Key Points
- Quantum encryption uses the laws of quantum mechanics to secure data — most often through quantum key distribution (QKD), which makes any eavesdropping physically detectable.
- QKD faces steep infrastructure demands, while post-quantum cryptography (PQC) takes a different path: quantum-resistant algorithms that run on ordinary computers.
- Shor's and Grover's algorithms are the quantum threats: Shor's would break RSA and ECC outright, while Grover's only weakens symmetric encryption like AES.
- NIST finalized three PQC standards in August 2024: ML-KEM (FIPS 203) for key exchange, and ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for digital signatures.
- Organizations can start migrating to quantum-resistant certificates today using platforms that support modern issuance protocols and algorithm agility.
Every authentication event on your network relies on encryption to verify identity and protect the session. For decades, the math underlying that encryption has been treated as unbreakable in practice.
Quantum computing changes that assumption.
A powerful enough quantum machine running the right algorithm could work backward through the arithmetic that protects RSA (Rivest-Shamir-Adleman) keys and elliptic curve cryptography in hours, not centuries.
The good news: this isn’t a surprise attack. Researchers have mapped the threat in detail, and NIST spent eight years running an international competition to standardize replacement algorithms.
Understanding what quantum encryption is, what quantum key distribution (QKD) does, and what post-quantum cryptography (PQC) actually replaces helps any IT team make informed decisions about where their certificate infrastructure stands today.
What Is Quantum Encryption?
Quantum encryption is a set of methods that uses the principles of quantum mechanics to secure, transmit and decode information. Rather than relying on the mathematical difficulty of factoring large numbers, quantum encryption relies on physical properties of quantum systems, chiefly individual particles of light called photons, to make eavesdropping detectable.
The term is sometimes used interchangeably with “quantum cryptography,” but it covers a broader set of techniques.
The most widely deployed form is quantum key distribution.
Post-quantum cryptography (PQC) is often confused with quantum encryption, but it’s a separate approach that uses no quantum physics at all. Instead, it runs on classical computers and uses conventional math to address the same quantum threat.
How Quantum Mechanics Protects Data
Three quantum properties make quantum encryption possible.
- Superposition allows a quantum particle to exist in multiple states simultaneously until it is measured. Encoding information on particles in superposition means the act of reading the data collapses the state and leaves a trace.
- Entanglement links two particles so that measuring one instantly reveals the state of the other, regardless of distance. This property underpins some quantum key distribution schemes and quantum position verification research.
- The no-cloning rule states that an unknown quantum state cannot be copied. Anyone who tries to intercept a quantum-encoded key destroys it rather than copying it, which immediately alerts both communicating parties.
What Is Quantum Key Distribution (QKD)?
Quantum key distribution is a technique for exchanging a secret encryption key between two parties using quantum particles, typically photons, so that any interception attempt is physically detectable.
The key itself is an ordinary bit string; what’s “quantum” about QKD is the channel used to transmit it, not the key. Once shared, the parties use that key with standard symmetric encryption such as the Advanced Encryption Standard (AES).
The best-known QKD protocol is BB84, introduced by Charles Bennett and Gilles Brassard in 1984. In a BB84 exchange:
- The sender encodes random bits on photons using one of two quantum bases.
- The receiver measures each photon, also choosing a basis at random.
- After transmission, the two parties compare their basis choices over a public channel and keep only the bits where they chose the same basis.
Any eavesdropper’s measurement would disturb the photons and introduce detectable errors in the final key.
QKD in Practice
QKD moved from theory to real-world deployment more than two decades ago. In 2004, Austrian researchers used QKD to secure a bank transfer from a financial institution to Vienna City Hall. China demonstrated QKD over approximately 4,600 kilometers using a hybrid fiber-optic and satellite network.
Despite these milestones, QKD carries significant operational constraints:
- It requires dedicated fiber or free-space optical channels between the communicating parties.
- Quantum repeaters, which would extend range, disturb the delicate photon states the system depends on.
- Deployment costs and complexity are high compared with software-only solutions.
