Post-Quantum Cryptography: What It Is, and Which Algorithms Are Safe
On 13 August 2024, the US National Institute of Standards and Technology (NIST) finalised three new encryption standards. No working quantum computer can break the encryption they replace. That is the point: NIST built the replacement before the attack exists, because encrypted data recorded today can still be decrypted in twenty years, once one does.
What this guide covers
- The problem in one sentence, and why "no quantum computer exists yet" doesn't make it wait.
- What a qubit actually breaks: RSA, elliptic curves, and Shor's algorithm, explained from the ground up.
- The three new standards: ML-KEM, ML-DSA, SLH-DSA, what each does, and where they come from.
- Safe algorithms vs broken ones: a straight table, including one that was already cracked on a laptop.
- Where AI actually fits in, and where it doesn't.
- Labs and a free certificate to practise this yourself.
The problem in one sentence
Almost every encrypted connection on the internet, your bank, your email, this page, relies on a mathematical problem that is hard for an ordinary computer to solve and easy to check once solved: factoring a large number back into its two prime factors (RSA), or solving a related problem on an elliptic curve (ECC/ECDH). A sufficiently powerful quantum computer solves both efficiently, using a 1994 result called Shor's algorithm. Build that computer, and every RSA or ECC-protected secret, past and future, is readable.
"Harvest now, decrypt later." An attacker does not need a quantum computer today to benefit from one tomorrow. Intelligence agencies and criminal groups already record encrypted internet traffic in bulk and store it. The data sitting in that archive is exactly as secure as the day it was captured, until the day someone runs Shor's algorithm against it. Medical records, government communications and trade secrets that need to stay secret for decades are already exposed to a computer that doesn't exist yet.
What a qubit actually does to RSA
A normal computer bit is 0 or 1. A quantum bit, a qubit, can be in a combination of both at once, a property called superposition. Linking qubits together so their combinations interact, entanglement, lets a quantum computer explore many possible answers to a problem simultaneously instead of one at a time.
Shor's algorithm uses this to turn factoring a large number into a periodicity problem, finding a repeating pattern in a sequence, a task quantum interference is suited to. A classical computer trying to factor a 2048-bit RSA key would take longer than the age of the universe. A large enough fault-tolerant quantum computer running Shor's algorithm would take hours. The honest catch: nobody has built that computer. Current machines, like Google's 105-qubit Willow chip (2024), demonstrate that quantum error correction can work at all, which is itself a hard unsolved engineering problem; running Shor's algorithm against RSA-2048 is estimated to need millions of stable, error-corrected qubits. Today's largest machines have a few hundred noisy ones. Estimates for when that gap closes range from the early 2030s to never, which is exactly why "harvest now, decrypt later" is the operative threat, not "my bank gets hacked next Tuesday."
The three new standards
NIST ran an open competition starting in 2016, inviting cryptographers worldwide to submit and attack each other's candidate algorithms. On 13 August 2024, three survivors became official US federal standards:
- FIPS 203, ML-KEM (from a submission called Kyber). A key-establishment algorithm: two parties use it to agree on a shared secret key over a public channel, replacing RSA and ECDH for that job. It comes in three strengths: ML-KEM-512, -768 and -1024.
- FIPS 204, ML-DSA (from Dilithium). A digital signature algorithm, used to prove a message or piece of software came from whoever claims to have sent it, replacing RSA and ECDSA signatures.
- FIPS 205, SLH-DSA (from SPHINCS+). A second, structurally different signature algorithm, kept as a deliberate fallback. If someone eventually finds a flaw in the lattice maths behind ML-KEM and ML-DSA, SLH-DSA doesn't use lattices at all, so it survives.
Both ML-KEM and ML-DSA are built on lattice cryptography. A lattice is a regular grid of points stretching infinitely in many dimensions, often hundreds. The hard problem is: given a point that is close to the grid but not on it, find the nearest actual grid point. In low dimensions this is easy to picture and easy to solve; in several hundred dimensions it is believed to be hard for both classical and quantum computers. The private key is, loosely, a reference frame in which the grid looks simple; the public key is the same grid described awkwardly, so that the grid structure is nearly impossible to find without that private frame.
