Taking the FUD out of PQC

“But Mike… there is no FUD in Post-Quantum Cryptography.”

I’m glad you brought that up, because that’s exactly what this post is about.

When people hear the term Post-Quantum Cryptography (PQC), the conversation often goes in one of two directions. Some claim that quantum computers are still decades away and that there’s nothing to worry about. Others make it sound as if RSA will stop working sometime next Tuesday, neither view tells the whole story. The reality is far more interesting, and far more nuanced than many have you believe, Post-Quantum Cryptography isn’t about fear, uncertainty, or doubt. It’s about understanding the actual risks, separating scientific facts from headlines, and making informed architectural decisions based on evidence rather than speculation.

So, let’s take the FUD out of the discussion. In this blog, we’ll look at what current research actually tells us about quantum computers, why symmetric encryption such as AES is in a very different position than RSA and ECC, who is realistically capable of building a cryptographically relevant quantum computer, and why organizations should begin preparing today, even though the first machine capable of breaking modern public key cryptography is unlikely to appear in your local datacenter anytime soon. Because the real challenge isn’t that quantum computers are coming. The real challenge is making sure your organization is ready when they do.

Before we start…

A quick apology up front, this article turned out to be considerably longer than I originally intended. Normally, I try to keep my blog posts fairly concise. However, every time I thought “this deserves just one more explanation”, another important piece of the puzzle appeared. Rather than oversimplifying the topic, I decided to be thorough. My hope is that by the end of this article you’ll not only understand what the quantum threat is, but also what it isn’t, and perhaps more importantly, why organizations should start preparing today without falling into the trap of Fear, Uncertainty and Doubt. So, if you’ve made it this far… grab a coffee, settle in, and let’s take the FUD out of PQC. Let’s have it!

About this article

This article is based on peer-reviewed scientific research, publications from standards organizations, and official guidance from government agencies. References are provided throughout the text using APA-style citations, with a complete bibliography included at the end.

Quantum computing is real

Hardly a week goes by without another headline on LinkedIn announcing a new quantum computing breakthrough. One day it’s a new qubit record, the next it’s a faster processor, and before long the inevitable conclusion appears: quantum computers will soon break all encryption.

While these headlines often contain a grain of truth, they rarely provide the context needed to understand what is actually happening. To understand why Post-Quantum Cryptography (PQC) is receiving so much attention, it’s important to realize that quantum computing does not threaten all cryptography equally. In fact, the impact depends entirely on the type of cryptographic algorithm being used. Today’s cryptographic systems can broadly be divided into two categories:

The first category is symmetric cryptography, where the same secret key is used for both encryption and decryption. Well-known examples include the Advanced Encryption Standard (AES), which protects everything from BitLocker volumes and VPN tunnels to TLS session traffic.

The second category is asymmetric cryptography, also known as public key cryptography. These algorithms use mathematically related public and private keys to perform operations such as authentication, digital signatures and key establishment. Common examples include RSA and Elliptic Curve Cryptography (ECC), both of which form the foundation of today’s Public Key Infrastructure (PKI). This distinction is crucial because quantum computers attack these two categories in fundamentally different ways.

For symmetric cryptography, the best-known quantum attack is Grover’s algorithm, first published by Lov Grover in 1996 (Grover, 1996). Rather than completely breaking AES, Grover’s algorithm provides a quadratic speed-up for brute-force key searches. Although significant from a theoretical perspective, this still leaves AES-256 with an effective security level of approximately 128 bits, an astronomically large search space by any practical standard. Public key cryptography tells a very different story.

In 1994, Peter Shor introduced what is now known as Shor’s algorithm, demonstrating that sufficiently powerful quantum computers could efficiently solve the mathematical problems upon which RSA, ECC and Diffie-Hellman rely (Shor, 1994). Unlike Grover’s algorithm, Shor’s algorithm doesn’t simply make existing attacks faster, it fundamentally changes the complexity of the problem itself. As a result, algorithms that are considered computationally infeasible to break on classical computers become theoretically vulnerable on a sufficiently large, fault-tolerant quantum computer. This difference explains why the security community is not rushing to replace AES, while at the same time investing enormous effort into replacing RSA and ECC with post-quantum alternatives such as ML-KEM and ML-DSA.

