Most internet security rests on public-key cryptography, such as RSA and elliptic curves, that a large enough quantum computer could break. No one can say when such a machine will exist. But data stolen today can be stored and decrypted later, and replacing cryptography across a company takes years, so the starting line is now rather than the day a quantum computer is announced.
The good news is that the replacement algorithms are standardized. This guide explains what changed, what is urgent and what can wait, and how to start without a big-bang rewrite.
The Threat: Harvest Now, Decrypt Later
A quantum computer running Shor's algorithm could break RSA, Diffie-Hellman and elliptic-curve cryptography, which protect key exchange, signatures and certificates. Symmetric ciphers such as AES-256 and hash functions are far less affected, needing only larger parameters.
The immediate risk is harvest now, decrypt later: an adversary records encrypted traffic or steals encrypted archives today and waits. Anything that must stay secret for ten or twenty years, including health records, trade secrets, government and financial data, is already in scope.
The Standards Are Here
| Standard | Algorithm | Use |
|---|---|---|
| FIPS 203 | ML-KEM (from CRYSTALS-Kyber) | Key establishment |
| FIPS 204 | ML-DSA (from CRYSTALS-Dilithium) | Digital signatures |
| FIPS 205 | SLH-DSA (from SPHINCS+) | Hash-based signatures |
| In progress | FN-DSA (from Falcon); HQC | Compact signatures; backup key encapsulation |
NIST published the first three in August 2024. Its draft transition guidance proposes deprecating quantum-vulnerable algorithms such as RSA and elliptic-curve cryptography by 2030 and disallowing them by 2035. The EU has published a coordinated roadmap asking member states to begin transition planning and to move high-risk systems earlier than the rest. Check the current text for your sector, because financial regulators are starting to ask.
What to Migrate First
1. Long-lived confidential data in transit and at rest. Prioritize VPNs, internal service-to-service links, backups and archives that must stay secret for a decade or more. Hybrid key exchange, combining a classical algorithm with ML-KEM, is already used in major browsers and CDNs and lets you add protection without giving up current assurance.
2. Long-lived signatures and trust anchors. Firmware signing, code signing, document signing and root certificates last for years and are hard to replace in the field.
3. Systems you cannot update easily. Hardware security modules, embedded devices, smart cards and IoT need long lead times.
4. Everything else. Short-lived web sessions are lower risk and mostly follow your TLS libraries and cloud providers.
How to Start Without a Big-Bang Rewrite
Build a cryptographic inventory. List where you use cryptography: libraries, certificates, key sizes, protocols, vendors and data lifetimes. A cryptographic bill of materials (CBOM) is the emerging format.
Design for crypto-agility. Wrap algorithms behind configuration so you can change them without re-architecting. Avoid hard-coded algorithm choices and fixed-size fields that cannot hold bigger keys and signatures; post-quantum keys and signatures are larger and can break assumptions.
Ask vendors for roadmaps. Cloud, HSM, VPN and SaaS suppliers should state when they will support post-quantum algorithms. Make it a procurement criterion.
Pilot, measure, then roll out. Test performance, handshake sizes and middlebox compatibility in a staging environment first.
Special Considerations for Crypto and Fintech
Blockchains rely on signatures to authorize spending. Addresses whose public keys have never been revealed are somewhat better protected, while reused addresses and exposed keys are more exposed in a quantum future. Migrating a live network requires community agreement and careful design, which is slow. Exchanges and custodians should plan for new key types in custody systems, review how public keys are exposed, and track protocol proposals.
Banks and payment firms have long-lived records, regulatory retention periods and heavy use of hardware security modules, so they are natural early movers. Incidents like the Binance hack show that today's biggest losses come from operational failures rather than broken cryptography, so keep fixing approval flows and access control while you plan the quantum transition.
A 90-Day Starter Plan
Days 1-30: name an owner, start the inventory, classify data by how long it must stay secret.
Days 31-60: ask vendors for roadmaps, enable hybrid key exchange where your stack supports it, and identify systems with long-lived signatures.
Days 61-90: pilot post-quantum algorithms in a non-critical service, document results and write the migration plan and budget.
We help teams design crypto-agile architectures and security roadmaps. Get in touch or explore our services.
Frequently Asked Questions
What is post-quantum cryptography?
Post-quantum cryptography means algorithms designed to resist attacks from both classical and quantum computers. They run on ordinary hardware and are different from quantum key distribution, which needs special equipment.
When will quantum computers break RSA?
Nobody knows. Estimates vary widely and depend on engineering breakthroughs. Because migration takes years and encrypted data can be stolen now and decrypted later, standards bodies recommend starting before a break is demonstrated.
Which algorithms did NIST standardize?
In August 2024 NIST published FIPS 203 (ML-KEM, for key establishment), FIPS 204 (ML-DSA, for digital signatures) and FIPS 205 (SLH-DSA, a hash-based signature scheme). A further signature standard, FN-DSA, and the HQC key-encapsulation algorithm selected in 2025 are in progress.
Does this affect Bitcoin and other cryptocurrencies?
Yes, in principle. Most chains use elliptic-curve signatures that a quantum computer could forge, and addresses whose public keys have been revealed are the most exposed. Protocol-level migration paths are under discussion and require community consensus.