Post-quantum cryptography

Short description: Cryptography secured against quantum computers

Not to be confused with Quantum cryptography.

Post-quantum cryptography (PQC), sometimes referred to as quantum-proof, quantum-safe, or quantum-resistant, is the development of cryptographic algorithms (usually public-key algorithms) that are currently thought, but not proven, to be secure against a cryptanalytic attack by a quantum computer.[1] Most widely used public-key algorithms rely on the difficulty of one of three mathematical problems: the integer factorization problem, the discrete logarithm problem, or the elliptic-curve discrete logarithm problem. All of these problems could be easily solved on a sufficiently powerful quantum computer running Shor's algorithm[2][3] or possibly alternatives.[4][5]

As of 2026, quantum computers lack the processing power to break widely used cryptographic algorithms;[6] however, because of the length of time required for migration to quantum-safe cryptography, cryptographers are already designing new algorithms to prepare for Y2Q or "Q-Day", the day when current algorithms will be vulnerable to quantum computing attacks. Mosca's theorem provides the risk analysis framework that helps organizations identify how quickly they need to start migrating.

Their work has gained attention from academics and industry through the PQCrypto conference series hosted since 2006, several workshops on Quantum Safe Cryptography hosted by the European Telecommunications Standards Institute (ETSI), and the Institute for Quantum Computing.[7][8][9] The rumoured existence of widespread harvest now, decrypt later programs has also been seen as a motivation for the early introduction of post-quantum algorithms, as data recorded now may still remain sensitive many years into the future.[10][11][12]

In contrast to the threat quantum computing poses to current public-key algorithms, most current symmetric cryptographic algorithms and hash functions are considered to be relatively secure against attacks by quantum computers.[3][13] While the quantum Grover's algorithm does speed up attacks against symmetric ciphers, doubling the key size can effectively counteract these attacks.[14] Thus post-quantum symmetric cryptography does not need to differ significantly from current symmetric cryptography.

In 2024, the U.S. National Institute of Standards and Technology (NIST) released final versions of its first three Post-Quantum Cryptography Standards.[15]

## Contents

* 1 Migration
* 2 Preparation
* 3 Algorithms
* 3.1 Lattice-based cryptography
* 3.2 Multivariate cryptography
* 3.3 Hash-based cryptography
* 3.4 Code-based cryptography
* 3.5 Isogeny-based cryptography
* 3.6 Symmetric key quantum resistance
* 4 Security reductions
* 4.1 Lattice-based cryptography – Ring-LWE Signature
* 4.2 Lattice-based cryptography – NTRU, BLISS
* 4.3 Multivariate cryptography – Unbalanced oil and vinegar
* 4.4 Hash-based cryptography – Merkle signature scheme
* 4.5 Code-based cryptography – McEliece
* 4.6 Code-based cryptography – RLCE
* 4.7 Supersingular elliptic curve isogeny cryptography
* 5 Comparison
* 5.1 Lattice-based cryptography – LWE key exchange and Ring-LWE key exchange
* 5.2 Lattice-based cryptography – NTRU encryption
* 5.3 Multivariate cryptography
* 5.4 Hash-based cryptography – Merkle signature scheme
* 5.5 Code-based cryptography – McEliece
* 5.6 Supersingular elliptic curve isogeny cryptography
* 5.7 Symmetric-key–based cryptography
* 6 Forward secrecy
* 7 Open Quantum Safe project
* 8 Implementation
* 9 Post-quantum cryptography in blockchain systems
* 9.1 Physical layer complements
* 9.2 Hybrid encryption
* 10 Criticisms
* 11 See also
* 12 References
* 13 Further reading
* 14 External links

## Migration

The transition from classical public-key cryptography to post-quantum cryptography (PQC) is considered a long-term, multi-phase process due to the widespread deployment of cryptographic infrastructure across digital systems. Migration planning is influenced by factors such as data longevity requirements, regulatory guidance, interoperability constraints, and the operational complexity of replacing embedded cryptographic components.[16]

