Post-quantum: what if the quantum computer arrives

Every few months it's in the news again: the quantum computer is coming and then all encryption is worthless. That isn't right. A quantum computer isn't a magic wand that opens every lock — it's very good at one particular kind of sum, and as it happens that's exactly the sum half of this book rests on. The other half it doesn't touch. This chapter says precisely which half is which, and what's being done about it.

What breaks and what stays

Shor's algorithm can see through one kind of hiding place: a sum with a hidden regularity in it, something that repeats every so many steps. Splitting a number into prime factors has that regularity, and so does the discrete logarithm — that clock arithmetic from chapter 5 literally runs in circles. A quantum computer can measure how long such a circuit is, and out of that one length the answer rolls.

That's the bad news right there, because everything that works with two keys stands on it:

Those bottom two rows deserve an explanation, because "halves the strength" sounds more dramatic than it is. An AES key of 256 bits has 2²⁵⁶ possibilities — a number with 78 digits. Grover only has to try the square root of that: 2¹²⁸, a number with 39 digits. That's unspeakably much less, and still unspeakably much too much. So you don't replace AES, you just take the long version. That's the whole measure.

The machine doesn't exist yet. The quantum computers running today have too few and too unstable qubits to crack a real RSA key; the biggest numbers ever factorised with one you can also do in your head. Nobody knows whether it'll work in ten years or in forty, or not at all. But the next section explains why that doesn't mean you can wait.

Store now, read later

Someone who catches your encrypted traffic today can't read it. What they can do is keep it. Hard disks are cheap, and in twenty years that machine may well exist. Then they fetch the box down from the attic and read everything you sent in 2026 after all. That attack has a name: harvest now, decrypt later — you collect the harvest while it's still locked and wait for the key to arrive. There's nothing futuristic about it; anyone can do the storing part today.

Whether that matters depends entirely on how long your secret has to stay secret. The message in which you arrange to meet at six is worth nothing tomorrow — if someone reads it in 2046, you have no problem. A medical file, an address that has to stay hidden, a company's plans, a state secret: those still have to hold up in 2046. For that sort of data the quantum computer isn't a problem for later but one for now.

What's ready

The American standards institute NIST announced a competition in 2016: who has encryption that can handle a quantum computer? Eight years, dozens of entries and quite a few fallen candidates later, the first three standards came out on 13 August 2024.

That last one is there on purpose. ML-KEM and ML-DSA both rest on lattices; if a hole is ever found in those, they fall over together. SLH-DSA uses only hash functions — the same building block from chapter 2, which we've known for thirty years and which the quantum computer can't break. Slower and with much bigger signatures, but it's a spare wheel that was made in a different way.

For the same reason, on 11 March 2025 NIST picked a second way of agreeing on a key: HQC, which doesn't rest on lattices but on error-correcting codes — the maths that makes sure a scratch on a CD doesn't ruin the music. HQC takes more computation than ML-KEM and so isn't a replacement but a way out in case lattices disappoint. The standard itself isn't there yet: NIST is aiming for 2027. A fourth signature standard, FIPS 206 (FN-DSA, from the entry Falcon), is still in the making.

Hybrid: both at once

There's a fair problem with those new algorithms: they're young. RSA has existed since 1977 and the discrete logarithm since 1976, and all that time everyone who knows anything about it has tried to break them. Lattices don't have that half century behind them. The chance that another mistake will be found in them is small but not zero — and in 2022 one of the competition finalists (SIKE) was cracked over a single weekend on an ordinary laptop, which shows exactly how that goes.

That's why nobody is making the switch in one go. The solution is called hybrid, and it works the way the name says:

1. You do the old key exchange on an elliptic curve. You get secret A.
2. Alongside it you do the new one with ML-KEM. You get secret B.
3. You throw A and B together through a hash function. What comes out is the key you actually use.

An attacker now has to break both. If there turns out to be a hole in the lattices, the curve stops them; if the quantum computer arrives, ML-KEM stops them. You pay a few extra bytes for it in every connection, and that's it. Don't confuse this with the hybrid from chapter 7.3: there you combine an asymmetric with a symmetric lock because they do different jobs, here you put two key exchanges side by side because you don't trust either one on its own.

It's already running — with you too

This isn't a plan for later. The hybrid key exchange is in the browser you're reading this with. It's called X25519MLKEM768: X25519 is the elliptic curve, ML-KEM-768 the new half, and the padlock from chapter 7.4 uses them without you having to do anything for it.

And it really is being used. Cloudflare, which handles a large share of the world's web traffic, reported in 2026 that more than two thirds of the browser traffic to their network is already protected with a post-quantum key exchange. That's no longer a test setup; that's become the normal route while nobody noticed.

What hasn't switched over yet are the signatures. The certificates a website uses to prove who it is are still almost everywhere on RSA or on a curve. That's less urgent — a signature you forge today after keeping it for twenty years convinces nobody any more — but it is a far bigger move, because every certificate in the world has to come along.

This is the only chapter without a button. The demos on this site all run on WebCrypto, the encryption your browser lends out to JavaScript — and for a long time it didn't know these algorithms. That's just starting to change: Chrome has been offering ML-KEM and ML-DSA in it since the summer of 2026 and Firefox switches them on in version 157. But it isn't everywhere yet, and imitating something in plain JavaScript would show you a toy version pretending to be the real thing. Better a chapter without a button.