Post-quantum cryptography
In cryptography, post-quantum cryptography is the family of algorithms designed to remain secure against an attacker with a large quantum computer, which would break the public-key schemes protecting most traffic today. It is the boardroom question of the moment, and the answer depends on how long a given piece of data has to stay confidential.
How it works
The public-key algorithms in wide use today (RSA and elliptic-curve schemes) rest on mathematical problems that a sufficiently large quantum computer could solve efficiently, which would break key exchange and digital signatures as they work now. Symmetric cryptography is affected far less: doubling a key size restores the margin. Post-quantum cryptography replaces the vulnerable public-key schemes with ones based on problems believed to resist quantum attack. NIST completed the first standards for this in 2024, selecting ML-KEM for key establishment and ML-DSA for signatures, with a further hash-based signature scheme; these are being integrated into TLS and the wider public key infrastructure, often in a hybrid mode that combines a classical and a post-quantum algorithm during transition.
What goes wrong
The threat that makes this urgent now, before any capable quantum computer exists, is “harvest now, decrypt later”: an adversary records encrypted traffic today and stores it, betting on decrypting it once the hardware arrives. For data whose confidentiality must last many years, that clock has already started, which is why long-lived secrets are the first candidates for migration. The mistake in the other direction is treating post-quantum as an emergency for everything at once: symmetric encryption and short-lived session data are far less exposed. The honest position is that the standards are set and adoption is beginning, which is not the same as a date that forces a specific action.
Where this shows up in an audit
Post-quantum readiness appears in an assessment as a forward-looking question, framed by what is verifiable rather than by a scare figure: which long-lived confidential data is protected only by classical public-key cryptography, where encryption in transit and key wrapping such as envelope encryption rely on the schemes that are being replaced, and whether the organisation has an inventory of its cryptography to migrate at all. The recommendation is to build that inventory and prioritise the data with the longest confidentiality lifetime, since that is the data the “harvest now” threat targets first.