One commonly cited risk model is Mosca’s theorem, which estimates the urgency of migration by comparing three time horizons: the time required to transition systems (X), the time during which data must remain secure (Y), and the estimated arrival of cryptographically relevant quantum computers (Z). If X + Y > Z, migration is considered urgent.[16]

A major concern motivating early transition is the “harvest now, decrypt later” threat model, in which encrypted data is intercepted and stored with the intention of decrypting it once large-scale quantum computers become available.[17]

Migration strategies frequently emphasize crypto-agility, the capability of systems to rapidly replace cryptographic primitives without major architectural changes. Hybrid cryptographic deployments where classical and post-quantum algorithms are used simultaneously have been tested in protocols such as Transport Layer Security (TLS) to reduce transitional risk.[18]

In 2024, the National Institute of Standards and Technology (NIST) finalized its first post-quantum cryptography standards, including module-lattice-based key encapsulation and digital signature schemes, providing a foundation for structured migration in governmental and commercial systems.[19]

International organizations and national cybersecurity agencies have published coordinated roadmaps outlining phased adoption timelines, risk assessments, and procurement guidelines to facilitate a systematic transition.[20]

## Preparation

Digital infrastructures require robust cybersecurity. Cryptographic systems are vital to protect the confidentiality and authenticity of data. Quantum computing will be a threat to many of the classical cryptographic algorithms, which are used to achieve these protection goals but are only secure against classical computers. Data that is currently not quantum-safe, whether it is stored or transmitted, and that must remain confidential for a long time, may be compromised in the future by quantum computers (“harvest now, decrypt later” attacks). In addition, authenticity will also be jeopardised by quantum computers. The threat that quantum computing poses to cybersecurity can be countered by a timely, comprehensive and coordinated transition to post-quantum cryptography (PQC).[21][22]

## Algorithms

Post-quantum cryptography research is mostly focused on six different approaches:[3][8]

### Lattice-based cryptography

Main article: Lattice-based cryptography

This approach includes cryptographic systems such as learning with errors, ring learning with errors (ring-LWE),[23][24][25] the ring learning with errors key exchange and the ring learning with errors signature, the older NTRU or GGH encryption schemes, and the newer NTRU signature and BLISS signatures.[26] Some of these schemes like NTRU encryption have been studied for many years without anyone finding a feasible attack. Others like the ring-LWE algorithms have proofs that their security reduces to a worst-case problem.[27] The Post-Quantum Cryptography Study Group sponsored by the European Commission suggested that the Stehle–Steinfeld variant of NTRU be studied for standardization rather than the NTRU algorithm.[28][29] At that time, NTRU was still patented. Studies have indicated that NTRU may have more secure properties than other lattice based algorithms.[30] Two lattice-based algorithms, ML-KEM (commonly known as Kyber) and ML-DSA (commonly known as Dilithium) were among the first post-quantum algorithms standardised by NIST.[31]

### Multivariate cryptography

Main article: Multivariate cryptography

This includes cryptographic systems such as the Unbalanced Oil and Vinegar signature scheme which is based on the difficulty of solving systems of multivariate equations. Various attempts to build secure multivariate equation encryption schemes have been broken, notably the Rainbow signature.[32]

### Hash-based cryptography

Main article: Hash-based cryptography

This includes cryptographic systems such as Lamport signatures, the Merkle signature scheme, the XMSS,[33] the SPHINCS,[34] the WOTS and the SPHINCS+ schemes. Hash based digital signatures were invented in the late 1970s by Ralph Merkle and have been studied ever since as an interesting alternative to number-theoretic digital signatures like RSA and DSA. Their primary drawback is that for any hash-based public key, there is a limit on the number of signatures that can be signed using the corresponding set of private keys. This fact reduced interest in these signatures until interest was revived due to the desire for cryptography that was resistant to attack by quantum computers. There appear to be no patents on the Merkle signature scheme and there exist many non-patented hash functions that could be used with these schemes. The stateful hash-based signature scheme XMSS developed by a team of researchers under the direction of Johannes Buchmann is described in RFC 8391.[35]

Note that all the above schemes are one-time or bounded-time signatures. Moni Naor and Moti Yung invented UOWHF hashing in 1989 and designed a signature based on hashing (the Naor-Yung scheme)[36] which can be unlimited-time in use (the first such signature that does not require trapdoor properties).

