Why classical public key cryptography fails
Almost all internet security today depends on the hardness of integer factorisation (RSA) or discrete logarithms (elliptic curve). Shor's algorithm, running on a sufficiently large fault tolerant quantum computer, solves both in polynomial time. Symmetric algorithms like AES are weakened (Grover's algorithm halves the effective key length) but not broken; doubling key sizes is enough.
The NIST standardised algorithms
In August 2024, NIST published the first three post quantum standards. These are the building blocks of the next decade of internet security.
- ML-KEM (Kyber), FIPS 203: key encapsulation, replacing RSA and ECDH for session key establishment.
- ML-DSA (Dilithium), FIPS 204: digital signatures, the general purpose replacement for RSA and ECDSA.
- SLH-DSA (SPHINCS+), FIPS 205: stateless hash based signatures, a conservative backup for long lived root signing.
Hybrid deployments are the realistic path
Most enterprise rollouts in 2026 use hybrid handshakes that combine a classical algorithm (X25519, P-256) with a post quantum KEM (ML-KEM-768). The session is secure as long as either component is unbroken. This protects against both quantum attack and any unforeseen weakness in the new algorithms, at the cost of slightly larger handshake payloads.
What changes operationally
PQC handshakes are larger. Certificates, signatures and key material grow, sometimes by an order of magnitude. Expect impact on MTU sensitive paths, embedded devices and TLS termination at very high request rates. None of this is fatal, but it has to be measured before broad rollout.
A pragmatic migration plan
Pair this article with our deep dive on post quantum cryptography readiness for the four phase migration (Discover, Prioritise, Pilot, Migrate). The headline rule: long lived secrets move first.
Frequently asked questions
Is AES quantum safe?
AES-256 is considered quantum safe in practice. Grover's algorithm halves the effective key strength, so AES-256 retains roughly 128 bits of security against a quantum attacker. AES-128 should be retired for long lived data.
Should we wait for more PQC algorithms to be standardised?
No. NIST will continue to standardise alternatives, but ML-KEM and ML-DSA are production grade today. Start hybrid pilots now; switch defaults as guidance evolves.
What about quantum key distribution (QKD)?
QKD solves a narrow problem (information theoretic key exchange over dedicated links) and is not a substitute for general purpose PQC. NCSC explicitly recommends PQC over QKD for most enterprise use cases.
Want a tailored view for your organisation?
Get in touch and qubion will match you with marketplace vendors who can map your quantum exposure, opportunities and a 12 to 36 month plan.
Find a vendor