Post-Quantum Cryptography (PQC): What It Is, the NIST Standards and What Changes

Post-quantum cryptography (PQC) is public-key cryptography designed to stay secure against an attacker with a large quantum computer, while running on the computers, phones and network equipment we use today. It replaces RSA, elliptic-curve cryptography and Diffie-Hellman, which a cryptographically relevant quantum computer could break. NIST published the first three PQC standards in August 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA).

Post-quantum cryptography is not a future topic. Chrome, Firefox and Safari already negotiate a post-quantum key exchange by default, OpenSSL 3.5 offers one out of the box, and regulators have set dates: the NSA requires CNSA 2.0 algorithms in new national security system acquisitions from 1 January 2027, and NIST's draft transition plan disallows quantum-vulnerable public-key algorithms after 2035.

This page explains what PQC is and is not, which algorithms are standardized and how they compare, what hybrid mode means, and which deadlines apply. For the step-by-step plan, see our PQC migration roadmap.

---

Table of Contents

1. Why Quantum Computers Break Today's Public-Key Cryptography
2. What Post-Quantum Cryptography Is, and What It Is Not
3. FIPS 203, FIPS 204 and FIPS 205: The NIST PQC Standards
4. Post-Quantum Algorithm Families
5. Hybrid Post-Quantum Cryptography
6. Where PQC Is Already Deployed
7. Post-Quantum Cryptography Deadlines
8. What Changes for an Organization
9. How DuoKey Helps
10. FAQ

---

Why Quantum Computers Break Today's Public-Key Cryptography

Almost every secure connection and digital signature today relies on two hard mathematical problems: factoring large numbers (RSA) and computing discrete logarithms (Diffie-Hellman, ECDH, ECDSA, EdDSA). Shor's algorithm, published in 1994, solves both efficiently on a quantum computer. A quantum computer large and reliable enough to run it against real key sizes is called a cryptographically relevant quantum computer (CRQC).

Nobody knows when a CRQC will exist. The NSA states in its CNSA 2.0 FAQ that it "does not know when there will be a CRQC" and that expert assessments disagree significantly. Two facts make the timing less important than it seems:

• Data can be recorded now and decrypted later. Encrypted traffic captured today with RSA or ECDH key exchange can be decrypted once a CRQC exists. This is the harvest now, decrypt later threat, and it applies to any data that must stay confidential for years.
• Migration takes years. Public-key cryptography sits in protocols, certificates, hardware, firmware and partner integrations. Replacing it is a multi-year program, so it has to start before the threat is real.

Symmetric cryptography is far less affected. The NSA considers symmetric algorithms secure "provided the key size is sufficiently large", and CNSA 2.0 keeps AES with 256-bit keys and SHA-384 or SHA-512.

---

What Post-Quantum Cryptography Is, and What It Is Not

PQC is software. Post-quantum algorithms are new mathematical constructions that run on classical hardware. They are deployed like any other algorithm: in TLS libraries, HSM firmware, certificate authorities and code-signing tools.

PQC is not quantum key distribution (QKD). QKD uses quantum physics to distribute keys and needs dedicated optical hardware and links. It does not provide authentication on its own and cannot replace digital signatures. Most national guidance, and every regulator timeline on this page, is about PQC.

PQC is not "quantum-proof". Like all cryptography, the new algorithms rest on problems believed to be hard. That is why NIST standardized algorithms from different mathematical families, and why many organizations use hybrid modes during the transition.

You will also see the terms quantum-safe and quantum-resistant cryptography. In practice they mean the same thing as post-quantum cryptography.

---

FIPS 203, FIPS 204 and FIPS 205: The NIST PQC Standards

NIST launched its post-quantum standardization process in 2016 and published the first three Federal Information Processing Standards on 13 August 2024.

Sizes are from the FIPS documents. The details, including private-key formats and certificate sizes, are in our ML-KEM guide and ML-DSA guide.

FIPS 203 vs FIPS 204 in one sentence: FIPS 203 (ML-KEM) lets two parties agree on a secret key, FIPS 204 (ML-DSA) lets one party prove who signed something. A complete migration needs both: ML-KEM protects confidentiality against harvest now, decrypt later; ML-DSA protects authenticity once a CRQC could forge RSA or ECDSA signatures.

What comes next. NIST has also selected Falcon (to be standardized as FN-DSA, a signature scheme with smaller signatures) and HQC (a code-based KEM, a backup to ML-KEM built on different mathematics); both standards are still in progress. NIST is also evaluating additional signature schemes. For using KEMs safely, NIST published SP 800-227 in September 2025.

Stateful hash-based signatures. LMS and XMSS, specified for US federal use in NIST SP 800-208 (2020), predate the FIPS standards. They are already approved and suit firmware and software signing, but the signer must track state so that no one-time key is ever reused. See post-quantum code signing.

---

Post-Quantum Algorithm Families

PQC algorithms come from a few mathematical families, each with different trade-offs:

Algorithm diversity is deliberate: if a weakness appears in one family, organizations can move to another. That only works if algorithm choice is a configuration setting, not hard-coded, which is the idea behind crypto agility.

---

Hybrid Post-Quantum Cryptography

Hybrid (or composite) cryptography combines a classical and a post-quantum algorithm so that the result stays secure as long as either one holds. It hedges against two risks: a future quantum computer, and an undiscovered weakness or implementation bug in the new algorithm.

• Key exchange. In TLS 1.3 the hybrid group X25519MLKEM768 combines X25519 with ML-KEM-768. It is the most widely deployed form of PQC today. See our guide to hybrid post-quantum TLS.
• Signatures and certificates. Composite certificates combine ML-DSA with ECDSA or RSA in one certificate. The IETF specification is not yet a final RFC; see hybrid certificates vs pure PQC.