### Code-based cryptography

This includes cryptographic systems which rely on error-correcting codes, such as the McEliece and Niederreiter encryption algorithms and the related Courtois, Finiasz and Sendrier Signature scheme. The original McEliece signature using random Goppa codes has withstood scrutiny for over 40 years. However, many variants of the McEliece scheme, which seek to introduce more structure into the code used in order to reduce the size of the keys, have been shown to be insecure.[37] The Post-Quantum Cryptography Study Group sponsored by the European Commission has recommended the McEliece public key encryption system as a candidate for long term protection against attacks by quantum computers.[28] In 2025, NIST announced plans to standardize the code-based HQC encryption algorithm.[38]

### Isogeny-based cryptography

These cryptographic systems rely on the properties of isogeny graphs of elliptic curves (and higher-dimensional abelian varieties) over finite fields, in particular supersingular isogeny graphs, to create cryptographic systems. Among the more well-known representatives of this field are the Diffie–Hellman-like key exchange CSIDH, which can serve as a straightforward quantum-resistant replacement for the Diffie–Hellman and elliptic curve Diffie–Hellman key-exchange methods that are in widespread use today,[39] and the signature scheme SQIsign which is based on the categorical equivalence between supersingular elliptic curves and maximal orders in particular types of quaternion algebras.[40] Another widely noticed construction, SIDH/SIKE, was spectacularly broken in 2022.[41] The attack is however specific to the SIDH/SIKE family of schemes and does not generalize to other isogeny-based constructions.[42]

### Symmetric key quantum resistance

Using sufficiently large key sizes, the symmetric key cryptographic systems like AES and SNOW 3G are already resistant to attack by a quantum computer.[43] Further, key management systems and protocols that use symmetric key cryptography instead of public key cryptography, like Kerberos and the 3GPP Mobile Network Authentication Structure, are also inherently secure against attack by a quantum computer. Given its widespread deployment in the world, some researchers recommend expanded use of Kerberos-like symmetric key management as an efficient way to get post-quantum cryptography today.[44]

## Security reductions

In cryptography research, it is desirable to prove the equivalence of a cryptographic algorithm and a known hard mathematical problem. These proofs are often called "security reductions", and are used to demonstrate the difficulty of cracking the encryption algorithm. In other words, the security of a given cryptographic algorithm is reduced to the security of a known hard problem. Researchers are actively looking for security reductions in the prospects for post-quantum cryptography. Current results are given here:

### Lattice-based cryptography – Ring-LWE Signature

In some versions of Ring-LWE there is a security reduction to the shortest-vector problem (SVP) in a lattice as a lower bound on the security. The SVP is known to be NP-hard.[27] Specific ring-LWE systems that have provable security reductions include a variant of Lyubashevsky's ring-LWE signatures defined in a paper by Güneysu, Lyubashevsky, and Pöppelmann.[24] The GLYPH signature scheme is a variant of the Güneysu, Lyubashevsky, and Pöppelmann (GLP) signature which takes into account research results that have come after the publication of the GLP signature in 2012. Another Ring-LWE signature is Ring-TESLA.[45] There also exists a "derandomized variant" of LWE, called Learning with Rounding (LWR), which yields "improved speedup (by eliminating sampling small errors from a Gaussian-like distribution with deterministic errors) and bandwidth".[46] While LWE uses the addition of a small error to conceal the lower bits, LWR uses rounding for the same purpose.