So, what I’m trying to say is that quantum computing is not a universal threat to cryptography. It is a highly specific threat to certain mathematical problems that underpin today’s public key infrastructure. Understanding that distinction is the first step toward separating scientific reality from the fear, uncertainty and doubt that often surrounds discussions about Post-Quantum Cryptography.

What the research says

One of the most common misconceptions is that quantum computers will “break encryption.” The research paints a much more nuanced picture. Grover’s algorithm provides only a quadratic improvement against symmetric cryptography, while Shor’s algorithm fundamentally changes the security assumptions behind public key cryptography. The consequence is that AES remains practically secure with appropriate key sizes, whereas RSA and ECC ultimately require replacement rather than larger keys (Grover, 1996; Shor, 1994). I’m not making this up, it’s based on research that proves the point.

AES is not broken

One of the biggest misconceptions surrounding quantum computing is the belief that all encryption will become obsolete once sufficiently powerful quantum computers become available, it’s most definitely not. To understand why, we first need to look at how symmetric encryption actually works.

Unlike public key cryptography, symmetric cryptography uses a single shared secret key for both encryption and decryption. Both communicating parties must possess the same key, making secure key distribution the primary challenge. Once the key has been exchanged, however, symmetric algorithms are remarkably efficient and are capable of encrypting enormous amounts of data with relatively little computational effort. The most widely deployed symmetric encryption algorithm today is the Advanced Encryption Standard (AES). It is used extensively throughout modern IT infrastructures, including TLS session encryption, BitLocker, VPN technologies, Wi-Fi security, database encryption and numerous other applications. Unlike RSA or ECC, there is currently no known mathematical shortcut that allows an attacker to recover an AES key. The only generic attack remains what cryptographers refer to as a brute-force attack, systematically trying every possible key until the correct one is found. For a classical computer, the search space is enormous.

Algorithm	Possible Keys
AES-128	2¹²⁸
AES-256	2²⁵⁶

To put this into perspective, 2²⁵⁶ is approximately: 115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,913,129,639,936 (Crazy long!)

Clearly, brute-forcing AES-256 using classical computers is simply not a realistic proposition.

Enter Grover’s algorithm

Quantum computers do offer an advantage against symmetric cryptography, but that advantage is frequently misunderstood. In 1996, Lov Grover introduced what is now known as Grover’s algorithm, a quantum search algorithm capable of reducing the complexity of exhaustive key searches from approximately 2ⁿ to 2ⁿ⁄² (Grover, 1996).

Did you notice what does not happen? Grover’s algorithm does not suddenly make AES easy to break. Instead, it effectively halves the security strength measured in bits.

Algorithm	Classical Security	Effective Quantum Security
AES-128	128 bits	~64 bits
AES-256	256 bits	~128 bits

This is precisely why modern security guidance increasingly recommends AES-256 when preparing for the post-quantum era. Although Grover’s algorithm significantly reduces the search space from a theoretical perspective, an effective security level of 128 bits remains extraordinarily strong and is still considered sufficient for protecting highly sensitive information (NIST, 2024).

A practical example

Numbers like 2¹²⁸ are difficult to visualize, so let’s make the problem more tangible. Imagine a future fault-tolerant quantum computer capable of performing one billion Grover search iterations every second. Even under this highly optimistic assumption, brute-forcing AES-256 would still require approximately:

3.9 × 10²⁴ days

For comparison:

• The Earth is approximately 4.5 billion years old.
• The observable universe is approximately 13.8 billion years old.

Even these timescales become insignificant compared to the effort required to exhaust the effective AES-256 key space. The exact numbers are less important than the conclusion, Grover’s algorithm certainly improves brute-force attacks, but it does not transform AES-256 into a practically breakable cipher. This distinction explains why the cryptographic community is not rushing to replace AES in the same way it is replacing RSA and ECC. Instead, most post-quantum migration strategies focus on replacing public key cryptography, while continuing to rely on symmetric algorithms such as AES-256 for data encryption. Symmetric cryptography remains one of the strongest building blocks in modern cryptography, even in the presence of quantum computers.

What the research says

Quantum computing does affect symmetric cryptography, but far less dramatically than public key cryptography. Grover’s algorithm provides a quadratic speed-up for exhaustive key searches rather than the exponential improvements offered by Shor’s algorithm against RSA and ECC. Consequently, doubling the symmetric key size, from AES-128 to AES-256, largely compensates for the theoretical quantum advantage and remains consistent with current guidance from NIST (Grover, 1996; NIST, 2024).

