Post-Quantum Cryptography: The Solution To A Challenge That Began In 1994

These days, we see no shortage of headlines: news of a «Q-Day» that keeps inching closer and big breakthroughs in quantum computing. If you follow any of it, you've probably felt a flicker of unease about what it all means for the security we rely on every day: the security behind our messages, our payments, and the digital infrastructure we all depend on.

But before the alarm bells drown everything out, let's stop and ask the real questions: What is the actual threat? And are the news genuine, or just marketing and hype?

Over a series of blog posts, we will unpack why post-quantum cryptography (PQC) has become a key topic, when a transition needs to happen, and how to approach the challenge. Our goal is simple: to bring clarity to a complex subject and replace anxiety with understanding.

In this first post, we set the scene: how the conversation around PQC began, and what PQC actually is.

What is quantum computing?

PQC entered the conversation as a mitigation, a defense against the day a cryptographically relevant quantum computer (CRQC) becomes reality. But why do we need to protect against a CRQC? This brings us to quantum computing.

How does a quantum computer work?

Classical computers store information in bits, each holding a value of either 0 or 1. A quantum computer instead uses qubits. Through superposition, a qubit isn't locked to a single value: «0» and «1» can coexist simultaneously, settling on one only when measured. Through entanglement, qubits become linked, so the state of one is tied to the state of another. Together, these properties let a quantum computer approach certain problems that are otherwise out of reach on a classical computer.

When did quantum computing start? A brief history

The roots of quantum computing reach back more than a century to the birth of quantum mechanics in the early 1900s. The idea of a quantum computer, though, is younger. In 1981, at a conference co-organized by the MIT and IBM, the brilliant physicist Richard Feynman challenged the world to build one: «Nature isn't classical, dammit, and if you want to make a simulation of nature, you'd better make it quantum mechanical, and by golly it's a wonderful problem, because it doesn't look so easy.»

In recent years, major players, including IBM, Google, and Microsoft, as well as national efforts such as China's have poured research and resources into making a quantum computer a reality.

Quantum computers hold the promise of revolutionizing how we solve some of our hardest problems, offering leaps in computing power far beyond today's classical systems. They could potentially transform fields like drug discovery, chemicals, and logistics, by turning years of trial-and-error into far faster, more precise results.

The two milestones and the quantum threat

The two milestones from this history that matter most for our security are Shor's algorithm (1994) and Grover's algorithm (1996).

Grover's algorithm speeds up brute-force search as it effectively halves the strength of symmetric cryptography. The fix would be simple: double the parameters, and the original security margin is restored. But the actual consensus is that we don't even need to double the parameters, we can continue using symmetric cryptography⁽¹⁾ as it is. So Grover’s algorithm is worth noting, but it does not break the symmetric primitives we rely on today.

Shor's algorithm is the real threat. To see why, we need the idea of a hard problem. A hard problem is one we believe is genuinely difficult to solve. Problems like integer factorization⁽³⁾ and the discrete logarithm⁽⁴⁾ have been studied for over 50 years with no efficient solution ever found. That track record is exactly what we trust. Public-key cryptography⁽²⁾ is built on hard problems like factorization and discrete logarithm. The key agreement, how two parties establish a shared secret over an open channel, relies on these hard problems. And TLS, the security protocol securing the internet, relies on the security of that key agreement.

Shor's algorithm breaks the hardness assumption. On a sufficiently powerful quantum computer, it solves factorization and discrete logarithm efficiently, collapsing millions of years of classical computation into weeks. The problems are no longer hard, and once that assumption falls, everything resting on it falls, too: public-key cryptography, key agreement, and TLS . While our example relies on TLS, the same fundamental risk extends to most of the security protocols we use today.

Why the quantum threat is getting real

There's a twist that makes the scenario described above urgent today: «harvest now, decrypt later.» An adversary can capture encrypted traffic now and store it. He cannot decrypt it for the moment but he will be able to do so the day a quantum computer arrives. So any data that must stay confidential for years is already at risk. Think of medical records, financial and banking details, government and military secrets, trade secrets, or intellectual property. If the secrecy of the data needs to outlast the arrival of quantum computers, then intercepting it today is enough to compromise it tomorrow.

This is to say that you don't need a quantum computer to have a quantum problem.

Post-quantum cryptography – the answer to the quantum problem

So how can we prepare for the age of quantum computers? The answer is post-quantum cryptography.

PQC refers to a new generation of public-key cryptographic primitives, built on different hard problems that are designed to resist attacks from both classical and quantum computers. The goal isn't to abandon public-key cryptography, but to rebuild it on foundations that Shor's algorithm cannot break.

To get there, the National Institute of Standards and Technology (NIST) launched its Post-Quantum Cryptography Standardization Process in 2016. This is an open, multi-year competition inviting the community of cryptographers worldwide to submit and rigorously scrutinize candidate algorithms. After several rounds of analysis, the first standards were published in 2024: ML-KEM, HQC for key encapsulation, along with ML-DSA, SLH-DSA and FN-DSA for digital signatures. In parallel other PQC primitives are still being discussed and analyzed. This is the same kind of open, competitive vetting that gave us standards like AES and SHA-3: a process that builds confidence through years of public cryptanalysis.

From understanding the challenge to planning the transition

The quantum threat is not a gradual weakening of today's cryptography. But once a quantum computer arrives, the assumptions behind current public-key cryptography no longer hold. It's a shift we can anticipate and prepare for well in advance. PQC provides the practical path forward: Standards now exist, built on new mathematical foundations and tested through public scrutiny. 

To become quantum-resilient, organizations should understand where current cryptography is used, which data needs long-term protection, and how to plan the transition.

What does this means in practice? Find out in our next post.

Short glossary