- The National Security Agency does not recommend QKD for national security systems because technological and theoretical loopholes remain that could allow eavesdroppers to intercept and decode messages.
For most enterprise IT teams, QKD is a research and critical-infrastructure technology, not a near-term network security tool. Post-quantum cryptography is the more accessible path.
What Is Post-Quantum Cryptography (PQC)?
Post-quantum cryptography is classical cryptography redesigned to resist quantum attacks. It runs on ordinary computers and replaces the vulnerable math behind RSA and elliptic curve cryptography (ECC) with problems that quantum computers can’t solve efficiently, such as lattice problems, hash functions and code-based systems.
That distinction is what makes PQC the practical path for most organizations.
Because PQC deploys as a software update or a new certificate profile rather than requiring dedicated hardware, it can protect data in transit, data at rest, digital signatures and authentication across the existing internet without the need for special channels.
PQC is the approach NIST standardized in 2024 and recommends as the primary migration path. NIST plans to deprecate quantum-vulnerable algorithms like RSA and ECC after 2030 and disallow them entirely by 2035, making PQC migration a matter of timeline rather than choice.
Quantum Encryption vs. Post-Quantum Cryptography
Quantum encryption and PQC describe fundamentally different approaches to quantum-era security.
Because QKD is the only form of quantum encryption in meaningful deployment, it’s the fair basis for comparison here. The table below compares QKD against PQC.
| Dimension | Quantum Key Distribution (QKD) | Post-Quantum Cryptography (PQC) |
| Relies on | Laws of quantum physics | Quantum-hard math problems |
| Runs on | Quantum hardware (photon emitters, detectors) | Standard classical computers |
| Protects | Key distribution channel | Data encryption and digital signatures |
| Infrastructure needed | Dedicated fiber or free-space optics | Software update or new certificate profile |
| NIST recommendation | Not recommended for national security systems alone | Primary recommended migration path |
| Deployment readiness | Limited, high-cost deployments | Standards finalized August 2024 |
The Quantum Threat to RSA and ECC
To understand why quantum encryption and post-quantum cryptography matter, you need to understand what quantum computers would break.
Shor’s Algorithm and Public-Key Cryptography
Peter Shor published his quantum factoring algorithm in 1994. Shor’s algorithm factors large integers exponentially faster than any known classical method. Because RSA encryption derives its security from the practical impossibility of factoring the product of two large primes on a classical computer, a quantum computer running Shor’s algorithm would render RSA broken.
ECC faces the same exposure. Elliptic curve cryptography relies on the difficulty of the elliptic curve discrete logarithm problem. Shor’s algorithm can also solve this efficiently on a quantum machine, allowing an attacker to derive an ECC private key from the corresponding public key.
Roughly half of experts surveyed in 2025 rated the likelihood of a quantum computer capable of breaking RSA-2048 by roughly 2035 at “about 50%” or higher.
Global Risk Institute, Quantum Threat Timeline Report 2025
Grover’s Algorithm and Symmetric Encryption
Grover’s algorithm poses a lesser threat to symmetric encryption. Where Shor’s algorithm breaks public-key systems outright, Grover’s algorithm provides a quadratic speedup in searching through possible keys.
In theory, this halves the effective bit-length security of a symmetric cipher; in practice, NIST notes that all steps of Grover’s algorithm must run serially, which undermines the speedup when classical cryptanalysis uses parallel hardware.
NIST’s guidance is that current AES key sizes of 128, 192 and 256 bits remain appropriate and do not require preemptive increases to counter quantum threats. AES-256 provides an especially comfortable margin.
The harder, more urgent problem requiring the new NIST standards is protecting public-key cryptography.
The “Harvest Now, Decrypt Later” Risk
Waiting for quantum computers to arrive before acting is not a safe posture. Nation-state adversaries are already collecting encrypted network traffic today with the intent of decrypting it once a sufficiently powerful quantum machine is available.
This strategy, called “harvest now, decrypt later,” means data protected only by RSA or ECC today could be exposed years from now, even if the encrypted data currently looks safe.