Reality check

A quantum computer capable of breaking RSA is not automatically capable of brute-forcing AES-256 within any practical timeframe. While Shor’s algorithm fundamentally undermines the mathematics behind public key cryptography, Grover’s algorithm merely reduces the search effort required for brute-force attacks. The difference is beyond huge and understanding that distinction is essential when discussing the real impact of quantum computing.

Why RSA and ECC are different

After reading the previous chapter, you might reasonably ask yourself:

“If AES survives quantum computing with larger key sizes, why can’t we simply do the same for RSA and ECC?”

It’s an excellent question, and the answer lies in the mathematics that underpin these algorithms. Unlike symmetric cryptography, public key cryptography does not rely on the secrecy of a shared key. Instead, its security is based on mathematical problems that are considered computationally infeasible to solve using classical computers, big difference. For RSA, that problem is integer factorisation. What now? Two very large prime numbers are multiplied together to produce a modulus that forms part of the public key (see my blog on Cryptography for non-math people). Multiplying those numbers is computationally easy. Reversing the process, determining the original prime numbers from the resulting modulus, is believed to be computationally infeasible once the numbers become sufficiently large. This asymmetry is exactly what gives RSA its security.

Elliptic Curve Cryptography (ECC) relies on a different mathematical problem known as the Elliptic Curve Discrete Logarithm Problem (ECDLP). Rather than factoring large integers, ECC depends on the difficulty of determining an unknown scalar used during elliptic curve point multiplication. Although the underlying mathematics is entirely different, both RSA and ECC share one critical property:

Their security depends on mathematical problems that are considered computationally infeasible for classical computers to solve.

Enter Shor’s algorithm

This assumption changed dramatically in 1994. Peter Shor demonstrated that a sufficiently powerful quantum computer could efficiently solve both integer factorisation and discrete logarithm problems using what is now known as Shor’s algorithm (Shor, 1994). This represents a fundamentally different type of attack than Grover’s algorithm. Grover accelerates brute-force searching, Shor eliminates the mathematical hardness upon which RSA and ECC depend. In other words, Shor doesn’t make existing attacks faster, it changes the rules of the game entirely. This distinction cannot be overstated. Once a sufficiently large fault-tolerant quantum computer becomes available, the mathematical problems protecting RSA and ECC are no longer practically difficult. They become efficiently solvable.

Why bigger keys don’t solve the problem

Historically, advances in classical computing have been addressed by increasing key sizes. When 1024-bit RSA became insufficient, the industry migrated to RSA-2048. As computational power continued to grow, many organizations adopted RSA-3072 or RSA-4096 to maintain an appropriate security margin. This strategy works because classical attacks become exponentially more expensive as key sizes increase. Quantum computing fundamentally changes that equation.

Since Shor’s algorithm directly targets the mathematical foundation of RSA and ECC, increasing key sizes merely increases the amount of computation required by the quantum algorithm, it does not restore the original security assumptions. Larger RSA keys may delay the inevitable, but they do not eliminate the underlying vulnerability. This is precisely why organizations are not planning to migrate from RSA-2048 to RSA-8192. Instead, they are replacing the entire class of algorithms with cryptographic schemes based on completely different mathematical problems, such as lattices, error-correcting codes and hash-based constructions.

Comparing the Impact

The different impact of quantum computing on symmetric and asymmetric cryptography can be summarized as follows.

Algorithm	Security Based On	Quantum Algorithm	Practical Impact
AES	Exhaustive key search	Grover	Quadratic speed-up. Larger keys largely compensate for the quantum advantage.
RSA	Integer factorisation	Shor	Mathematical problem becomes efficiently solvable. Replacement required.
ECC	Discrete logarithms	Shor	Mathematical problem becomes efficiently solvable. Replacement required.

For symmetric cryptography, quantum computing reduces the security margin. For public key cryptography, quantum computing removes the mathematical assumption upon which security is built. That difference explains why AES continues to play a central role in the post-quantum era, while RSA and ECC are gradually being replaced by algorithms specifically designed to resist quantum attacks.