Positions differ. Several European authorities recommend hybrid during the transition. The NSA, for national security systems, "will not require" hybrid products and expects pure CNSA 2.0 algorithms (ML-KEM-1024, ML-DSA-87), accepting hybrid only in specific protocols where it has published guidance.

---

Where PQC Is Already Deployed

Post-quantum key exchange is already in production on the public internet. According to Cloudflare's PQC support list:

Post-quantum signatures are earlier in their adoption. ML-DSA certificates are defined for X.509 (RFC 9881) and can be used in private PKI today, but the CA/Browser Forum has not yet allowed them in publicly trusted TLS certificates. The ML-DSA certificates guide tracks the status.

---

Post-Quantum Cryptography Deadlines

---

What Changes for an Organization

Adopting post-quantum cryptography is less about choosing algorithms, which NIST has done, and more about finding and changing every place where public-key cryptography is used.

1. Inventory. Find RSA, ECC and DH in TLS endpoints, VPNs, PKI, code signing, KMS and HSM keys, applications and devices. A cryptographic inventory kept as a CBOM is the starting point.
2. Prioritize. Rank systems by how long their data must stay confidential and how hard they are to change. Key exchange protecting long-lived data comes first.
3. Enable hybrid key exchange where your stacks support it. It needs no new certificates.
4. Plan the PKI and signature migration, which has the longest lead time: new roots, trust-store distribution, larger certificates, and firmware roots of trust.
5. Check key stores and vendors. HSMs, cloud KMS and appliances need dated support for ML-KEM, ML-DSA and the new key formats.
6. Make algorithms a policy decision so the next change does not need another multi-year program.

The full sequence, with owners and timing, is in the PQC migration roadmap. To measure where you stand first, see PQC readiness assessment.

---

How DuoKey Helps

According to DuoKey's documentation and product pages:

• Measure. The free Quantum Risk Score assesses a domain's publicly observable cryptography, including whether endpoints negotiate a hybrid post-quantum key exchange, without access to internal systems.
• Inventory continuously. DuoKey CPM (cryptographic posture management, formerly PQC Scanner) discovers certificates and keys, flags RSA and ECDSA as quantum-vulnerable and produces a CBOM with dated remediation targets.
• Issue post-quantum certificates. DuoKey Cockpit's certificate management supports ML-DSA-44/65/87, SLH-DSA and a hybrid ML-DSA-65 + ECDSA-P256 composite for private CA hierarchies.
• Manage post-quantum keys under policy. Cockpit manages ML-KEM, ML-DSA and SLH-DSA keys, exports them in the IETF LAMPS encodings that OpenSSL 3.5 reads, and its Crypto Agility Plane lets a central policy switch applications between classical, hybrid and PQC-only.

---

FAQ

Q: What is post-quantum cryptography in simple terms?

It is a new generation of public-key algorithms that a quantum computer cannot break, designed to replace RSA and elliptic-curve cryptography. It runs on ordinary computers. NIST standardized the first algorithms in 2024: ML-KEM for key exchange, and ML-DSA and SLH-DSA for signatures.

Q: What are FIPS 203 and FIPS 204?

FIPS 203 is the NIST standard for ML-KEM, a key-encapsulation mechanism used to establish shared secret keys. FIPS 204 is the NIST standard for ML-DSA, a digital signature algorithm. Both were published on 13 August 2024, alongside FIPS 205 (SLH-DSA, a hash-based signature).

Q: Is post-quantum cryptography the same as quantum cryptography?

No. Post-quantum cryptography is mathematics that runs on classical hardware. Quantum cryptography, usually quantum key distribution (QKD), uses quantum physics and needs dedicated optical equipment. Regulatory timelines for the quantum transition are about PQC.

Q: When will quantum computers break RSA?

Nobody knows. The NSA says it does not know when a cryptographically relevant quantum computer will exist and that expert estimates disagree significantly. Because data can be recorded now and decrypted later, and migration takes years, the deadlines are set well before any expected date.

Q: Is AES quantum-safe?

AES with 256-bit keys is considered secure against quantum attacks. Quantum computing is much less effective against symmetric algorithms than against public-key ones. CNSA 2.0 requires AES-256 and SHA-384 or SHA-512.

Q: Should we use hybrid or pure post-quantum algorithms?

Most organizations start with hybrid key exchange, such as X25519MLKEM768 in TLS, because it is widely supported and stays secure if either algorithm holds. US national security systems follow CNSA 2.0, which expects pure ML-KEM-1024 and ML-DSA-87. Treat the choice as a policy setting you can change later.

---

Further reading

• PQC migration roadmap: how to build one
• CNSA 2.0 timeline
• Hybrid post-quantum TLS
• Post-quantum code signing

---

References

• NIST: Post-Quantum Cryptography project
• NIST FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard
• NIST FIPS 204: Module-Lattice-Based Digital Signature Standard
• NIST FIPS 205: Stateless Hash-Based Digital Signature Standard
• NIST SP 800-208: Recommendation for Stateful Hash-Based Signature Schemes
• NIST SP 800-227: Recommendations for Key-Encapsulation Mechanisms
• NIST IR 8547 (Initial Public Draft): Transition to Post-Quantum Cryptography Standards
• NSA: CNSA 2.0 and Quantum Computing FAQ (Ver. 2.2, October 2026, PDF)
• Cloudflare: Post-quantum cryptography support
• European Commission: Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography
• NCSC: Timelines for migration to post-quantum cryptography
• DuoKey Docs: PQC Scanner
• DuoKey Docs: Post-quantum certificates