Non-graded · offline · explore at your own pace

Replacing the math before the quantum computer arrives

Shor's algorithm breaks RSA, Diffie-Hellman, and elliptic-curve cryptography, which together protect almost every secure connection on the internet. No quantum computer can do that yet. But encrypted data recorded today can be decrypted later, so the replacement has to happen first. That replacement is post-quantum cryptography.

Sinclair College - Dr. Mike Libassi

Post-quantum cryptography (PQC) — algorithms that run on ordinary computers today but rely on math problems that neither classical nor quantum computers are known to solve efficiently. Not to be confused with quantum cryptography (QKD), which needs quantum hardware.

BROKEN BY SHOR'S ALGORITHM

RSA · DH · ECDH · ECDSA · Ed25519

Factoring and discrete logarithms: the public-key layer.

WEAKENED BY GROVER'S ALGORITHM

AES · SHA-2 · SHA-3

Symmetric ciphers and hashes: fixed by using longer keys and outputs.

01 · The threat model

Harvest now, decrypt later

An attacker doesn't need a quantum computer today to cause harm later. They can record encrypted traffic now and store it until a cryptographically relevant quantum computer exists. Anything that must stay secret for years, such as medical records, government data, or trade secrets, is already exposed to this risk.

CRQC (cryptographically relevant quantum computer) — a quantum computer large and reliable enough to run Shor's algorithm against real key sizes like RSA-2048. None exists today.

KEY EXCHANGE: URGENT

Recorded sessions can be decrypted later. This is why encryption is being migrated first.

SIGNATURES: LESS URGENT

A forged signature only matters once a CRQC exists, but long-lived roots of trust (firmware, certificates) take years to replace.

02 · Symmetric crypto

Grover's algorithm roughly halves the key-search exponent

Grover's algorithm searches an unsorted space of 2ⁿ possibilities in roughly 2^n/2 steps. Applied to brute-forcing a key, 2¹²⁸ classical tries become about 2⁶⁴ quantum steps in the idealized count. That isn't the same as a classical 64-bit search: each step is slow, error-corrected, and must run one after another, so the real cost is far higher. The defense is simple: use longer keys.

Grover's algorithm (1996) — a quantum search algorithm with a quadratic (square-root) speedup. It's provably optimal: no quantum algorithm can brute-force a key faster. Its steps must also run one after another, which limits it in practice.

Try it: choose a key length

Compare a classical brute-force search with Grover's search.

symmetric key length128 bits

CLASSICAL BRUTE FORCE

GROVER ITERATIONS

classical security

post-quantum security

Hashes aren't hit the same way

Preimages (finding an input that produces a given n-bit hash) are a search problem, so Grover cuts them the same way it cuts keys: about 2^n/2 steps. Collisions (finding any two inputs with the same hash) are different. Classically they already take about 2^n/2 tries thanks to the birthday paradox. A quantum algorithm (Brassard–Høyer–Tapp) needs only about 2^n/3 queries on paper, but it needs an enormous quantum memory, and counting that hardware cost it isn't believed to beat the classical attack. SHA-256 keeps roughly 128-bit collision resistance.

03 · The core idea

Hard problems with a little noise: learning with errors

ML-KEM and ML-DSA are built on learning with errors (LWE). Solving a system of linear equations is easy; high school algebra does it. Add the right kind of small random error to each equation, with carefully chosen sizes, and the system becomes extremely hard to solve, for classical and quantum computers alike, once there are hundreds of unknowns. Adding noise to just any system of equations doesn't make it quantum-resistant.

Learning with errors — given many equations a·s + e = b (mod q), where s is secret and each e is small random noise, recover s. It reduces to hard problems on high-dimensional lattices. ML-KEM-768 hides a secret made of 3 polynomials with 256 coefficients each: 768 unknown numbers modulo q = 3329. Its equations have extra structure (module-LWE) that keeps keys compact, so the simple equation in the demo shows the idea, not the exact standardized math. The "768" is not bits of security; ML-KEM-768 targets NIST security category 3, comparable to AES-192.

Try it: recover the secret (s₁, s₂), with and without noise

Four equations mod 17. Use elimination on the first two equations, then check whether the answer fits the other two. Toggle the noise and try again.

add noise (e = −1, 0, or +1)

your guess s₁ s₂

Scale is everything: with 2 unknowns mod 17 you could try all 289 combinations by hand. With 768 unknowns mod 3329, there are more possibilities than atoms in the universe, and the noise blocks the algebra shortcuts. Shor's period-finding trick doesn't apply, because there's no repeating structure to find.

04 · The standards

NIST's post-quantum toolkit

Click an algorithm for its role and status.

Try it: compare the sizes

Post-quantum security costs bandwidth. Sizes in bytes; cyan is the public key, amber is the ciphertext or signature.

05 · When to start

Mosca's inequality

Michele Mosca framed the timing question as simple arithmetic. Let x be how long your data must stay secret, y how long migration will take, and z the years until a CRQC exists. If x + y > z, your data will still be sensitive when it becomes readable, and you're already late.

Try it: plug in your own numbers

Nobody knows z. Try a cautious and an optimistic estimate.

x · data shelf life (years)

y · migration time (years)

z · years until a CRQC

CRQC

today+15 yrs+30 yrs+45 yrs

06 · Migration

How organizations are switching

Inventory. Find every place public-key crypto is used: TLS, VPNs, SSH, code signing, certificates, firmware, hardware security modules, and vendor products.

Prioritize. Start with long-lived secrets and key exchange, where harvest-now-decrypt-later applies.

Go hybrid. Combine a classical algorithm with a post-quantum one so the connection stays secure if either holds. As of 2026, Chrome and Edge (since late 2024), with Firefox and Apple platforms following, use hybrid X25519 + ML-KEM key exchange in TLS by default. Check current vendor documentation, since this changes quickly.

Build crypto agility. Design systems so algorithms can be swapped through configuration rather than rewrites. The next migration should be easier than this one.

NIST's draft transition plan (IR 8547, initial public draft, Nov 2024) proposes deprecating today's quantum-vulnerable public-key algorithms after 2030 and disallowing them after 2035. These dates are provisional until the plan is final. The NSA's CNSA 2.0 sets its own deadlines for national security systems, which vary by system type, and requires AES-256.

Two answers to one problem: PQC (this page) changes the math and runs on existing hardware. QKD (page 07) changes the physics and needs special equipment. Most government guidance today favors PQC for broad deployment.