What the research says

Research consistently distinguishes between the impact of Grover’s and Shor’s algorithms. Grover’s algorithm provides only a quadratic speed-up for exhaustive search, whereas Shor’s algorithm efficiently solves integer factorisation and discrete logarithm problems, the mathematical foundations of RSA and ECC. This distinction is the primary reason why current post-quantum standardisation efforts focus on replacing public key algorithms while retaining symmetric encryption with appropriately sized keys (Shor, 1994; Grover, 1996; NIST, 2024).

Reality check

Increasing the size of an RSA key is not equivalent to increasing the size of an AES key. Larger AES keys compensate for Grover’s algorithm by increasing the search space. Larger RSA keys, however, remain vulnerable because Shor’s algorithm attacks the underlying mathematical problem itself rather than the size of the key.

What do we mean with a Cryptographically relevant Quantum Computer?

If you’ve followed quantum computing news over the past few years, you’ve probably noticed a recurring trend, “Company X announces a new quantum processor with over 1,000 qubits.”

At first glance, that sounds alarming. If a thousand qubits exist today, and quantum computers threaten RSA, are we already close to the point where modern cryptography becomes obsolete? Well, no. The reason is that not all qubits are created equal. Understanding the difference between physical qubits and logical qubits is perhaps the single most important concept in understanding the real quantum threat.

Physical Qubits

A physical qubit is the basic building block of a quantum computer. Unlike a classical bit, which stores either a zero or a one, a qubit can exist in a quantum superposition of both states. This unique property allows quantum computers to solve certain classes of mathematical problems far more efficiently than classical computers. Unfortunately, qubits are also extremely fragile. Even tiny disturbances from their surrounding environment, such as heat, electromagnetic interference or cosmic radiation, can introduce errors into quantum calculations. These errors accumulate rapidly, making long and complex computations impossible on today’s hardware. Simply put, today’s quantum processors are noisy.

Error correction is key

Breaking RSA-2048 is not a computation that finishes in a few milliseconds. It requires an enormous number of sequential quantum operations, each of which must produce the correct result. If even a small percentage of those operations fail, the entire computation becomes unreliable. This is where Quantum Error Correction (QEC) comes into play. Rather than relying on a single physical qubit, quantum error correction encodes one reliable computational unit across many physical qubits. By continuously detecting and correcting errors during computation, the system behaves as though it contains far more stable qubits than the underlying hardware actually provides. These stable computational units are known as logical qubits.

Physical versus logical qubits

A useful way to think about the relationship is to compare it with RAID storage, well at least this is how it works in my mind. One hard drive can fail unexpectedly. A RAID array combines multiple disks to create a storage system that is significantly more reliable than any individual drive. Quantum error correction follows a similar principle.

Many unreliable physical qubits work together to produce a single reliable logical qubit capable of performing long computations. The exact ratio depends on the hardware architecture and error rates, but it is entirely possible that hundreds, or even thousands, of physical qubits are required to create a single logical qubit suitable for cryptographic applications. This is one of the reasons why headlines announcing “1,000 qubits” should be interpreted with caution.

Fault-tolerant quantum computing

A fault-tolerant quantum computer is one that can continue performing extremely long calculations while continuously detecting and correcting errors. This is fundamentally different from today’s noisy intermediate-scale quantum (NISQ) devices, which are primarily intended for research and experimentation. When researchers discuss the possibility of breaking RSA-2048, they are almost always referring to a future fault-tolerant quantum computer, not the quantum processors that exist today, this distinction alone is essential. Without fault tolerance, algorithms such as Shor’s simply cannot execute reliably enough to complete the enormous number of operations required.

So, where are we today?

Current quantum computers contain hundreds or, in some cases, over a thousand physical qubits. While these systems represent remarkable engineering achievements, they remain many orders of magnitude away from the capabilities required to threaten modern public key cryptography.

Recent research by Gidney and Ekerå (2021) estimated that factoring RSA-2048 could require approximately 20 million physical qubits under conservative assumptions. More recent work by Gidney (2025), based on improved error correction techniques and hardware assumptions, suggests that this number may eventually be reduced to less than one million physical qubits. At first glance, this appears to represent a dramatic breakthrough. However, there is an important nuance here. Reducing the estimated number of required physical qubits does not imply that such a machine exists today, or that it will exist tomorrow. It simply reflects advances in our understanding of how efficiently future fault-tolerant quantum computers might operate. Engineering such a machine remains one of the greatest technological challenges of our time.