### Lattice-based cryptography – NTRU, BLISS

The security of the NTRU encryption scheme and the BLISS[26] signature is believed to be related to, but not provably reducible to, the closest vector problem (CVP) in a lattice. The CVP is known to be NP-hard. The Post-Quantum Cryptography Study Group sponsored by the European Commission suggested that the Stehle–Steinfeld variant of NTRU, which does have a security reduction, be studied for long term use instead of the original NTRU algorithm.[28]

### Multivariate cryptography – Unbalanced oil and vinegar

Unbalanced Oil and Vinegar signature schemes are asymmetric cryptographic primitives based on multivariate polynomials over a finite field 𝔽. Bulygin, Petzoldt, and Buchmann have shown a reduction of generic multivariate quadratic UOV systems to the NP-Hard multivariate quadratic equation solving problem.[47]

### Hash-based cryptography – Merkle signature scheme

In 2005, Luis Garcia proved that there was a security reduction of Merkle Hash Tree signatures to the security of the underlying hash function. Garcia showed in his paper that if computationally one-way hash functions exist then the Merkle Hash Tree signature is provably secure.[48]

Therefore, use of a hash function with a provable reduction of security to a known hard problem would have a provable security reduction of the Merkle tree signature to that known hard problem.[49]

The Post-Quantum Cryptography Study Group sponsored by the European Commission has recommended use of the Merkle signature scheme for long term security protection against quantum computers.[28]

### Code-based cryptography – McEliece

The McEliece Encryption System has a security reduction to the syndrome decoding problem (SDP). The SDP is known to be NP-hard.[50] The Post-Quantum Cryptography Study Group sponsored by the European Commission has recommended the use of this cryptography for long term protection against attack by a quantum computer.[28]

### Code-based cryptography – RLCE

In 2016, Wang proposed a random linear code encryption scheme RLCE[51] which is based on McEliece schemes. A RLCE scheme can be constructed using any linear code such as Reed-Solomon code by inserting random columns in the underlying linear code generator matrix.

### Supersingular elliptic curve isogeny cryptography

Security is related to the problem of constructing an isogeny between two supersingular curves with the same number of points. The most recent published investigation of the difficulty of this problem, by Delfs and Galbraith, indicates that this problem is as hard as the inventors of the key exchange suggest that it is.[52] There is no security reduction to a known NP-hard problem.

## Comparison

One common characteristic of many post-quantum cryptography algorithms is that they require larger key sizes than commonly used "pre-quantum" public key algorithms. There are often tradeoffs to be made in key size, computational efficiency and ciphertext or signature size. The table below lists some values for different schemes at a 128-bit post-quantum security level.

Algorithm | Type | Public key | Private key | Signature

|
|
|
|

ML-DSA[53] | Lattice  | 1,312 B  | 2,560 B  | 2,420 B
Streamlined NTRU Prime | Lattice | 154 B |  |
SPHINCS[34] | Hash Signature | 1,000 B | 1,000 B | 41,000 B
BLISS-II | Lattice | 7,000 B | 2,000 B | 5,000 B
GLP-Variant GLYPH Signature[24][54] | Ring-LWE | 2,000 B | 400 B | 1,800 B
NewHope[55] | Ring-LWE | 2,000 B | 2,000 B |
Goppa-based McEliece[28] | Code-based | 1,000,000 B | 11,500 B |
Random Linear Code based encryption[56] | RLCE | 115,000 B | 3,000 B |
Quasi-cyclic MDPC-based McEliece[57] | Code-based | 1,232 B | 2,464 B |
SIDH[58] | Isogeny | 564 B | 48 B |
SIDH (compressed keys)[59] | Isogeny | 330 B | 48 B |
3072-bit Discrete Log | not PQC | 384 B | 32 B | 96 B
256-bit Elliptic Curve | not PQC | 32 B | 32 B | 65 B

A practical consideration on a choice among post-quantum cryptographic algorithms is the effort required to send public keys over the internet. From this point of view, the Ring-LWE, NTRU, and SIDH algorithms provide key sizes conveniently under 1 kB, hash-signature public keys come in under 5 kB, and MDPC-based McEliece takes about 1 kB. On the other hand, Goppa-based McEliece requires a nearly 1 MB key.

