"10",[12,218,220],{"id":219},"the-deadlines-you-should-know","The deadlines you should know",[222,223,224,233,242,250],"ul",{},[225,226,227,230,231,42],"li",{},[169,228,229],{},"United States:"," Federal high-value assets and high-impact systems must use PQC for key establishment by Dec. 31, 2030, and for digital signatures by Dec. 31, 2031 ",[21,232,23],{},[225,234,235,238,239,42],{},[169,236,237],{},"European Union:"," High-risk use cases by the end of 2030, and as many systems as feasible by the end of 2035 ",[21,240,241],{},"11",[225,243,244,247,248,42],{},[169,245,246],{},"United Kingdom:"," Discovery and an initial plan by 2028, priority migration by 2031, full migration by 2035 ",[21,249,216],{},[225,251,252,255,256,42],{},[169,253,254],{},"Canada:"," Federal departments finish high-priority systems by the end of 2031 and everything else by the end of 2035 ",[21,257,258],{},"12",[17,260,261,262,175,265,269],{},"NIST's draft transition report proposes deprecating 112-bit-strength quantum-vulnerable algorithms after 2030 and disallowing them, at every strength, after 2035. It remains an initial public draft ",[21,263,264],{},"13",[157,266,268],{"href":267},"\u002Fblog\u002Fpqc-mandates-deadlines","Global Mandates and Deadlines"," compares every jurisdiction in one table.",[12,271,273],{"id":272},"what-to-do-this-quarter","What to do this quarter",[275,276,277,280,288,291],"ol",{},[225,278,279],{},"Assign an owner for PQC migration.",[225,281,282,283,287],{},"Start a cryptographic inventory. ",[157,284,286],{"href":285},"\u002Fblog\u002Fcryptographic-inventory-cbom","Cryptographic Inventory and CBOM Guide"," shows what to record.",[225,289,290],{},"Rank your data by how long it must stay confidential.",[225,292,293],{},"Ask your top vendors for their PQC roadmaps and put PQC support into new procurement language.",[12,295,297],{"id":296},"what-this-means-for-executives-and-the-board","What this means for executives and the board",[17,299,300],{},"PQC is a risk and planning topic before it is a technology topic. Your board does not need to understand lattices. It needs to know who owns the migration, how long the work takes, and which data cannot wait.",[17,302,303,304,32,306,32,308,310,311,313,314,42],{},"Three facts frame the conversation. First, NIST finished the standards ",[21,305,31],{},[21,307,35],{},[21,309,38],{},", so the technical target exists. Second, regulators have set dates. The U.S., EU, UK and Canada all publish deadlines between 2030 and 2035 [1][10][11]",[21,312,258],{},". Third, no one knows when a cryptographically relevant quantum computer will arrive. OMB says only that steady advances may yield one in the coming decade ",[21,315,27],{},[17,317,318],{},"That uncertainty argues for early planning, not for panic. ArcQubit guidance: treat PQC like any long-lead infrastructure program. You cannot buy your way out in the final year, because the work touches applications, vendors, hardware and contracts.",[17,320,321],{},"Each executive role owns a different piece:",[222,323,324,330,336,342,348],{},[225,325,326,329],{},[169,327,328],{},"CEO:"," Names one accountable executive and protects the budget for discovery.",[225,331,332,335],{},[169,333,334],{},"CISO:"," Runs the inventory, sets the technical standard and reports progress.",[225,337,338,341],{},[169,339,340],{},"CFO:"," Funds a multi-year program and asks vendors what upgrades will cost.",[225,343,344,347],{},[169,345,346],{},"General counsel:"," Reviews contracts, regulatory exposure and data retention duties.",[225,349,350,353],{},[169,351,352],{},"CIO or CTO:"," Sequences the engineering work and owns supplier relationships.",[12,355,357],{"id":356},"decisions-leadership-must-make-in-the-next-90-days","Decisions leadership must make in the next 90 days",[17,359,360],{},"These are ArcQubit recommendations, not regulatory requirements.",[275,362,363,369,375,383,389],{},[225,364,365,368],{},[169,366,367],{},"Name the owner."," Pick one executive sponsor and one program lead. Shared ownership stalls.",[225,370,371,374],{},[169,372,373],{},"Approve discovery."," Fund a cryptographic inventory. You cannot plan a migration for systems you cannot see.",[225,376,377,380,381,42],{},[169,378,379],{},"Set