Looking beyond the headlines

This is why security professionals should be careful when interpreting announcements about increasing qubit counts. A processor with 1,000 physical qubits is an extraordinary scientific achievement. It is not the same as a cryptographically relevant quantum computer capable of executing Shor’s algorithm against RSA-2048. Understanding this distinction helps separate genuine scientific progress from sensational headlines.

What the research says

The ability to threaten modern public key cryptography depends not simply on the number of qubits, but on the availability of large-scale fault-tolerant quantum computers. Recent resource estimates continue to evolve as quantum error correction techniques improve, yet they consistently conclude that breaking RSA-2048 requires a machine many orders of magnitude beyond today’s noisy quantum processors (Gidney & Ekerå, 2021; Gidney, 2025).

Reality check

Headlines reporting quantum processors with over a thousand qubits can easily create the impression that RSA is on the verge of collapse. In reality, there’s an enormous difference between a processor containing 1,000 physical qubits and a fault-tolerant quantum computer capable of reliably executing Shor’s algorithm against RSA-2048. The latter remains a formidable engineering challenge that extends far beyond simply increasing the number of qubits.

Could criminals actually afford one?

At this point, we’ve established two important facts. First, sufficiently powerful quantum computers represent a genuine long-term threat to today’s public key cryptography. Second, today’s quantum computers are nowhere near capable of executing Shor’s algorithm against RSA-2048. So the base question remains, Who is actually going to own one? The answer is probably not who most people imagine.

More than just a bigger computer

When people hear the term quantum computer, it’s easy to picture something that resembles a classical server, perhaps a larger rack, a faster processor or simply “a really expensive computer.” The reality is far different. A fault-tolerant quantum computer is an entire ecosystem of highly specialized technologies. The quantum processor itself is only one small part of the overall system. Supporting that processor requires complex control electronics, microwave signal generators, high-precision measurement equipment, vibration isolation, extensive shielding from environmental interference and one of the most sophisticated refrigeration systems ever built. Unlike classical processors that operate at room temperature, many superconducting quantum processors must be cooled to temperatures of around 10 to 15 millikelvin (−273,140 °C), only a fraction of a degree above absolute zero. Yes, that’s cold! Maintaining these temperatures continuously is an engineering challenge in itself.

The cost of quantum computing

Unlike conventional IT hardware, there is currently no commercial price list for a fault-tolerant quantum computer capable of breaking RSA. No vendor offers one, no organization can simply place an order (yet). Instead, we can only estimate the scale of the investment by looking at the technologies involved. Building such a machine would likely require:

• years of research and development.
• custom-designed hardware.
• specialized fabrication facilities.
• advanced cryogenic infrastructure.
• highly specialized engineering teams.
• continuous maintenance and operation.

Taken together, the total investment is likely measured in billions rather than millions of euros, economically not feasible for most. In many ways, a cryptographically relevant quantum computer has more in common with a particle accelerator or an exascale supercomputer than with a conventional server.

Who is the most likely threat actor?

When discussing post-quantum cryptography, it’s tempting to imagine cybercriminal groups using quantum computers to steal passwords or decrypt VPN traffic. For the foreseeable future, that scenario appears highly unlikely. The organizations most likely to possess cryptographically relevant quantum computers are those with virtually unlimited financial resources and long-term strategic interests.

Threat actor	Likelihood of operating a CRQC
Home user	Extremely unlikely
Cybercriminal group	Highly unlikely
Commercial enterprise	Unlikely
Large cloud provider	Possible in the long term
Nation state	Most likely

This table isn’t intended to predict the future with certainty. Rather, it reflects today’s technological and economic realities, and my own view of the world. Even if the engineering challenges are solved tomorrow, the cost and complexity of operating such a machine would remain far beyond the reach of ordinary organizations.

Does that mean we can ignore PQC?

Let me make one thing very clear. No, absolutely not. In fact, this is where the discussion gets interesting imho. Nation states don’t need millions of quantum computers. They only need a handful. Unlike financially motivated cybercriminals, intelligence agencies often operate on entirely different timescales. Information intercepted today may still have intelligence value decades from now. Military communications, diplomatic cables, critical infrastructure, long-term research projects, Intellectual property. Just to name a few. For these threat actors, patience is a strategic advantage. This is precisely why the concept of Harvest Now, Decrypt Later (HNDL) has become such an important driver behind the migration to post-quantum cryptography. I’ll explore that in the next chapter.

