Replace
Traditional asymmetric cryptography
RSA, elliptic-curve and Diffie-Hellman methods protect key establishment, certificates and digital signatures. A CRQC could break them, and larger key sizes do not provide meaningful protection.
PQC Education
Post-quantum cryptography, explained.
Quantum computing will change which cryptography organisations can rely upon. This page sets out what is at risk, why the risk is current and what readiness involves.
What is affected
Not all cryptography is equally exposed.
Strengthen
Symmetric encryption and hashing
AES and SHA-2 are far less affected. Adopting the larger key and hash sizes, such as AES-256 and SHA-384, is sufficient.
Adopt
Standardised post-quantum algorithms
NIST has published ML-KEM (FIPS 203) for key establishment, and ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for digital signatures. They are designed to resist a CRQC and are supported in commercial products.
Why the risk is current
The risk begins before the machine exists.
Encrypted data captured today can be decrypted once the capability exists, so information that must remain confidential for years is already exposed. Signatures face a separate risk: once a CRQC exists, traditional signatures on certificates, software updates and signed records could be forged. Long-lived trust anchors, such as root certificates and firmware-signing keys, warrant early attention.
- Harvest now, decrypt later (HNDL)
- Data intercepted and stored today, then decrypted once a CRQC exists. A confidentiality risk for anything that must stay private for years.
- Trust now, forge later (TNFL)
- Signing keys derived by a CRQC allow forged certificates, software updates and firmware to be accepted as genuine. An integrity risk.
- CRQC
- A cryptographically relevant quantum computer: one capable of breaking today's public-key cryptography. No date is assumed.
Readiness
What readiness involves.
- 1
Visibility
A current inventory of where cryptography is used: certificates, keys, protocols, libraries, hardware security modules and supplier services.
- 2
Prioritisation
Each system ranked by the sensitivity and lifespan of its data and the effort required to migrate it.
- 3
A plan the organisation owns
Sequenced waves, accountable owners and a governance cycle that keeps the plan current.
- 4
Crypto-agility
Systems and contracts designed so algorithms can be changed without re-engineering, including requirements on suppliers and new purchases.
Readiness begins with discovery, which turns an abstract risk into a prioritised programme of work. Hybrid key establishment, combining a traditional and a post-quantum algorithm, allows protection against harvest now, decrypt later to begin while products mature.
A thinking aid
When does it matter for your data?
This is Mosca's inequality, a standard way to reason about quantum risk. If the time your data must stay secure (X) plus the time migration will take (Y) is greater than the time until a cryptographically relevant quantum computer (CRQC) exists (Z), data protected today will be exposed while it still matters.
Risk exists if X + Y > Z
A thinking aid, not a forecast. No date for a CRQC is assumed; choose the value your organisation plans against.
Readiness begins with a clear baseline.
A 30-minute consultation, led by a PQC expert, establishes the organisation's current position and the right first step.
Book a 30-minute consultation