Quantum computing has moved out of science fiction and into engineering. The promised breakthroughs in healthcare, AI and logistics get most of the attention, but for security teams the interesting part is what it breaks. The public-key cryptography that sets up most of today’s encrypted connections rests on math that a large enough quantum computer solves quickly. The symmetric encryption doing the bulk of the work is in far less trouble.
Researchers have been working on this for years, so there is already a path forward. Here is what that path consists of, and why some algorithms are in far more trouble than others.
The problem
Public-key encryption such as RSA and ECC (Elliptic Curve Cryptography) is secure because certain math problems are slow to solve. Factoring a large number is the classic example. A classical computer would need billions of years.
Shor’s Algorithm removes that guarantee. On a sufficiently powerful quantum computer it solves those problems exponentially faster, which leaves RSA and ECC insecure rather than merely weakened. Much of the world’s encrypted data could in theory be decrypted.
Symmetric encryption is in better shape. Grover’s Algorithm halves the effective security of algorithms like AES (Advanced Encryption Standard) in theory, but Grover parallelizes poorly, so the practical loss is smaller than the halving suggests. It is a problem you can answer with larger keys instead of new math, and NIST has not deprecated AES-128.
Post-quantum cryptography
Post-quantum cryptography (PQC) is the main defense. These are encryption algorithms built specifically to resist quantum attacks, and unlike RSA and ECC they do not rest on the problems a quantum computer handles easily.
The National Institute of Standards and Technology (NIST) finalized its first three post-quantum standards on 13 August 2024: FIPS 203 ML-KEM (from CRYSTALS-Kyber) for key establishment, FIPS 204 ML-DSA (from CRYSTALS-Dilithium) for signatures, and FIPS 205 SLH-DSA (from SPHINCS+) as a hash-based signature alternative. NIST selected HQC in March 2025 as a backup KEM, and a FALCON-based signature standard (FN-DSA, FIPS 206) is still to come. These are the algorithms replacing RSA and ECC, and procurement now speaks in the FIPS names.
Hybrid encryption
Nothing this large gets replaced overnight. Too many systems depend on the current standards, and swapping them all at once would break things. Hybrid encryption combines a traditional algorithm like RSA or ECC with a post-quantum one, so if a quantum computer breaks one of them, the other still holds. It buys compatibility while the migration happens.
Bigger symmetric keys
AES is not as exposed as public-key cryptography, but a quantum computer still cuts into its margin, and key size handles that. AES-128 would offer the equivalent of 64-bit security against a quantum attack on the theoretical bound, though the engineering reality is far more forgiving. AES-256 stays comfortably secure either way. Symmetric encryption is widely used, so strengthening it is a practical and cost-effective way to prepare.
Quantum key distribution
Quantum key distribution (QKD) uses quantum mechanics to share encryption keys. If someone intercepts the exchange, the quantum state of the system changes and both parties see that it happened. The property is genuinely useful and also expensive, because QKD needs specialized hardware. That keeps it in government and financial communications rather than general use.
Transition planning
The technology is the easier half. The harder half is knowing what you have. Three steps, in order:
- Audit your systems and find every place RSA and ECC are in use.
- Test post-quantum algorithms in non-critical systems and measure what they cost you in performance.
- Write a migration roadmap that moves you across in stages instead of one cutover, so compatibility does not break along the way. For date anchors, NIST’s draft IR 8547 proposes deprecating quantum-vulnerable algorithms at 112-bit strength after 2030 and disallowing them after 2035, which is closer than a migration this size usually takes.
Preparing early lowers the risk and makes for a smoother transition once quantum computing becomes a real-world threat.
The reason to start now is not that quantum computers have arrived. It is that a migration this size takes years, and the new algorithms have to be in place before the machines are working, not after.