What the research says

Although resource estimates for cryptographically relevant quantum computers continue to evolve, the engineering requirements remain extraordinary. Fault-tolerant quantum computers require far more than quantum processors alone, they depend on large-scale error correction, advanced cryogenic systems and highly specialised control infrastructure. As a result, the organizations most likely to deploy such systems in the foreseeable future are governments and a small number of globally funded research programmes rather than traditional cybercriminal groups (Gidney & Ekerå, 2021; Gidney, 2025).

Reality check

The first quantum computer capable of threatening RSA is unlikely to appear in someone’s garage, or even in a typical enterprise datacenter. It will almost certainly emerge from organizations with exceptional scientific expertise, enormous financial resources and long-term strategic objectives. The greatest near-term quantum threat is therefore not ordinary cybercrime, but nation-state intelligence operations.

The real threat, harvest now, decrypt later

Up to this point, I’ve reached what might appear to be a reassuring conclusion. Today’s quantum computers cannot break RSA-2048. Building a cryptographically relevant quantum computer remains an enormous scientific and engineering challenge. The cost is likely measured in billions rather than millions. And the organizations most likely to possess such a machine are nation states, not cybercriminals. Phew, what a relief! So why are governments, standards bodies and technology vendors investing so heavily in Post-Quantum Cryptography today? The answer lies in a simple but powerful concept known as Harvest Now, Decrypt Later (HNDL).

The attack doesn’t start when the quantum computer gets here

One of the biggest misconceptions surrounding quantum computing is that an attacker first needs a quantum computer before they can begin their attack. In reality, the attack may already have started, you just don’t know it yet.

Imagine an intelligence agency intercepting encrypted network traffic today. Perhaps it’s diplomatic communication, perhaps it’s classified military information, perhaps it’s proprietary research from a defense contractor. Today, none of that traffic can be decrypted if it is protected using sufficiently strong cryptography. However, encrypted data can be stored. Storage is inexpensive, patience is free. If, twenty years from now, a cryptographically relevant quantum computer becomes available, the attacker can simply retrieve those archived communications and decrypt them using Shor’s algorithm. Nothing about the intercepted data has changed, Only the attacker’s capabilities have, think about that for a while.

Time is part of the threat model

Traditional cybersecurity often focuses on protecting systems against today’s threats. Quantum computing introduces an entirely different perspective. Instead of asking:

“Can this information be decrypted today?”

we must ask:

“Will this information still need to remain confidential when quantum computers eventually become capable of attacking it?”

For many organizations, the answer is surprisingly often yes. In each of these cases, confidentiality may need to be preserved for decades. That is precisely the time horizon in which quantum computing becomes relevant.

Why this changes the discussion

Without Harvest Now, Decrypt Later, organizations could simply wait until the first cryptographically relevant quantum computer is demonstrated before beginning their migration. With Harvest Now, Decrypt Later, waiting becomes a risk in itself. Data intercepted today cannot be re-encrypted tomorrow. Once an attacker has captured encrypted traffic, the organization loses control over its future confidentiality. This fundamentally changes how security architects think about cryptographic risk. The question is no longer:

“When will RSA become vulnerable?”

The better question is:

“How long must my data remain confidential?”

Those are two very different discussions.

The long road ahead

There is another practical consideration. Even if the first fault-tolerant quantum computer capable of attacking RSA were still many years away, migrating an entire organization to post-quantum cryptography is not a weekend project. Large enterprises often depend on thousands of certificates, hundreds of applications, embedded systems, smart cards, hardware security modules, VPN gateways, identity platforms and third-party software, you name it. Replacing every cryptographic dependency requires careful planning, testing and coordination. For many organizations, the migration itself may take years.

That is why NIST, ENISA, the NSA and many technology vendors consistently recommend beginning preparations now, not because RSA has already failed, but because waiting until it does would leave insufficient time to respond.

To infinity and beyond

Ironically, the greatest challenge presented by quantum computing may not be building the quantum computer itself. It may be replacing decades of deployed cryptography before such a machine becomes available. This is why Post-Quantum Cryptography is not simply a research topic. It is becoming an architectural planning exercise.