Any data that must remain confidential for a decade or more is already at risk under purely classical public-key encryption. Adversaries collecting encrypted traffic today can decrypt it years from now, once a sufficiently powerful quantum machine exists.
NIST Post-Quantum Cryptography Standards: ML-KEM and ML-DSA
NIST finalized its first three post-quantum cryptography standards on August 13, 2024, concluding an eight-year international standardization process that began in 2016.
Each standard covers a different job:
- ML-KEM handles key exchange, taking over the role RSA and elliptic curve Diffie-Hellman (ECDH) play today in establishing shared session keys.
- ML-DSA handles digital signatures and is NIST’s recommended default for most enterprise use — certificate signing, code signing and authentication protocols.
- LH-DSA also handles digital signatures but bases its security on hash functions rather than lattice math. That makes it a backup if lattice-based cryptography is ever weakened.
The names describe the algorithms. ML = module-lattice (the underlying math), KEM = key encapsulation mechanism, DSA = digital signature algorithm, SLH = stateless hash.
Here’s a table showing a quick comparison between the standards and algorithms:
| NIST Standard | Algorithm | Formerly | What It Does | Security Levels |
| FIPS 203 | ML-KEM | CRYSTALS-Kyber | Key exchange — replaces RSA and ECDH for establishing session keys | 512, 768, 1024 |
| FIPS 204 | ML-DSA | CRYSTALS-Dilithium | Digital signatures — NIST’s recommended default for certificate signing, code signing and authentication | 44, 65, 87 |
| FIPS 205 | SLH-DSA | SPHINCS+ | Digital signatures — hash-based alternative with a different underlying security assumption | — |
NIST has stated that these algorithms can and should be implemented now, and that the agency will phase out quantum-vulnerable algorithms by 2035.
Benefits and Limitations of Post-Quantum Cryptography
PQC’s practical advantages make it the recommended path, but migration carries real trade-offs worth understanding before you start.
Benefits
- Software-deployable: PQC runs on standard processors, so migration can begin with a certificate profile update rather than new hardware.
- Addresses all workloads: PQC protects data at rest, data in transit, digital signatures, code signing and authentication protocols.
- Standardized and auditable: FIPS 203, 204 and 205 give organizations a clear, government-approved baseline.
- Scalable: Unlike QKD, PQC works across the global internet without dedicated physical links.
Limitations and Challenges
- Larger key and signature sizes: Lattice-based algorithms produce larger keys and signatures than RSA or ECC at equivalent security levels, which can affect TLS handshake performance and certificate storage.
- Migration complexity: Existing public key infrastructure (PKI) hierarchies, certificate templates, and network authentication configurations all need updating.
- Cryptographic agility requirement: Organizations need infrastructure that can swap algorithms without rebuilding the entire authentication stack, a property known as cryptographic agility.
How Organizations Can Prepare for Quantum-Safe Authentication
Moving to quantum-resistant authentication is a three-part process.
- Inventory current cryptographic use. Identify every place RSA or ECC is used in your environment: TLS certificates, Wi-Fi authentication (802.1X/EAP-TLS), VPN certificates, code signing and device identity certificates.
- Adopt cryptographic agility in your PKI. Your certificate authority (CA) and issuance infrastructure must be able to issue both classical and post-quantum certificates in parallel during the transition period. This is not optional: migrating every endpoint overnight is not feasible, so hybrid operation is the realistic path.
- Migrate to PQC algorithms on a risk-prioritized schedule. NIST recommends beginning immediately with high-risk systems and completing the migration of all systems before the 2030 deprecation of quantum-vulnerable algorithms.
Post-quantum cryptography documentation from SecureW2 shows how to create certificate authorities using ML-DSA and SLH-DSA and configure certificate templates for PQC enrollment today, without waiting for a full infrastructure overhaul.
For a deeper grounding in the encryption fundamentals that PQC replaces, the SecureW2 guides on how public-key encryption works, RSA asymmetric encryption and elliptic curve cryptography build the background you need.
Secure Network Access in a Post-Quantum World with SecureW2
The certificate-based authentication that protects your Wi-Fi, VPN and application access today depends on the same RSA and ECC math that quantum computers will eventually break.