the data priority rule."," Decide how long each class of data must stay confidential. Long-lived secrets move first because attackers can collect data today and decrypt it later ",[21,382,23],{},[225,384,385,388],{},[169,386,387],{},"Change procurement language."," Require PQC roadmaps from vendors and add PQC support to new contracts.",[225,390,391,394],{},[169,392,393],{},"Pick a reporting rhythm."," Ask for a short quarterly update to the board or risk committee.",[12,396,398],{"id":397},"questions-to-ask-your-team-this-week","Questions to ask your team this week",[275,400,401,404,407,410,413,416,419,422],{},[225,402,403],{},"Who owns PQC migration today, by name?",[225,405,406],{},"Where does our organization use RSA, Diffie-Hellman or elliptic-curve cryptography?",[225,408,409],{},"Which of those systems protect data that must stay secret for a decade or more?",[225,411,412],{},"Which vendors and cloud providers hold our keys or run our encryption, and what are their PQC plans?",[225,414,415],{},"Which systems are hard to update, such as embedded devices, hardware security modules or long-lived certificates?",[225,417,418],{},"Do our current contracts require suppliers to support the NIST standards?",[225,420,421],{},"Which regulator deadlines apply to us, directly or through customers?",[225,423,424],{},"How will we know we are on track a year from now?",[17,426,427],{},"If your team cannot answer questions 1 and 2, start there. Those answers drive every other decision.",[12,429,431],{"id":430},"what-it-costs-to-wait","What it costs to wait",[17,433,434],{},"Waiting has a cost even if a quantum computer never arrives on schedule. This section is ArcQubit reasoning, not a forecast.",[222,436,437,445,451,457,466],{},[225,438,439,442,443,42],{},[169,440,441],{},"Data already collected."," If an adversary copies your encrypted traffic today, later upgrades do not protect it. The executive order names this risk directly ",[21,444,23],{},[225,446,447,450],{},[169,448,449],{},"Procurement lead time."," Vendors ship PQC support on their own schedules. If you ask late, you wait behind every other customer.",[225,452,453,456],{},[169,454,455],{},"Supplier dependence."," Much of your cryptography lives in products you do not control. Your options narrow as deadlines approach.",[225,458,459,462,463,465],{},[169,460,461],{},"Long discovery phase."," The UK NCSC expects large organizations to need two to three years for discovery, strategy and an initial plan, then two to three more for early migration ",[21,464,216],{},". A 2030 deadline is close on that timeline.",[225,467,468,471],{},[169,469,470],{},"Audit and customer exposure."," Government customers and regulated partners will ask for evidence. Organizations without an inventory cannot supply it.",[12,473,475],{"id":474},"how-to-brief-your-board","How to brief your board",[17,477,478],{},"Use these talking points. Adapt the wording to your business.",[275,480,481,494,502,510,516],{},[225,482,483,486,487,32,489,32,491,493],{},[169,484,485],{},"The standards exist."," NIST published three PQC standards in August 2024 ",[21,488,31],{},[21,490,35],{},[21,492,38],{},". We do not need to wait for anything else.",[225,495,496,499,500,42],{},[169,497,498],{},"The dates are set."," Governments in the U.S., EU, UK and Canada expect migration between 2030 and 2035 [1][10][11]",[21,501,258],{},[225,503,504,507,508,42],{},[169,505,506],{},"The threat is uncertain but not remote."," Experts assign meaningful odds to a cryptographically relevant quantum computer within a decade ",[21,509,202],{},[225,511,512,515],{},[169,513,514],{},"Our exposure is unknown until we inventory."," Discovery is the first funded step.",[225,517,518,521],{},[169,519,520],{},"We ask for a sponsor and a quarterly update."," We will report progress against a plan.",[12,523,525],{"id":524},"common-mistakes-and-how-to-avoid-them","Common mistakes and how to avoid them",[222,527,528,536,542,551,557,563],{},[225,529,530,533,534,42],{},[169,531,532],{},"Waiting for a quantum computer to appear."," Migration takes years, so the start date matters more than the arrival date ",[21,535,216],{},[225,537,538,541],{},[169,539,540],{},"Treating PQC as a one-time patch."," It