Post quantum cryptography is no longer a research topic. In fact, it’s an active migration priority for governments, cloud providers, and security teams worldwide. Every secure connection you make today — your bank login, your encrypted messages, the padlock icon in your browser — relies on math problems that are hard for classical computers to solve. Specifically, RSA and elliptic curve cryptography (ECC) have protected the internet for decades, since factoring huge numbers, or solving discrete logarithms, takes an ordinary computer longer than the age of the universe.
However, quantum computers change that equation. As a result, the countdown to what the industry calls “Q-Day” has already reshaped encryption roadmaps. Because of this, understanding what’s coming is no longer optional for developers or IT leaders.
Show Image
What Happens on “Q-Day”?
“Q-Day” is the informal name for the moment a quantum computer becomes powerful enough to break the RSA and ECC encryption that secures most internet traffic. Rather than a single dramatic event, it’s more of a threshold — the point where a large, error-corrected quantum computer can run Shor’s algorithm against real-world key sizes.
Shor’s algorithm dates back to 1994, and it can factor large integers and solve discrete logarithm problems exponentially faster than any known classical method. That’s precisely the math underpinning RSA and ECC. For example, a classical computer would need longer than the age of the universe to break a 2048-bit RSA key, whereas a sufficiently powerful quantum computer running Shor’s algorithm could, in theory, do it in hours or days.
Currently, no one knows exactly when a quantum computer capable of this will exist. Additionally, current quantum hardware suffers from high error rates and limited qubit counts. Meanwhile, estimates for a cryptographically relevant quantum computer range from several years to a couple of decades out. That uncertainty is exactly why organizations are moving now, rather than waiting for a firm date.
The “Harvest Now, Decrypt Later” Threat to Post Quantum Cryptography Efforts
Q-Day doesn’t need to arrive today to cause damage today. Indeed, adversaries, including nation-state actors, can intercept and store encrypted data now, then decrypt it retroactively once quantum computers catch up. This strategy is known as “harvest now, decrypt later,” and it makes any data with a long confidentiality shelf life a target right now: medical records, government communications, intellectual property, financial records, and encrypted backups.
This is the real urgency behind PQC migration. Rather than protecting tomorrow’s traffic, it’s about protecting data that’s already been captured and is sitting in an adversary’s storage, waiting.
Understanding Post Quantum Cryptography (PQC) Standards
Post quantum cryptography (PQC) refers to cryptographic algorithms designed to run on today’s classical computers while resisting attacks from both classical and quantum computers. To develop these, NIST ran an eight-year public evaluation process starting in 2016. Eventually, the agency finalized its first set of PQC standards in August 2024.
FIPS 203 — ML-KEM (based on CRYSTALS-Kyber)
ML-KEM, short for Module-Lattice-Based Key-Encapsulation Mechanism, is the flagship replacement for RSA and ECDH key exchange. Specifically, it’s a lattice-based algorithm whose security rests on the hardness of the Module Learning With Errors (MLWE) problem — essentially, finding a specific “needle” hidden inside noisy, high-dimensional data. It comes in three parameter sets (ML-KEM-512, -768, and -1024) offering increasing security margins, and public keys and ciphertexts range roughly from 800 to 1568 bytes. Because ML-KEM is a key-encapsulation mechanism rather than a signature scheme, it protects the confidentiality of data in transit. That’s exactly the part vulnerable to harvest-now-decrypt-later attacks.
FIPS 204 — ML-DSA (based on CRYSTALS-Dilithium)
ML-DSA, or Module-Lattice-Based Digital Signature Algorithm, is the primary quantum-resistant signature scheme, replacing ECDSA and RSA signatures. Similarly, it also relies on module lattice problems. Overall, most security teams recommend it as the default choice for signing, thanks to a good balance of signature size and performance.
FIPS 205 — SLH-DSA (based on SPHINCS+)
SLH-DSA takes a different mathematical approach: its security depends only on the collision resistance of hash functions, not on lattice assumptions. Consequently, this makes it slower and produces much larger signatures. Still, it acts as a conservative backup, in case researchers ever find unexpected weaknesses in lattice-based structures.
