What Is Post-Quantum Cryptography And Why Does It Affect You?

There is a lock protecting almost everything you do online. When you log into your bank, share a health record, or send a work email, a mathematical lock scrambles that information before it travels across the internet. Only the intended recipient holds the key.

This system has worked reliably for decades. It works because the mathematics behind the lock is practically impossible to break with today's computers.

That is about to change — not immediately, but within a timeframe that engineers, policymakers, and researchers across Europe are treating with real urgency. And the time to act is not when quantum computers arrive. It is now.

This is the first post in the FOCAL Knowledge Series: a plain-language guide to the ideas behind one of Europe's most pressing digital security challenges.

 How the lock works today 

Most of the encryption protecting internet communications today — including the padlock icon in your browser — relies on what is called asymmetric cryptography. The two most widely used systems are RSA and Elliptic Curve Cryptography (ECC).

Both rest on the same principle: certain mathematical problems are easy to perform in one direction but extraordinarily difficult to reverse. RSA uses the fact that multiplying two very large prime numbers together is simple, but working backwards from the result to find those two primes is computationally infeasible — even for the fastest computers in the world.

This asymmetry is the lock. The security of the system does not depend on keeping the method secret. It depends on the sheer difficulty of reversing the mathematics.

 Why quantum computers change everything 

A conventional computer processes information as a series of binary choices — zero or one. To crack an RSA key, it would need to try an astronomical number of combinations, one at a time. This would take longer than the age of the universe.

A quantum computer operates differently. Using a property called superposition, it can explore many possibilities simultaneously. In 1994, mathematician Peter Shor published an algorithm showing that a sufficiently large quantum computer could solve the factorisation problem underpinning RSA — and the equivalent problem underpinning ECC — in a matter of hours, not billions of years.

Quantum computers are not universally faster. They are not better at everyday computing tasks. But for this specific class of mathematical problem — the one that today's asymmetric cryptography depends on — they are categorically more capable. When a quantum computer large enough to run Shor's algorithm at meaningful scale exists, the lock protecting most of today's internet will no longer hold.

That computer does not yet exist. But the scientific and policy consensus is clear: planning must begin now.

The threat that is already active: Harvest Now, Decrypt Later

One of the most important reasons for urgency is a strategy known as Harvest Now, Decrypt Later.

The approach is straightforward: an adversary intercepts and stores encrypted data today — in its locked form — and waits. When a quantum computer capable of breaking current encryption eventually becomes available, they use it to decrypt everything they have collected.

This matters because some data does not lose its value quickly. Medical records, financial contracts, diplomatic communications, and intellectual property may still be sensitive in fifteen or twenty years. An adversary willing to play a long game does not need to wait for quantum capability before beginning to collect.

Harvest Now, Decrypt Later is not a theoretical concern. It is a recognised, active security risk acknowledged by cybersecurity agencies across multiple countries.

 What is Post-Quantum Cryptography? 

Post-Quantum Cryptography — PQC — refers to a new generation of cryptographic algorithms designed to remain secure against attacks from both conventional and quantum computers.

It is worth clarifying what PQC is not: it does not use quantum mechanics. It runs on ordinary hardware. What distinguishes it is that the mathematical problems it relies on — including lattice-based problems and hash-based structures — are believed to be hard for quantum computers as well as classical ones.

After an eight-year global evaluation process, the US National Institute of Standards and Technology (NIST) published three finalised PQC standards in August 2024:

ML-KEM (FIPS 203) — for secure key exchange between systems, based on the CRYSTALS-Kyber algorithm

ML-DSA (FIPS 204) — for digital signatures that verify authenticity, based on CRYSTALS-Dilithium

SLH-DSA (FIPS 205) — a hash-based digital signature standard, based on SPHINCS+

A fourth standard — FN-DSA (FIPS 206), based on the Falcon algorithm — was subsequently published by NIST.

Adoption has moved quickly in cloud environments. According to Cloudflare's 2024 Year in Review, post-quantum encrypted traffic grew from roughly 2% of TLS 1.3 connections in early 2024 to 13% by November 2024, driven largely by Chrome enabling it by default in April of that year.

Where PQC works today — and where it does not

The new standards perform well in environments with abundant computing resources: cloud servers, data centres, and modern smartphones. But they do not yet fit cleanly everywhere.

Post-quantum algorithms carry larger key sizes and higher computational demands than their classical counterparts. An ML-KEM-768 public key is approximately 1,184 bytes — considerably larger than a comparable RSA key. Digital signatures under ML-DSA can reach several kilobytes. These differences matter enormously when memory, processing power, and battery life are tightly constrained.

Consider the embedded sensors in an industrial facility. The control unit in a connected vehicle. A medical IoT device monitoring a patient remotely. A satellite that cannot be recalled for a software upgrade.

These are resource-constrained edge environments — and they make up a large proportion of the world's connected infrastructure. Current PQC standards were not designed with them in mind. Making PQC work across these environments, not just in the cloud, is one of the defining engineering challenges of the next decade.

Where Europe stands — and what FOCAL is researching

In April 2024, the European Commission published its Recommendation on a Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography (C(2024) 2393). It set two clear milestones: all EU Member States should begin their PQC transition by the end of 2026, and critical infrastructure should complete that transition no later than the end of 2030.

FOCAL — Functional Composition of Post-Quantum Cryptosystems at Large — is a Horizon Europe research project working directly in this space. Its focus is the gap between PQC theory and real-world deployment: developing the engineering foundations needed to make quantum-safe security practical not only in cloud environments, but across the full range of devices and systems that make up modern connected infrastructure.

The research spans connected vehicles, satellite communications, medical IoT, financial systems, next-generation networks, and large-scale data centres. It covers hardware adaptation, reprogrammable chips, quantum-safe execution environments, and the networking frameworks that allow these systems to communicate securely end to end.

These are research goals currently in development, not finished products. But they represent Europe's coordinated effort to ensure that the transition to quantum-safe security is not only theoretically possible, but practically achievable across the environments that matter most.

The bottom line

The mathematics protecting most of today's internet was designed for a world without quantum computers. That world is changing. The work of replacing that mathematics — carefully, systematically, across billions of devices — is already underway.

Post-quantum cryptography is the answer. Making it work everywhere is the challenge.

This is Part 1 of the FOCAL Knowledge Series. Part 2 covers crypto-agile hardware and software — why updating a device's security is not as simple as it sounds. Subscribe to the FOCAL newsletter at focal-pqc.eu to receive each post as it is published.