What the research says

The concept of Harvest Now, Decrypt Later has become one of the primary drivers behind global migration efforts towards post-quantum cryptography. Organizations responsible for protecting information with long confidentiality requirements cannot assume that encrypted data intercepted today will remain secure indefinitely. Consequently, guidance from NIST, ENISA and the NSA increasingly focus on proactive migration planning rather than waiting for the first cryptographically relevant quantum computer to emerge (NIST, 2024; NSA, 2022; ENISA, 2021).

Reality check

The greatest quantum threat is not that an attacker can decrypt your encrypted traffic today. It is that they may already be collecting it. If your information must remain confidential for twenty years or more, the countdown has already started.

The real reason you should start preparing now

Throughout this article, we’ve explored the science behind quantum computing, the differences between symmetric and asymmetric cryptography, the enormous engineering challenges involved in building a cryptographically relevant quantum computer, and the strategic implications of Harvest Now, Decrypt Later. At this point, one conclusion should be becoming increasingly clear. The greatest challenge facing organizations is not mathematics, It’s migration.

Cryptography is everywhere

When people hear the term Post-Quantum Cryptography, they often imagine replacing a single algorithm. In reality, cryptography is deeply embedded throughout modern IT infrastructures. A typical enterprise may depend on public key cryptography for:

• Public Key Infrastructure (PKI)
• TLS certificates
• VPN authentication
• Smart Cards
• Windows Hello for Business
• Code Signing
• Secure Boot
• Software update mechanisms
• Email encryption
• Device identity
• IoT platforms
• Cloud authentication
• Digital signatures

Just to name a few (see where I’m going?) Many of these systems have evolved over decades, some are actively maintained, others have become business-critical legacy systems that few people fully understand. Replacing cryptography is therefore rarely a simple software upgrade, It is often an organization-wide transformation project. Read: It takes a long time…

You can’t replace what you don’t know about

Before organizations can migrate to post-quantum cryptography, they first need to answer a surprisingly difficult question: Where is cryptography actually being used?

In many environments, no complete inventory exists. Certificates have been issued for years. Applications depend on libraries that were selected long ago. Hardware appliances may contain embedded cryptographic implementations that cannot simply be upgraded. Third-party vendors may still be working on their own post-quantum roadmaps. In other words, the migration begins long before the first post-quantum certificate is ever issued. It begins with visibility and insights.

Long certificate lifecycle

Public Key Infrastructure provides an excellent example. Although certificate lifetimes have become shorter in recent years, Certificate Authorities, trust anchors, Hardware Security Modules and the surrounding operational processes are often designed with planning horizons measured in years rather than months. Replacing those components requires careful planning, interoperability testing, governance updates and operational experience. The same applies to many embedded devices and IoT platforms, where deployed systems may remain in production for ten or even twenty years. Waiting until a cryptographically relevant quantum computer exists would leave little time to complete such migrations successfully.

Crypto agility

Crypto agility is a fancy industry made up word for the ability to replace cryptographic algorithms without redesigning the entire system, read, flexibility. Rather than building applications that depend on a single algorithm such as RSA, modern architectures should allow algorithms to evolve as standards and threats change. Today’s migration is from RSA and ECC towards post-quantum algorithms. Tomorrow’s migration may be from one post-quantum algorithm to another. History has shown that cryptography continues to evolve, hence architectures should evolve with it.

Michele Mosca’s migration principle

Perhaps the best-known way to think about post-quantum migration comes from cryptographer Michele Mosca. His migration principle is often summarized as:

If the time your information must remain confidential, plus the time required to migrate your systems, exceeds the estimated time until a cryptographically relevant quantum computer becomes available, you should already be migrating. (Mosca, 2018)

Although the exact timelines remain uncertain, the principle itself is very simple. Migration takes time, confidentiality has a lifetime. Those two timelines must be considered together.

Preparing without panicking

Preparing for post-quantum cryptography does not mean replacing every certificate tomorrow. It does not require abandoning RSA overnight, nor does it mean rushing into technologies that are still evolving. Instead, organizations should focus on building the foundations that will make future migration achievable. That includes:

• Understanding where cryptography is used.
• Introducing crypto agility into new solutions.
• Monitoring standard development.
• Engage with software and hardware vendors.
• Developing a realistic migration strategy.

These activities deliver value regardless of when the first cryptographically relevant quantum computer eventually appears. They reduce technical debt. They improve visibility. And they ensure that future cryptographic transitions become manageable engineering projects rather than emergency response exercises.