Planning that migration before it becomes urgent is where organizations that handle sensitive data have a clear advantage.
JoinNow Dynamic PKI is our managed certificate authority platform. It supports the post-quantum cryptography certificate enrollment guide workflows, enabling IT teams to create PQC-native certificate authorities using ML-DSA or SLH-DSA and issue post-quantum certificates to devices through automated enrollment.
JoinNow Cloud RADIUS handles network access authentication, enforcing certificate-based identity verification at the moment of connection for Wi-Fi and VPN. Together, they give organizations a path from today’s classical PKI to a quantum-resistant authentication stack without disrupting existing infrastructure.
Schedule a demo to see how SecureW2 supports PQC migration for your environment.
Frequently Asked Questions
Is quantum encryption available today?
QKD systems exist and have been deployed in limited, high-security scenarios, including financial institutions and government networks, since at least 2004. However, they require specialized hardware and dedicated optical channels, and the NSA does not recommend them for national security systems due to remaining vulnerabilities. Post-quantum cryptography standards, which run on existing computers, were finalized by NIST in August 2024 and are available for deployment now.
How does Shor’s algorithm threaten RSA?
RSA encryption is secure because factoring the product of two very large prime numbers is computationally intractable for classical computers. Shor’s algorithm factors integers exponentially faster on a quantum computer, meaning a sufficiently powerful quantum machine could derive an RSA private key from the public key. The same algorithm applies to elliptic curve cryptography by solving the discrete logarithm problem efficiently.
What are the NIST post-quantum cryptography standards?
NIST finalized three post-quantum cryptography standards on August 13, 2024. FIPS 203 specifies ML-KEM for key encapsulation. FIPS 204 specifies ML-DSA for digital signatures, which NIST recommends as the default for most enterprise applications. FIPS 205 specifies SLH-DSA as a hash-based signature alternative. NIST plans to deprecate quantum-vulnerable algorithms such as RSA and ECC after 2030.
Does quantum computing break AES?
Grover’s algorithm theoretically provides a quadratic speedup in brute-force key searches, but NIST’s analysis concludes it will likely provide little or no practical advantage against AES because the algorithm’s steps must run serially, which limits its effectiveness against massively parallel classical cryptanalysis. NIST recommends continuing to use current AES key sizes without preemptive increases. The far more serious quantum threat targets public-key cryptography, specifically RSA and ECC, which the NIST PQC standards address directly.
What is “harvest now, decrypt later”?
“Harvest now, decrypt later” refers to the practice of adversaries collecting encrypted data today with the intent of decrypting it once a quantum computer becomes powerful enough to break the encryption. Because data intercepted over RSA or ECC-protected channels is recorded in its current ciphertext form, an adversary who stores it now can decrypt it years later without needing access to the original network session. Organizations handling data that must remain confidential for a decade or more are already at risk.
When should my organization start migrating to PQC?
Now, for anything with a long confidentiality requirement. NIST has said its standards can and should be implemented today, and plans to deprecate quantum-vulnerable algorithms after 2030. Because "harvest now, decrypt later" attacks put today's traffic at future risk, data that must stay confidential for a decade or more is already exposed. Most organizations start by inventorying where RSA and ECC are used, then migrating highest-risk systems first.
Do I need to replace my existing certificates for PQC?
Eventually, yes. Certificates signed with RSA or ECC will need to be reissued using quantum-resistant algorithms like ML-DSA. But migration doesn't happen overnight. Most organizations run classical and post-quantum certificates in parallel during the transition, which is why cryptographic agility (the ability to swap algorithms without rebuilding your authentication stack) matters more than picking a single algorithm today.
Will post-quantum certificates work with my existing systems?
Not universally, at least not yet. PQC algorithms produce larger keys and signatures than RSA or ECC, which can affect TLS handshake performance and certificate storage, and not all clients, servers and network devices support the new algorithms. This is why hybrid deployments — issuing both classical and post-quantum certificates during the transition — are the standard approach rather than a hard cutover.