is a multi-year program that changes protocols, certificates and hardware.",[225,543,544,547,548,550],{},[169,545,546],{},"Delaying for FN-DSA or HQC."," NIST calls HQC a backup ",[21,549,154],{},", and the three finished standards already cover key establishment and signatures.",[225,552,553,556],{},[169,554,555],{},"Skipping the inventory."," Teams that buy tools before they know what they run buy the wrong tools.",[225,558,559,562],{},[169,560,561],{},"Leaving it to the security team alone."," Procurement, legal and engineering all hold pieces of the answer.",[225,564,565,568],{},[169,566,567],{},"Ignoring vendors."," Ask suppliers for roadmaps now and record their answers.",[12,570,572],{"id":571},"owner-and-timeline-table","Owner and timeline table",[17,574,575],{},"ArcQubit guidance. Adjust the timing to your regulatory exposure.",[71,577,578,591],{},[74,579,580],{},[77,581,582,585,588],{},[80,583,584],{},"Action",[80,586,587],{},"Owner",[80,589,590],{},"Suggested timing",[93,592,593,604,615,626,636,646],{},[77,594,595,598,601],{},[98,596,597],{},"Name executive sponsor and program lead",[98,599,600],{},"CEO",[98,602,603],{},"Within 30 days",[77,605,606,609,612],{},[98,607,608],{},"Start cryptographic inventory",[98,610,611],{},"CISO",[98,613,614],{},"Within 30 to 90 days",[77,616,617,620,623],{},[98,618,619],{},"Rank data by confidentiality lifetime",[98,621,622],{},"CISO and data owners",[98,624,625],{},"Within 90 days",[77,627,628,631,634],{},[98,629,630],{},"Add PQC clauses to procurement",[98,632,633],{},"CFO and general counsel",[98,635,625],{},[77,637,638,641,644],{},[98,639,640],{},"Request vendor PQC roadmaps",[98,642,643],{},"CIO or CTO",[98,645,625],{},[77,647,648,651,653],{},[98,649,650],{},"Report progress to the board",[98,652,611],{},[98,654,655],{},"Each quarter",[12,657,659],{"id":658},"how-arcqubit-approaches-it","How ArcQubit approaches it",[17,661,662],{},"ArcQubit QuCode scans your environment read-only and ingests output from scanners you already run. It returns a ranked Quantum Exposure Report with an owner assigned to each finding, sold directly as a fixed-scope discovery. QuTrust then turns those findings into a living migration roadmap with the evidence your auditors and board will ask for.",{"title":664,"searchDepth":665,"depth":665,"links":666},"",2,[667,668,669,670,671,672,673,674,675,676,677,678,679,680,681],{"id":14,"depth":665,"text":15},{"id":45,"depth":665,"text":46},{"id":55,"depth":665,"text":56},{"id":68,"depth":665,"text":69},{"id":164,"depth":665,"text":165},{"id":219,"depth":665,"text":220},{"id":272,"depth":665,"text":273},{"id":296,"depth":665,"text":297},{"id":356,"depth":665,"text":357},{"id":397,"depth":665,"text":398},{"id":430,"depth":665,"text":431},{"id":474,"depth":665,"text":475},{"id":524,"depth":665,"text":525},{"id":571,"depth":665,"text":572},{"id":658,"depth":665,"text":659},"Security","2026-07-14","What post-quantum cryptography is, which three NIST standards exist, why the threat matters now, and the deadlines your organization should plan around.",false,"md",[688,691,694],{"q":689,"a":690},"Which algorithms does PQC replace?","OMB lists RSA, Diffie-Hellman, ECDH, ECDSA, DSA, and MQV as quantum-vulnerable and tells agencies to treat any asymmetric algorithm not known to resist quantum attack the same way [2].",{"q":692,"a":693},"Has a quantum computer broken RSA-2048?","No. OMB states that a cryptographically relevant quantum computer is not yet known to exist, although steady advances may yield one in the coming decade [2].",{"q":695,"a":696},"Do I need to wait for FN-DSA or HQC?","No. NIST describes HQC as a backup to ML-KEM [7], and three finished standards already cover key establishment and signatures [3], [4], [5].",[698],"global",[700],"Cross-Sector",{},"2026-09-30",true,"\u002Fblog\u002Fpost-quantum-cryptography-explained",[706,709,712,715,718,721,724,727,730,733,736,739,742],{"label":707,"url":708},"Executive Office of the President, \"Securing the Nation Against Advanced Cryptographic Attacks,\" Executive Order 14412, 91 Fed. Reg. 38483, Jun. 25, 2026","https:\u002F\u002Fwww.federalregister.gov\u002Fdocuments\u002F2026\u002F06\u002F25\u002F2026-12909\u002Fsecuring-the-nation-against-advanced-cryptographic-attacks",{"label":710,"url":711},"Office