What’s Coming Next in Post Quantum Cryptography
NIST isn’t done yet. For instance, in March 2025, the agency selected HQC (Hamming Quasi-Cyclic), a code-based algorithm, as a second key-encapsulation mechanism, which diversifies the standard away from lattice-only reliance. Additionally, a FALCON-based signature standard, expected to publish as FIPS 206, is also in the pipeline, targeting bandwidth-constrained environments like IoT devices.
This layered approach exists for a reason: multiple algorithms, built on different mathematical foundations, protect against a single point of failure. In fact, the standardization process itself proved that “no known attack” isn’t the same as “proven secure.” For example, two earlier PQC candidates, SIKE and Rainbow, were cryptanalytically broken during the evaluation period. That’s a reminder that these algorithms, while extensively studied, haven’t had the decades of adversarial scrutiny that RSA and ECC have survived.
How Web Infrastructure Is Preparing for Quantum-Safe Migration
Migrating the internet’s cryptographic backbone is a multi-year, multi-layer undertaking. Here’s what that migration looks like in practice.
Hybrid TLS Deployments
Most organizations are deploying hybrid key exchange rather than flipping a switch from ECC to PQC. Specifically, this means combining a classical algorithm, like X25519, with ML-KEM in the same TLS handshake, so a connection stays secure even if one of the two algorithms is later broken. Already, major browsers and CDNs have rolled out hybrid post quantum key exchange as a default or opt-in option. Meanwhile, large cloud providers are integrating ML-KEM support into their TLS stacks and load balancers.
Certificate Authorities and PKI
Public Key Infrastructure (PKI) is one of the trickiest pieces to migrate, since certificate chains, hardware security modules, and legacy validation logic are all built around RSA/ECC key sizes and signature formats. Currently, certificate authorities are piloting PQC-signed certificates. However, commercially available post quantum certificates at scale are only just beginning to emerge, because ML-DSA’s larger signature sizes create real engineering challenges for existing protocols and hardware.
Regulatory Pressure Is Accelerating Timelines
Migration isn’t just a technical best practice anymore; it’s becoming a compliance deadline. For instance, the NSA’s CNSA 2.0 guidance sets 2030 as the mandatory migration deadline for National Security Systems. Likewise, a June 2026 U.S. executive order set a broader federal timeline: a migration pilot through the Department of Commerce by 2027, key-establishment migration by 2030, and digital-signature migration by 2031 for federal civilian high-value systems. Similarly, financial infrastructure operators, payment networks, and critical infrastructure providers in multiple countries are running comparable migration studies.
What Developers and IT Leaders Should Be Doing Now
- Inventory your cryptography. Most organizations don’t have a clear map of where RSA/ECC is used across their systems, including TLS, VPNs, code signing, database encryption, and embedded devices. After all, you can’t migrate what you haven’t found.
- Prioritize by data sensitivity and lifespan. Specifically, data that needs to stay confidential for 10+ years is the most urgent target — think health records, trade secrets, and government communications.
- Adopt hybrid modes first. Hybrid classical/PQC key exchange gives you quantum resistance today, so you won’t be betting everything on algorithms that are still relatively young.
- Track library and vendor support. OpenSSL, major TLS libraries, and cloud key-management services are steadily adding ML-KEM and ML-DSA support. Therefore, staying current on these releases is often the fastest path to migration.
- Plan for crypto-agility. Since FIPS 206 and HQC-based standards are still being finalized, systems that can swap cryptographic algorithms without a full rewrite will pay off for years.
The Bottom Line on Post Quantum Cryptography
Nobody can say with certainty when Q-Day will arrive; estimates range from several years to a couple of decades. Nevertheless, the migration itself takes years to execute safely, and regulatory deadlines are already on the books. Moreover, data harvested today can be decrypted the moment quantum computers catch up. That combination of long lead times and retroactive risk is exactly why tech companies aren’t waiting for certainty before they act.
Ultimately, organizations that treat post quantum cryptography migration as a multi-year infrastructure project, rather than a future problem, will avoid scrambling when the countdown finally runs out.