What Is Post-Quantum Cryptography and Why Does It Matter?

Somewhere right now, an adversary may be quietly copying your encrypted traffic. Not because they can read it today, but because they’re betting they’ll be able to in a few years (and patience, annoyingly, is a valid attack strategy). It’s called “harvest now, decrypt later,” and it’s the reason post-quantum cryptography stopped being a research curiosity and became a federal mandate. In June 2026, the White House signed an executive order giving federal agencies hard deadlines to migrate their cryptography by 2030 and 2031.

Big takeaway: Post-quantum cryptography is about future-proofing security. Because “we’ll deal with it later” is not a strategy. It’s a plan to get hacked on a schedule.

This is Part 1 of a two-part series. Here, we’ll cover what post-quantum cryptography is, how today’s encryption actually works, and why quantum computers represent a fundamentally different kind of threat to it. In Part 2, we’ll cover the new executive order, where the industry stands today, and what your security team should be doing right now.

What is Post-Quantum Cryptography?

Post-quantum cryptography (PQC) is a set of cryptographic algorithms designed to resist attacks from quantum computers. It’s not a single product or protocol, but an entire generation of replacement math for the cryptographic systems that the internet currently runs on. This is built specifically so that even a powerful quantum computer can’t break them the way it could break what we use today.

To understand why that replacement is necessary, it helps to start with how cryptography works right now.

How Cryptography Works Today

Encryption is the process of scrambling readable information (plaintext) into unreadable, scrambled text (called ciphertext) so that only the intended person can read it. There are two key methods of encryption: symmetric encryption and asymmetric encryption.

Symmetric encryption uses one single key to both lock (encrypt) and unlock (decrypt) the data. Think of it like a house key. You can lock and unlock the door using the same key.

Asymmetric encryption uses two different keys: a public key, which anyone can see, and a private key, which only you have. One key locks the data, and only the matching private key can unlock it. This is also called public-key cryptography.

These two methods work together. When you visit a secure website, asymmetric encryption is used first to confirm the website is genuine and to safely agree on a shared secret. Then symmetric encryption takes over to protect the actual data flowing back and forth, since it’s much faster. Asymmetric encryption is also what makes digital signatures possible, which confirm that a software update, an email, or an online payment really came from who it claims to be.

Both encryption types rely on the same basic idea: certain math problems are easy to solve in one direction, but extremely difficult to reverse. At least, in the case of a regular computer. Two well-known examples of this:

• RSA, one of the oldest and most widely used encryption methods, relies on how difficult it is to find the two original prime numbers that were multiplied together to make a very large number.
• ECC (Elliptic Curve Cryptography) relies on a different but similarly one-way math problem involving points on a curve.

Both RSA and ECC have protected our data successfully for decades, because regular computers simply can’t reverse that math in any reasonable amount of time. That’s exactly what’s about to change.

What Makes Quantum Computers a Different Kind of Threat

Classical Computers vs Quantum Computers

The computers we use every day, like our laptops and phones, are called classical computers. They process information as bits, which are either a 0 or a 1, one calculation at a time for sequential, deterministic calculations. This makes them great for day-to-day tasks, database management, and hosting.

Quantum computers work differently. Instead of bits, they use qubits, which exist in multiple states simultaneously (a property called superposition), to solve complex, high-dimensional problems exponentially faster than classical computers. This makes them great for specific, advanced simulation and optimization. But what makes them great, unfortunately, is the exact kind of math that RSA and ECC depend on.

“Faster” in the case of quantum computers, isn’t like a faster version of your laptop where your emails open quicker or a video renders faster. The advantage here only shows up on a small set of specific problems, and breaking encryption happens to be one of them. Of course it does.

The most important quantum algorithms to know:

• Shor’s algorithm - created by mathematician Peter Shor in 1994, shows mathematically that a powerful enough quantum computer could solve the exact problems RSA and ECC rely on, and quickly.
• Grover’s algorithm - speeds up brute-force guessing attacks against symmetric encryption (like AES, the standard symmetric encryption method used today).

The fix for Grover’s algorithm is simpler: using a longer key restores the original level of security. That’s a big reason most of the urgency around PQC is focused on asymmetric encryption (RSA and ECC), not symmetric encryption.

Quantum Computing's Impact on Encryption

Quantum computers today aren’t yet powerful enough to actually run Shor’s algorithm against real-world encryption. That would require a large, stable, error-free quantum computer. Most researchers believe that’s still years away, though that may change as technology improves.

So why do we need to act now, if the threat isn’t here yet? Because of the “harvest now, decrypt later” we mentioned earlier. A patient, well-funded attacker doesn’t need a working quantum computer today. They just need to collect and store encrypted data now and wait. Years down the line, once quantum computers are powerful enough, they can go back and unlock everything they’ve been quietly hoarding.

This especially matters for data that needs to stay secret for a long time, like government records, trade secrets, medical records, and the like. If your data needs to remain confidential for the next 10 or 15 years, the relevant question isn’t “when will quantum computers be a threat?” It’s “is my data already being collected today to be unlocked later?” Deeply uncomfortable question. Ask it anyway.

Between how long your data needs to stay secret and how long it will take to upgrade your systems, the actual deadline for taking action is a lot sooner than you’d like it to be.

How Post-Quantum Cryptography Works

PQC is built to resist exactly the kind of attack Shor’s algorithm represents. Think of it like a giant, messy LEGO pile where finding the right piece is still extremely hard, no matter how smart or how fast you are at searching.

Instead of relying on the math problems that RSA and ECC use (which quantum computers can solve), PQC relies on different math problems that, as far as current research shows, stay hard to solve even for quantum computers. The main approaches include:

• Lattice-based cryptography: based on the difficulty of finding a specific point hidden within an enormous, many-dimensional grid. Picture that LEGO pile again, except it exists in hundreds of dimensions at once, with no shortcuts. This approach forms the basis of most of the new official standards.
• Hash-based cryptography: builds digital signatures using hash functions, a much older and extremely well-tested type of math. It’s a more conservative, “better safe than fancy” approach.
• Code-based cryptography: based on the difficulty of decoding a type of scrambled message (error-correcting codes), a problem that’s been studied since the 1970s without anyone finding an efficient way to crack it.

NIST and PQC

In August 2024, the National Institute of Standards and Technology (NIST), the U.S. government agency responsible for setting official cryptography standards, finalized the first three official PQC standards, after an eight-year public review process:

(“FIPS” stands for Federal Information Processing Standard, the official label NIST uses for government-approved technical standards)

A fourth standard, called FN-DSA, is still being finalized and is expected sometime in late 2026 or early 2027. It produces especially small digital signatures. Useful for devices with limited bandwidth, but it’s taken longer to finalize because it’s trickier to implement correctly.

One more detail worth knowing: many organizations aren’t switching to the new PQC algorithms all at once. Instead, they are using hybrid encryption. Hybrid encryption combines an older method (like ECC) with a new PQC method (like ML-KEM) at the same time. That way, an attacker would have to break both methods to succeed, which adds a safety net in case any brand-new PQC algorithm turns out to have an undiscovered weakness.

Up Next: The Mandate and the Migration

So now you know what PQC is, why it matters, and what the new methods look like.

The foundation is there. What changed recently is that the industry got a deadline. Not a vague “we should do this eventually” kind of deadline. A real one, with dates and federal backing behind it.

Part 2 is where it gets real: the executive order behind it, what it means even if you’re not a federal agency, the concrete steps your team should be taking right now, and answers to the questions most organizations are already asking.