30 essential terms across cryptography, threats, standards, protocols, organisations and concepts.
Algorithms & cryptographic schemes
CRYSTALS-Kyber (ML-KEM)
A lattice-based key encapsulation mechanism standardised by NIST as FIPS 203. Based on the hardness of the Module Learning With Errors (MLWE) problem. It is the primary post-quantum algorithm for key exchange and encryption, and the one most widely deployed in TLS today.
CRYSTALS-Dilithium (ML-DSA)
A lattice-based digital signature scheme standardised as FIPS 204. It replaces RSA and ECDSA for signing certificates, code, and authentication tokens. The recommended choice for most general-purpose signature use cases.
SPHINCS+ (SLH-DSA)
A stateless hash-based digital signature scheme standardised as FIPS 205. Unlike lattice-based schemes, its security depends only on hash functions, one of the oldest and best-understood primitives in cryptography. Conservative choice for root CAs and long-lived signatures.
FALCON (FN-DSA)
A lattice-based signature scheme standardised as FIPS 206. It produces significantly smaller signatures than Dilithium, making it attractive for bandwidth-constrained environments like IoT devices and embedded systems.
Lattice-based cryptography
A family of cryptographic constructions based on computational problems over mathematical lattices, such as Learning With Errors (LWE). These problems are believed to be hard for both classical and quantum computers, and form the basis of most NIST-standardised PQC algorithms.
Hash-based cryptography
Cryptographic schemes whose security relies entirely on the properties of hash functions. No exotic mathematics involved, just well-understood primitives applied carefully. Includes SPHINCS+, XMSS, and LMS.
Threats & attack models
Shor’s algorithm
A quantum algorithm published by Peter Shor in 1994 that can efficiently factor large integers and compute discrete logarithms. It breaks RSA, DSA, Diffie-Hellman, and ECC, the mathematical foundations of essentially all current public-key infrastructure. This is the core reason post-quantum cryptography exists.
Grover’s algorithm
A quantum algorithm that provides a quadratic speedup for searching unsorted databases. Applied to symmetric cryptography, it effectively halves the security level: AES-128 would offer only 64-bit quantum security. The fix is simple, use AES-256, which is why symmetric encryption is not the urgent problem.
Harvest now, decrypt later (HNDL)
An attack in which an adversary intercepts and stores encrypted data today, intending to decrypt it once a cryptographically relevant quantum computer becomes available. No current capability to break encryption is required, only the ability to capture traffic at scale. Nation-state actors are believed to be doing this now.
Cryptographically relevant quantum computer (CRQC)
A quantum computer powerful and reliable enough to run Shor’s algorithm against real-world key sizes, breaking RSA-2048 or ECDSA P-256 in practical time. Most estimates place the arrival of a CRQC between 2030 and 2035, though there is genuine uncertainty in both directions.
Quantum supremacy / quantum advantage
Quantum supremacy refers to a quantum computer outperforming classical computers on a specific task. Google claimed this in 2019. Neither this nor quantum advantage implies cryptographic relevance. Today’s quantum computers are nowhere near capable of running Shor’s algorithm at the required scale.
Standards & frameworks
FIPS 203
The NIST standard defining ML-KEM, the primary post-quantum key encapsulation mechanism based on CRYSTALS-Kyber. Published August 2024 after an eight-year evaluation process. This is the algorithm that replaces Diffie-Hellman and ECDH in TLS and other key exchange protocols.
FIPS 204
The NIST standard defining ML-DSA, the primary post-quantum digital signature algorithm based on CRYSTALS-Dilithium. Published August 2024. Replaces RSA and ECDSA for certificate signing, code signing, and authentication.
FIPS 205
The NIST standard defining SLH-DSA, a hash-based signature scheme based on SPHINCS+. Published August 2024 as a conservative backup to lattice-based signatures. Recommended for long-lived signatures and root CAs where maximum conservatism is warranted.
NIST PQC standardisation project
A process launched by NIST in 2016 to evaluate and standardise post-quantum cryptographic algorithms. 69 algorithms were submitted. After six years of global cryptographic review across four rounds, FIPS 203 to 205 were finalised in August 2024.
NSA CNSA 2.0
The US National Security Agency’s Commercial National Security Algorithm Suite 2.0, published in 2022. The first government mandate with hard post-quantum migration deadlines, from 2025 for new software to 2033 for full migration of all national security systems.
Protocols & mechanisms
Quantum key distribution (QKD)
A method of distributing cryptographic keys using the principles of quantum mechanics. Any eavesdropping attempt disturbs the quantum states and can be detected. Provides information-theoretic security, but requires specialised optical hardware and dedicated fibre links. It does not run over the internet.
Hybrid cryptography
Running a classical algorithm (e.g. X25519) and a post-quantum algorithm (e.g. ML-KEM) in parallel, combining their outputs. If either algorithm is secure, the combined scheme is secure. The recommended transitional approach during PQC migration. You get quantum protection without betting everything on a new algorithm.
Key encapsulation mechanism (KEM)
A cryptographic primitive used to securely transmit a symmetric key under a public key. ML-KEM is the post-quantum KEM standardised by NIST, replacing Diffie-Hellman key exchange in TLS, SSH, and IPsec.
TLS 1.3 + PQC
An extension of the TLS 1.3 handshake incorporating post-quantum key exchange via ML-KEM. Google Chrome and Cloudflare have deployed hybrid TLS 1.3 with ML-KEM in production since 2024. This is the most impactful first step organisations can take.
Concepts & migration
Cryptographic agility
The design principle of building systems that can swap cryptographic algorithms without requiring a full redesign. Systems without it will require expensive rewrites to migrate to post-quantum algorithms. Systems with it can migrate via a configuration change and a library update.
Cryptographic inventory
A comprehensive catalogue of all cryptographic assets in an organisation: algorithms, key lengths, certificates, protocols, libraries, and dependencies. The essential first step in any post-quantum migration programme. You cannot migrate what you have not found.
Cryptographic Bill of Materials (CBOM)
A structured inventory of all cryptographic dependencies in a software component, analogous to a software bill of materials. Introduced by NIST as a tool for assessing migration scope and tracking which algorithms are used where across a codebase.
Post-quantum migration
The process of transitioning cryptographic systems from classical algorithms vulnerable to quantum attacks to post-quantum algorithms. Involves discovery, prioritisation, testing and phased deployment. Most large organisations need three to seven years to complete it.
Security level (NIST)
NIST defines five security levels for PQC algorithms. Level 1 is equivalent to the cost of breaking AES-128. Level 3 to AES-192. Level 5 to AES-256. Most enterprise applications are recommended to use at least Level 3 parameter sets.
Organisations & bodies
NIST
The US National Institute of Standards and Technology. Responsible for developing cryptographic standards including the FIPS series. Led the eight-year post-quantum standardisation project that produced FIPS 203 to 205 in 2024. Its standards carry de facto global weight.
ETSI
The European Telecommunications Standards Institute. Developing post-quantum cryptography standards and migration guidance through its Quantum Safe Cryptography working group (ISG QSC). Particularly active in defining PQC profiles for telecom and financial sector protocols.
BSI
Germany’s Bundesamt für Sicherheit in der Informationstechnik, the federal cybersecurity authority. One of the most active European bodies on post-quantum guidance. Has published explicit migration recommendations and set a 2030 target for German federal systems.
ENISA
The EU Agency for Cybersecurity. Has published multiple reports on post-quantum cryptography implications for EU critical infrastructure and NIS2-regulated sectors. A key reference for European organisations assessing their regulatory exposure.