of Management and Budget, \"Execution of the Migration to Post-Quantum Cryptography,\" Memorandum M-26-15, Jun. 24, 2026","https:\u002F\u002Fwww.whitehouse.gov\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002FM-26-15-Execution-of-the-Migration-to-Post-Quantum-Cryptography.pdf",{"label":713,"url":714},"National Institute of Standards and Technology, \"Module-Lattice-Based Key-Encapsulation Mechanism Standard,\" FIPS 203, Aug. 2024","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Ffips\u002F203\u002Ffinal",{"label":716,"url":717},"National Institute of Standards and Technology, \"Module-Lattice-Based Digital Signature Standard,\" FIPS 204, Aug. 2024","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Ffips\u002F204\u002Ffinal",{"label":719,"url":720},"National Institute of Standards and Technology, \"Stateless Hash-Based Digital Signature Standard,\" FIPS 205, Aug. 2024","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Ffips\u002F205\u002Ffinal",{"label":722,"url":723},"P. W. Shor, \"Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer,\" SIAM J. Comput., vol. 26, no. 5, pp. 1484-1509, 1997","https:\u002F\u002Farxiv.org\u002Fabs\u002Fquant-ph\u002F9508027",{"label":725,"url":726},"National Institute of Standards and Technology, \"NIST Selects HQC as Fifth Algorithm for Post-Quantum Encryption,\" NIST News, Mar. 11, 2025","https:\u002F\u002Fwww.nist.gov\u002Fnews-events\u002Fnews\u002F2025\u002F03\u002Fnist-selects-hqc-fifth-algorithm-post-quantum-encryption",{"label":728,"url":729},"C. Gidney, \"How to factor 2048 bit RSA integers with less than a million noisy qubits,\" arXiv:2505.15917, May 2025","https:\u002F\u002Farxiv.org\u002Fabs\u002F2505.15917",{"label":731,"url":732},"M. Mosca and M. Piani, \"Quantum Threat Timeline Report 2025,\" Global Risk Institute and evolutionQ","https:\u002F\u002Fglobalriskinstitute.org\u002Fpublication\u002Fquantum-threat-timeline-report-2025b\u002F",{"label":734,"url":735},"National Cyber Security Centre, \"Timelines for migration to post-quantum cryptography,\" NCSC, Mar. 20, 2025","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fguidance\u002Fpqc-migration-timelines",{"label":737,"url":738},"NIS Cooperation Group and European Commission, \"A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography,\" European Commission, Jun. 23, 2025","https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Flibrary\u002Fcoordinated-implementation-roadmap-transition-post-quantum-cryptography",{"label":740,"url":741},"Canadian Centre for Cyber Security, \"Roadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001),\" Communications Security Establishment Canada, Jun. 2025","https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Froadmap-migration-post-quantum-cryptography-government-canada-itsm40001",{"label":743,"url":744},"D. Moody, R. Perlner, A. Regenscheid, A. Robinson, and D. Cooper, \"Transition to Post-Quantum Cryptography Standards,\" NIST IR 8547 (Initial Public Draft), Nov. 12, 2024","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fir\u002F8547\u002Fipd",[746,747,748,750,751],{"label":179,"url":178},{"label":206,"url":205},{"label":749,"url":159},"NIST PQC Standards Guide",{"label":268,"url":267},{"label":752,"url":753},"The Three Clocks: Why Post-Quantum Migration Is the Defining Infrastructure Challenge of the Decade","\u002Fwhitepapers\u002Fthe-three-clocks",{"title":5,"description":684},"Post-Quantum Cryptography Explained","post-quantum-cryptography-explained",[758,759],"NIST published three post-quantum cryptography standards in August 2024: FIPS 203, FIPS 204 and FIPS 205 (NIST, 2024).","U.S. federal high-value assets and high-impact systems must use PQC for key establishment by Dec. 31, 2030 (Executive Office of the President, 2026).","blog\u002Fpost-quantum-cryptography-explained",[762,763,764,765,766],"post-quantum cryptography","NIST PQC standards","quantum risk","primer","for CISOs","Post-quantum cryptography (PQC) is a family of encryption and digital signature algorithms designed to resist both classical and quantum attacks, and NIST published the first three standards in August 2024.","4RZ3dQpRcD6ep5pwag8cR-w19flPKjiBYhbVVvJiTPI",1792182884295]