Post-quantum algorithms aren't stronger RSA. They're different maths
RSA and ECC derive their security from problems that are hard for classical computers and easy for quantum ones — integer factorisation and discrete logarithms. Post-quantum algorithms are built on problems believed to be hard for both. The emphasis on "believed" is deliberate — RSA's security was also believed sound until Shor demonstrated otherwise in 1994.
NIST's evaluation process ran from 2016 to 2024. Cryptographers worldwide submitted candidates and attempted to break each other's submissions. Several were broken during the process and eliminated. The three that survived to standardisation withstood eight years of sustained cryptanalytic attack from the global research community — the strongest evidence available, and the basis governments and major technology companies are now acting on.
Lattice problems: no polynomial-time quantum algorithm is known to break them. Hash-based schemes: security reduces directly to collision resistance, which quantum algorithms don't meaningfully threaten.
Four algorithms. All finalised. All available now
In August and September 2024, NIST finalised four post-quantum cryptographic standards. Organisations don't need to wait for further guidance — the algorithms are in major cryptographic libraries, and the question is now implementation, not readiness.
ML-KEM
Key encapsulation — replaces RSA and ECDH in TLS key exchange. Adds ~0.2% overhead to handshake time — negligible in practice.
✓ Chrome, Cloudflare, Signal, since 2023ML-DSA
Digital signatures — replaces RSA and ECDSA for certificates, code signing, DKIM. Larger signatures (~3.3KB), fast verification.
✓ OpenSSL, BouncyCastle, Azure Key VaultSLH-DSA
Hash-based signatures — the most conservative option. Larger and slower, but the strongest long-term trust argument available.
✓ Root CA & firmware signingFN-DSA
Compact lattice signatures for bandwidth-constrained environments — IoT, embedded systems, strict size constraints.
⟳ Finalised September 2024The transition is already underway in infrastructure you depend on
Some of the most exposed data — data in transit over TLS — is already being protected post-quantum by infrastructure providers, without any action from your organisation. The gap is in the systems you own and operate directly: internal PKI, VPN infrastructure, authentication systems, data-at-rest encryption, and custom application cryptography.
The implication: the standards aren't waiting for vendor readiness. Vendors are already shipping. The gap is organisational readiness — specifically, the cryptographic inventory, vendor assessment, and migration planning most organisations haven't started yet.
Hybrid cryptography is the transition state, not the destination
Most cryptographic transitions don't happen as a hard cutover. RSA-1024 to RSA-2048 took over a decade. SHA-1 to SHA-256 took longer. Post-quantum will be no different. The recommended approach during transition is hybrid cryptography — combining a classical algorithm with a post-quantum one, so the combined scheme's security depends on both.
Hybrid TLS uses both ECDH and ML-KEM simultaneously. The session key is secure unless both algorithms are broken at once — requiring a working quantum computer and a classical break of elliptic curve cryptography together. This is what Chrome and Cloudflare have been running since 2023.
Begin hybrid deployment — ML-KEM alongside ECDH for key exchange, ML-DSA alongside ECDSA for signatures where supported. Immediate protection, full compatibility.
NSA CNSA 2.0 preferred deadline — ML-KEM should be the primary key encapsulation mechanism for National Security Systems. Hybrid still acceptable as fallback.
ASD ISM target — transition away from quantum-vulnerable algorithms complete for systems protecting long-term confidentiality data. The governing deadline for most Australian organisations.
NSA CNSA 2.0 final deadline — ML-KEM and ML-DSA as sole algorithms for National Security Systems. No RSA or ECC permitted. Hybrid no longer acceptable.
What to take into your next risk conversation
The standards are finalised and implemented
NIST published ML-KEM, ML-DSA, SLH-DSA, and FN-DSA between August and September 2024, all in major libraries. The question isn't readiness — it's whether your systems are.
Post-quantum is already in infrastructure you use
Chrome, Cloudflare, Signal, Apple iMessage, AWS, and Azure have all deployed it in production. The gap is in systems your organisation owns directly.
Hybrid cryptography is the recommended transition
Combining classical and post-quantum algorithms provides immediate protection while keeping compatibility — the transition state, not the destination.
The transition is a programme, not a software update
Inventory, vendor assessment, prioritisation, migration, and ongoing monitoring are distinct phases — each taking time. Part 4 covers the practical roadmap.
The Roadmap: What Your Organisation Should Do Now
The standards are ready. The decisions that drive adoption are made by people.
Vendor assessments, board briefings, internal prioritisation debates — every step of the transition involves people making decisions under uncertainty. Click or Flick Corporate builds the awareness foundation that makes those decisions informed and timely.