### Lattice-based cryptography – LWE key exchange and Ring-LWE key exchange

The fundamental idea of using LWE and Ring LWE for key exchange was proposed and filed at the University of Cincinnati in 2011 by Jintai Ding. The basic idea comes from the associativity of matrix multiplications, and the errors are used to provide the security. The paper[60] appeared in 2012 after a provisional patent application was filed in 2012.

In 2014, Peikert[61] presented a key transport scheme following the same basic idea of Ding's, where the new idea of sending an additional 1 bit signal for rounding in Ding's construction is also used. For somewhat greater than 128 bits of security, Singh presents a set of parameters which have 6956-bit public keys for the Peikert's scheme.[62] The corresponding private key would be roughly 14,000 bits.

In 2015, an authenticated key exchange with provable forward security following the same basic idea of Ding's was presented at Eurocrypt 2015,[63] which is an extension of the HMQV[64] construction in Crypto2005. The parameters for different security levels from 80 bits to 350 bits, along with the corresponding key sizes are provided in the paper.[63]

### Lattice-based cryptography – NTRU encryption

For 128 bits of security in NTRU, `ntruhps2048509` with n = 509 and q = 2048 was selected in the NIST submission in September 2020.[65] This results in a public key of 699 bytes and a corresponding private key of 935 bytes.[66]

### Multivariate cryptography

### Hash-based cryptography – Merkle signature scheme

In order to get 128 bits of security for hash based signatures to sign 1 million messages using the fractal Merkle tree method of Naor Shenhav and Wool the public and private key sizes are roughly 36,000 bits in length.[67]

### Code-based cryptography – McEliece

For 128 bits of security in a McEliece scheme, The European Commission's Post-Quantum Cryptography Study group recommends using a binary Goppa code of length at least n = 6960 and dimension at least k = 5413, and capable of correcting t = 119 errors. With these parameters the public key for the McEliece system will be a systematic generator matrix whose non-identity part takes k × (n − k) = 8373911 bits. The corresponding private key, which consists of the code support with n = 6960 elements from GF(213) and a generator polynomial of with t = 119 coefficients from GF(213), will be 92,027 bits in length.[28]

The group is also investigating the use of Quasi-cyclic MDPC codes of length at least n = 216 \+ 6 = 65542 and dimension at least k = 215 \+ 3 = 32771, and capable of correcting t = 264 errors. With these parameters the public key for the McEliece system will be the first row of a systematic generator matrix whose non-identity part takes k = 32771 bits. The private key, a quasi-cyclic parity-check matrix with d = 274 nonzero entries on a column (or twice as much on a row), takes no more than d × 16 = 4384 bits when represented as the coordinates of the nonzero entries on the first row.

Barreto et al. recommend using a binary Goppa code of length at least n = 3307 and dimension at least k = 2515, and capable of correcting t = 66 errors. With these parameters the public key for the McEliece system will be a systematic generator matrix whose non-identity part takes k × (n − k) = 1991880 bits.[68] The corresponding private key, which consists of the code support with n = 3307 elements from GF(212) and a generator polynomial of t = 66 coefficients from GF(212), will be 40,476 bits in length.