What the research says

Guidance from standards organizations consistently emphasizes that the primary challenge of post-quantum cryptography is no longer selecting replacement algorithms, it is preparing organizations for a migration that may take many years. This aligns closely with Michele Mosca’s well-known migration principle, which highlights that migration timelines and data confidentiality requirements should be evaluated together rather than independently (Mosca, 2018; NIST, 2024; ENISA, 2021).

Reality check

The biggest risk facing most organizations is not that quantum computers will arrive sooner than expected. It is that they will underestimate how long it takes to replace decades of deployed cryptography. Post-Quantum Cryptography is therefore not simply a cryptographic challenge, It is an architectural one. But hey, that’s just me saying that.

My final thoughts

If there is one message I hope you’ll take away from this article, it’s this:

Don’t panic. But don’t ignore it either.

Quantum computing is neither science fiction nor tomorrow’s crisis. It is a technological evolution that is already influencing today’s security decisions. Throughout this blog we’ve seen that the reality is far more nuanced than many headlines suggest. Quantum computers do not suddenly render all cryptography obsolete. AES remains remarkably resilient against known quantum attacks when appropriate key sizes are used. The real impact lies in public key cryptography, where algorithms such as RSA and ECC ultimately need to be replaced by quantum-resistant alternatives. Fortunately, building a cryptographically relevant quantum computer remains one of the greatest engineering challenges ever undertaken. The scientific progress is real, the engineering progress is impressive.

But there is still a considerable gap between today’s experimental quantum processors and the fault-tolerant quantum computers capable of threatening modern public key infrastructures. For most organizations, the greatest challenge is therefore not the arrival of quantum computers. It is preparing their own environment for the day they eventually arrive. That preparation starts with understanding where cryptography is used. It continues with building crypto agility into new solutions. It includes engaging with software vendors, inventorying cryptographic assets, monitoring standards, and developing realistic migration plans. None of these activities require panic, they simply require good architecture and engineering.

Well, sorry for writing such a long piece, I just needed to get this of my chest. As always, hope this helps someone understand post quantum just a little bit more. Until next time!

References

Peer-reviewed research:

Gidney, C. (2025). How to factor 2048-bit RSA integers with less than a million noisy qubits. arXiv. https://arxiv.org/abs/2505.15917

Gidney, C., & Ekerå, M. (2021). How to factor 2048-bit RSA integers in 8 hours using 20 million noisy qubits. Quantum, 5, 433. https://doi.org/10.22331/q-2021-04-15-433

Grover, L. K. (1996). A fast quantum mechanical algorithm for database search. Proceedings of the Twenty-Eighth Annual ACM Symposium on Theory of Computing (STOC ’96), 212–219. https://dl.acm.org/doi/10.1145/237814.237866

Mosca, M. (2018). Cybersecurity in an era with quantum computers: Will we be ready? IEEE Security & Privacy, 16(5), 38–41. https://eprint.iacr.org/2015/1075.pdf

Shor, P. W. (1994). Algorithms for quantum computation: Discrete logarithms and factoring. Proceedings of the 35th Annual Symposium on Foundations of Computer Science (FOCS ’94), 124–134. https://users.cs.duke.edu/~reif/courses/randlectures/Quantum.papers/shor.factoring.pdf

Standards and Government Publications

European Union Agency for Cybersecurity. (2021). Post-Quantum Cryptography: Current State and Quantum Mitigation. https://www.enisa.europa.eu/publications/post-quantum-cryptography-current-state-and-quantum-mitigation

European Telecommunications Standards Institute. (2024). Quantum-Safe Cryptography (QSC) Standards. https://www.etsi.org/technologies/quantum-safe-cryptography

National Institute of Standards and Technology. (2024). Migration to Post-Quantum Cryptography. https://www.nist.gov/

National Security Agency. (2022, September 7). Announcing the Commercial National Security Algorithm Suite 2.0. https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/3148990/nsa-releases-future-quantum-resistant-qr-algorithm-requirements-for-national-se/

Vendor Documentation

IBM. (2024). IBM Quantum Documentation. https://quantum.ibm.com/

Microsoft. (2025). Post-Quantum Cryptography in Windows Server 2025. Microsoft Learn. https://learn.microsoft.com/

Google Quantum AI. (2024). Quantum Computing Research. https://quantumai.google/