Post-Quantum Cryptography

When you send a message or pay online, the data gets encrypted. That means: it is transformed according to a fixed computational procedure so that outsiders cannot read it. The methods common today rely on computational problems that take far too long for ordinary computers. One example is factoring a huge number into its factors. But there is a new kind of computer, the quantum computer, which approaches certain such problems in a fundamentally different way and could be vastly faster at it. Post-quantum cryptography is the umbrella term for encryption methods that are meant to hold up against such machines as well.

Why we're already switching over, even though the quantum computer is missing

Large, practically usable quantum computers do not yet exist. Experts expect years or decades, and nobody knows the date. Nevertheless, the transition is already underway. The reason is an attack that particularly worries experts: "harvest now, decrypt later."

In this scenario, an attacker simply stores today's encrypted data without being able to read it. He waits until the appropriate technology exists, and then decrypts it. For last week's chat messages, that doesn't matter. For medical records, construction plans, state secrets, or bank data, it's a real problem, because these will still be sensitive even twenty years from now.

On top of that: swapping out encryption takes a long time. It is embedded in browsers, bank cards, cars, industrial plants, and millions of servers. Such transitions stretch over a decade. Anyone who only starts once the quantum computer is here is already too late.

Lattices, codes, and other hard problems

Post-quantum methods rely on computational problems for which even quantum computers have no known trick. The most important are lattice-based methods. Simplified, the task there is to find, within a regular grid of points spanning many hundreds of dimensions, the point that lies closest to a given location. That sounds harmless, but at high dimensionality it becomes extremely demanding.

Besides that, there are further families, such as methods based on error-correcting codes or on so-called hash functions. Pursuing several different approaches is deliberate. If one family falls to a new attack, the others remain. That has already happened: a candidate called SIKE was broken in 2022 using an ordinary computer within a few hours.

The US agency NIST had proposals from all over the world publicly reviewed over several years. In 2024 the first standards were published, including one method for key exchange and two for digital signatures. A common misconception: post-quantum cryptography has nothing to do with quantum computers inside your own device. It runs on perfectly ordinary processors. It should also not be confused with quantum cryptography, which physically secures data via special fiber-optic lines.

Where the new methods are already running

Some of your data traffic is probably already quantum-safe. Chrome and Firefox encrypt connections to many major websites using a method that combines a classical and a lattice-based scheme. Messengers like Signal and Apple's iMessage have also switched over their key exchange methods. The user notices nothing, except that the keys are noticeably larger and slightly more data flows.

In business news, these terms often appear alongside "crypto agility." This refers to software being built so that its encryption can be easily swapped out later. Banks, insurers, and government agencies are creating inventories for this: where exactly, in our systems, is which method embedded? This stocktaking is considered the truly tedious part.

For providers of security software, chip cards, and network technology, this is a growing market. Agencies like Germany's BSI issue deadlines and recommendations that companies must orient themselves by. So when you read that a corporation is becoming "quantum-safe," it's usually not about new hardware, but about swapping out the mathematics in existing software.