Post-Quantum Cryptography

The name misleads almost everyone on first contact. Post-quantum cryptography is not cryptography that runs on a quantum computer, and it is not QKD. It is ordinary software — classical algorithms, running on the laptop and phone you already own — chosen because the mathematical problem underneath them has no known efficient quantum attack. The previous lesson ended by naming it as the practical answer to the quantum threat. This lesson is about what that answer actually is, what it costs, why the migration has already started, and why it is the part of this course most likely to show up in a job description.

Start with the threat, stated precisely. Shor's algorithm finds periods, and every public-key system deployed at scale today — RSA, Diffie–Hellman, and elliptic-curve schemes like ECDH and Ed25519 — reduces to a period-finding problem. A cryptographically relevant quantum computer breaks all of them, completely, not gradually. That covers the key exchange in every TLS connection, the signature on every certificate and software update, and the identity behind every SSH login. It does not cover symmetric cryptography: AES and SHA-2 face only Grover's quadratic speed-up, which turns 128-bit security into roughly 64-bit-equivalent effort and is answered by moving to AES-256. The public-key layer is the emergency; the symmetric layer is a parameter change.

Now the part that makes this urgent rather than academic. Encrypted traffic can be recorded today and decrypted later, once a machine exists — "harvest now, decrypt later." Anything whose confidentiality must outlast the arrival of that machine is already exposed, on the day it is sent, regardless of how far away the machine is. Michele Mosca put this as an inequality: let X be how long your data must stay secret, Y how long your migration takes, and Z how long until a cryptographically relevant quantum computer exists. If X + Y > Z, you are already late. Nobody knows Z. But medical records, state secrets, and long-lived industrial designs have X measured in decades, and Y for a large organisation is routinely five to ten years, so for a great deal of real data the inequality holds for any Z under about thirty years — which is why governments started the migration before anyone had built the machine.