What Is Post-Quantum Cryptography (PQC)? NIST Standards and Migration in Practice
An overview of post-quantum cryptography to prevent quantum decryption, NIST-standardized algorithms, and practical enterprise migration steps.
The Need for and Background of Post-Quantum
Cryptography (PQC) The public-key cryptosystems widely used today are based on mathematically difficult problems. For example, elliptic curve cryptography (ECC) and RSA are considered secure because integer factorization and discrete logarithm problems require enormous computational effort. However, as quantum computers advance, Shor’s algorithm could solve these problems in polynomial time. This means that current cryptographic systems will be threatened by quantum computers in the future.
Post-Quantum Cryptography (PQC) is a collective term for cryptographic schemes designed to remain secure even against quantum computers. PQC comprises algorithms that run on classical computers, not on quantum computers themselves. This is the key difference from quantum cryptographic communication. The goal of PQC is to maintain existing infrastructure and continue protecting confidential data even after quantum computers become practical.
NIST Standardization Process and Selected
Algorithms The U.S. National Institute of Standards and Technology (NIST) launched its PQC standardization process in 2016. After rigorous evaluation of 69 candidate algorithms submitted through a public call, it officially released the first standards in August 2024. The main standardized items are as follows.
- Key Encapsulation Mechanism (KEM): CRYSTALS-Kyber was standardized. It is a lattice-based cryptosystem that serves as a replacement for Elliptic Curve Diffie-Hellman (ECDH). It is used to establish secure shared keys with communication peers.
- Digital Signatures: CRYSTALS-Dilithium, FALCON, and SPHINCS+ were standardized. The lattice-based Dilithium and FALCON serve as replacements for RSA and ECDSA. SPHINCS+, with its stateless structure, takes a different approach as a hash-based scheme.
All of these algorithms are based on mathematical foundations such as lattice problems and hash functions, and are assessed to be resistant to attacks from quantum algorithms. NIST plans to continue additional standardization efforts from 2025 onward.
Migration in Practice: Steps and Considerations
Migrating to PQC is not merely a matter of replacing algorithms. The following steps are recommended.
- Inventory of cryptographic assets: Identify all encryption keys, certificates, and protocols used across the organization. These span a wide range, including TLS, VPN, code signing, and email encryption.
- Risk assessment: Determine the impact of decryption by quantum computers and set migration priorities. Start with highly confidential data and data with long expected lifespans.
- Performance and compatibility verification: PQC algorithms may have larger key and signature sizes than conventional schemes. Test the impact on network bandwidth and processing speed.
- Phased deployment and consideration of hybrid mode: A hybrid mode that uses existing encryption alongside PQC is recommended. This ensures that even if one cipher is broken during the transition period, the other maintains protection.
- Update key management: Design processes for generating, distributing, and storing PQC keys, and integrate them into the existing key management infrastructure.
A real-world use case is introducing PQC signatures into TLS certificates for web servers. First, issue certificates with PQC signatures using a side chain in a test environment and confirm connectivity with clients. Next, proceed with gradual migration in the production environment, monitoring for any issues.
Related Technologies and Comparison
PQC is easily confused with other technologies for the quantum era. The main differences are as follows.
- Quantum Key Distribution (QKD): A technology that protects the communication channel itself using the principles of quantum mechanics. PQC, in contrast, consists of mathematical algorithms that operate over classical channels.
- Quantum computers: These are the threat to PQC, and there is a misconception that PQC itself is a quantum computer. PQC runs on classical computers.
When selecting PQC, it is necessary to comprehensively evaluate standardization progress, ease of implementation, performance, and compatibility with existing systems. Since NIST standards are widely accepted as a basis for security, it is practical to start with them.
Editorial Opinion
As evaluation criteria for comparison, organizations should prioritize “standardization status” and “implementation maturity.” The NIST standards have passed security review, and support from major vendors and libraries is advancing. In addition, it is important to quantitatively measure compatibility with existing cryptographic assets and operational costs, and incorporate these into the migration plan.
A common pitfall in the field is that the impact on infrastructure caused by larger key and signature sizes tends to be overlooked. For example, IoT devices and embedded systems face strict memory and bandwidth constraints, and there is a risk they may become inoperable after PQC deployment. Official documentation lacks concrete examples of implementations and bottlenecks under such resource constraints, making load testing in the field essential.
Looking ahead, within one to three years, PQC hybrid mode will likely become standard in major cloud services and communication protocols. Consequently, demand will grow for middleware that ensures key management automation and interoperability with legacy systems. Complete migration is a long-term effort requiring more than a decade, making a phased approach and continuous monitoring essential.
References
Frequently Asked Questions
- Does post-quantum cryptography (PQC) require a complete replacement of existing encryption?
- Rather than replacement, a phased migration is recommended. At this stage, a hybrid mode combining existing encryption with PQC is the most realistic approach. This ensures dual protection during the transition period until quantum computers become practical.
- Are there any points other than NIST standards to consider when selecting PQC algorithms?
- Yes. NIST standards should serve as the foundation, but an organization's specific requirements also matter. For example, in real-time systems where low latency is critical, Dilithium may be more suitable than FALCON. Also, regulatory requirements of specific countries or industries must be checked.
- How much cost and time can be expected for the migration to PQC?
- It depends greatly on
Comments