Safe algorithms, and ones that already failed
| Algorithm | Status | Why |
|---|---|---|
| RSA, ECC, ECDSA, Diffie-Hellman | Not quantum-safe | Broken in theory by Shor's algorithm once the hardware exists. Still fine against classical attackers today. |
| ML-KEM, ML-DSA, SLH-DSA | Standardised, safe | FIPS 203/204/205, finalised August 2024, survived an eight-year public attack competition. |
| HQC | Standardised backup, 2025 | A fourth algorithm NIST selected as a structurally different backup to ML-KEM, based on error-correcting codes rather than lattices. |
| SIKE / SIDH | Broken | A 2022 attack by Wouter Castryck and Thomas Decru recovered the private key on a single ordinary laptop core in about an hour. SIKE was a NIST round-4 candidate at the time. |
| Rainbow | Broken | A 2022 attack by Ward Beullens recovered Rainbow private keys in days on a laptop, after it had reached round 3 of the same NIST competition. |
Read that table again: two of NIST's own competition finalists, SIKE and Rainbow, were broken by other researchers before standardisation. That isn't an embarrassment, it's the process working. Post-quantum cryptography is unusually young, and "survived years of public attack" is the actual bar, not a guess.
Where it's already running
This isn't theoretical future-proofing. Signal added a post-quantum key exchange, PQXDH, to its messaging protocol in 2024. Apple shipped PQ3 in iMessage the same year. Chrome and Cloudflare began defaulting to a hybrid key exchange, classical X25519 combined with ML-KEM, so a break in either algorithm alone isn't enough. OpenSSH has defaulted to a hybrid post-quantum key exchange since 2022. The US National Security Agency's CNSA 2.0 mandate requires National Security Systems to be running ML-KEM and ML-DSA on a fixed migration timeline running out to 2033. None of this waits for Q-Day. The migration itself is the current work.
Where AI actually fits in
No AI model has broken ML-KEM, ML-DSA or SLH-DSA. Be suspicious of anyone claiming otherwise. The real AI risk in post-quantum cryptography isn't a smarter attacker, it's a careless assistant.
In 2025, researchers documented a security-critical flaw in a real HQC implementation: a decapsulation check, a step that verifies a decrypted value is actually valid before using it, was missing. The implementation still worked correctly on every normal input. It passed every functional test. The missing check sat there for nineteen months before anyone noticed it could be exploited (CRYPTO 2025, Stebila et al.). That is the exact shape of bug an AI coding agent introduces without anyone catching it: code that compiles, passes its tests, and is quietly wrong, because the thing it got wrong was never covered by a test in the first place.
CyberLearner's own PQ-01 lab is built around this precise failure mode: a fictional bank's AI coding assistant "simplifies" a lattice encryption library by removing its error term, because the maths is easier to debug without it. Every existing test still passes. The encryption still encrypts and decrypts correctly. It just no longer protects the private key, because without that error term the underlying problem stops being a lattice problem and becomes an ordinary system of linear equations, solvable with Gaussian elimination, the same technique taught in a first linear algebra course.
Practise it
CyberLearner runs a dedicated Post Quantum Cryptography category, plus earlier Crypto Intro labs that build the same lattice intuition at a smaller scale:
- PQ-01: QuietBank. Recover a bank's private key after its AI coding assistant removed the error term from an LWE-inspired construction. 15-20 minutes, Python only, no libraries. Not Kyber, not ML-KEM, an explicitly educational construction built to teach the exact mistake above.
- LWEZero. The same missing-error-term idea against a session service, one step closer to the raw mathematics.
- LWECrack. A vault using LWE with a deliberately tiny secret and tiny errors, both small enough to brute-force once you understand the structure.
- CI-04: NTRUVault. A real lattice scheme, NTRUEncrypt, with parameters set far too small to be secure.
- CI-05: SIDHVault. SIDH key exchange with Alice's auxiliary torsion point images exposed, the same category of information the real Castryck-Decru attack used against SIKE.
Finish any lab track and CyberLearner issues a free certificate for it, worth putting on a CV next to "understands why RSA has an expiry date."
Sources
- NIST FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard
- NIST FIPS 204: Module-Lattice-Based Digital Signature Standard
- NIST FIPS 205: Stateless Hash-Based Digital Signature Standard
- NIST: first three finalised post-quantum encryption standards, August 2024
- Castryck & Decru: the SIDH/SIKE structural break, 2022
- Beullens: the Rainbow signature break, 2022
- Stebila et al., CRYPTO 2025: verifiable decapsulation and the missing HQC check
- Signal: PQXDH post-quantum key exchange, 2024
- Apple: iMessage PQ3, 2024
- NSA: CNSA 2.0 timeline for National Security Systems
CyberLearner.org is a free cybersecurity training platform, built on the curriculum of the International Cybersecurity Olympiad (ICO). Every lab is hands-on and runs in your browser. It is open to everyone, regardless of skill level.