Post-Quantum Cryptography Explained: Why It Matters Now, Not Later

Introduction

It's tempting to file "quantum computers will break encryption" under problems for a future decade. That instinct is exactly backwards. The quantum computer capable of doing that damage doesn't exist yet, which broadly matches what our guide to quantum computing's realistic timeline found. But the risk to today's encrypted data is already active, because an attacker doesn't need a working quantum computer today to compromise data tomorrow. They just need to capture it now and wait.

This guide explains what post-quantum cryptography actually is, why the timeline works the way it does, and what a credible migration looks like for an organization that isn't a cryptography specialist.

The Threat That's Already Here: Harvest Now, Decrypt Later

The core justification for acting today, despite the underlying quantum threat itself being years away, is a strategy with a deliberately blunt name: harvest now, decrypt later. An adversary captures and stores encrypted traffic or data today, at effectively no cost beyond storage, and simply waits. Once a cryptographically relevant quantum computer exists, capable of running Shor's algorithm at the scale needed, that stored data becomes readable retroactively. National security agencies including the US NSA, the UK's GCHQ, and France's ANSSI have all publicly acknowledged this as an active threat model, not a hypothetical one.

The practical implication: anything that needs to stay confidential for more than a few years, medical records, government communications, long-term trade secrets, intellectual property, is already exposed to this risk today, regardless of exactly when quantum computers arrive.

What Post-Quantum Cryptography Actually Is

Post-quantum cryptography (PQC) refers to encryption methods designed to remain secure even against an adversary with a large-scale quantum computer. It isn't about using quantum technology to encrypt data, that's a related but separate field called quantum key distribution. It's about using new classical mathematical problems, ones that quantum algorithms don't have a known shortcut for, in place of the math that quantum computers are expected to break.

What's Actually at Risk (and What Isn't)

Not every algorithm in use today is equally exposed. The split matters, because it determines where a migration effort should concentrate.

The vulnerable category, asymmetric cryptography, isn't a minor corner of the internet. It underpins HTTPS connections, digital certificates, signed software updates, and SSH logins, essentially the trust infrastructure of the modern internet.

The New Standards: NIST's Answer

After an eight-year public evaluation process, NIST finalized its first three post-quantum cryptography standards on August 13, 2024.

A fourth standard, FIPS 206, based on the FALCON algorithm and designed for bandwidth-constrained applications, is expected to be finalized in 2026 or 2027.

How Close Is the Actual Threat?

Worth grounding this against real numbers rather than vague urgency. Breaking RSA-2048 with Shor's algorithm is estimated to require roughly 4,000 error-corrected logical qubits.

That gap is real, and it's exactly why harvest now, decrypt later is the argument that matters here, not "quantum computers will break encryption tomorrow." Data captured today doesn't need decrypting today to become a problem later. IBM's targeted 2029 fault-tolerant system is one of the clearest markers on the quantum computing timeline.

Governments Are Already Setting Deadlines

This isn't a distant compliance question either. NIST's own transition guidance targets deprecating RSA-2048 and ECC P-256 by 2030, with full removal from NIST standards by 2035. The NSA's Commercial National Security Algorithm Suite 2.0 mandates PQC for new national security systems starting in 2027. A June 2026 US executive order set concrete deadlines for federal civilian high-value systems: a migration pilot by 2027, key-establishment migration by 2030, and digital signature migration by 2031. Gartner's 2026 analysis projects RSA will become unsafe for protecting sensitive data by 2030 as well.

It's Already Happening at Internet Scale

This isn't theoretical or years away in practice, either. Cloudflare, Google, and Apple have already deployed hybrid post-quantum key exchange, combining a classical algorithm with a post-quantum one so security doesn't depend entirely on newer, less battle-tested math, to billions of users. Cloudflare reported crossing the 50% threshold in late October 2025, meaning more than half of human-initiated web traffic passing through its network was already protected by a hybrid post-quantum key exchange method.

A Practical Migration Roadmap

The following is adapted from the joint CISA, NSA, and NIST quantum-readiness guidance, sequenced for organizations without an in-house cryptography team.

How This Connects to Broader Data Governance

Post-quantum cryptography is one piece of a broader data protection picture, not a standalone fix. Identity and access management determines who's allowed to reach your systems in the first place; encryption, including its post-quantum successor, protects data even if that access control fails or is bypassed. And because data sovereignty depends partly on which laws govern data wherever it's stored, encryption strength is often a factor regulators explicitly weigh when assessing whether data is adequately protected across borders.

Sources

• NIST, FIPS 203, FIPS 204, and FIPS 205, finalized August 13, 2024 (csrc.nist.gov)
• NIST, NIST IR 8547 (draft), Transition to Post-Quantum Cryptography Standards
• National Security Agency, Commercial National Security Algorithm Suite 2.0 (CNSA 2.0)
• CISA, NSA and NIST, joint quantum-readiness migration guidance
• Cloudflare, post-quantum cryptography adoption reporting (blog.cloudflare.com)

This article reflects publicly available standards and research as of July 2026. Post-quantum cryptography guidance and deadlines continue to evolve, consult current NIST and CISA publications before finalizing a migration plan.

Frequently Asked Questions