### Supersingular elliptic curve isogeny cryptography

For 128 bits of security in the supersingular isogeny Diffie–Hellman (SIDH) method, De Feo, Jao and Plut recommend using a supersingular curve modulo of a 768-bit prime. If one uses elliptic curve point compression, the public key will need to be no more than 8x768 or 6144 bits in length.[69] A March 2016 paper by authors Azarderakhsh, Jao, Kalach, Koziel, and Leonardi showed how to cut the number of bits transmitted in half, which was further improved by authors Costello, Jao, Longa, Naehrig, Renes and Urbanik resulting in a compressed-key version of the SIDH protocol with public keys only 2640 bits in size.[59] This makes the number of bits transmitted roughly equivalent to the non-quantum secure RSA and Diffie–Hellman at the same classical security level.[70]

### Symmetric-key–based cryptography

## Forward secrecy

A public-key system demonstrates a property referred to as perfect forward secrecy when it generates random public keys per session for the purposes of key agreement. This means that the compromise of one message cannot lead to the compromise of others, and also that there is not a single secret value which can lead to the compromise of multiple messages. Security experts recommend using cryptographic algorithms that support forward secrecy over those that do not.[71] The reason for this is that forward secrecy can protect against the compromise of long term private keys associated with public/private key pairs. This is viewed as a means of preventing mass surveillance by intelligence agencies.

Both the Ring-LWE key exchange and supersingular isogeny Diffie–Hellman (SIDH) key exchange can support forward secrecy in one exchange with the other party. Both the Ring-LWE and SIDH can also be used without forward secrecy by creating a variant of the classic ElGamal encryption variant of Diffie–Hellman.

The other algorithms in this article, such as NTRU, do not support forward secrecy as is.

Any authenticated public key encryption system can be used to build a key exchange with forward secrecy.[72]

## Open Quantum Safe project

The Open Quantum Safe (OQS) project was started in late 2016 and has the goal of developing and prototyping quantum-resistant cryptography.[73][74] It aims to integrate current post-quantum schemes in one library: liboqs.[75] liboqs is an open source C library for quantum-resistant cryptographic algorithms. It initially focuses on key exchange algorithms but by now includes several signature schemes. It provides a common application programming interface (API) suitable for post-quantum key exchange algorithms, and will collect together various implementations. liboqs will also include a test harness and benchmarking routines to compare performance of post-quantum implementations. Furthermore, OQS also provides integration of liboqs into OpenSSL.[76]

As of March 2023, the following key exchange algorithms are supported:[73]

As of August 2024, NIST has published 3 algorithms below as FIPS standards and the 4th is expected near end of the year:[77]

Algorithm | Type

|

BIKE[78] | codes
Classic McEliece | goppa codes
FIPS-203: CRYSTALS-Kyber | ML-KEM:[79] Module Learning With Error
FIPS-204: CRYSTALS-Dilithium[80][81] | ML-DSA:[82] Module Short Integer Solution
FIPS-205: SPHINCS+ | SLH-DSA:[83] hash based
FIPS-206: Falcon | FN-DSA:[84] Short Integer Solution
Frodo[85][86] | Learning with errors
HQC[87][88] | codes
NTRU[89] | Lattice-based cryptography

Older supported versions that have been removed because of the progression of the NIST Post-Quantum Cryptography Standardization Project are:

Algorithm | Type

|

BCNS15[90] | Ring learning with errors key exchange
McBits[91] | Error-correcting codes
NewHope[92][55] | Ring learning with errors key exchange
SIDH[93][94] | Supersingular isogeny key exchange

## Implementation

A challenge in post-quantum cryptography is the implementation of potentially quantum safe algorithms into existing systems. There are tests done, for example by Microsoft Research implementing PICNIC in a PKI using Hardware security modules.[95] Test implementations for Google's NewHope algorithm have also been done by HSM vendors. In August 2023, Google released a FIDO2 security key implementation of an ECC/Dilithium hybrid signature schema which was done in partnership with ETH Zürich.[96]

The Signal Protocol has used Post-Quantum Extended Diffie–Hellman (PQXDH) since 2023.[97][98]

On February 21, 2024, Apple announced that they were going to upgrade their iMessage protocol with a new PQC protocol called "PQ3", which will use ongoing keying.[99][100][101] Apple stated that, although capable quantum computers do not yet exist, they wanted to mitigate risks from future quantum computers as well as so-called "Harvest now, decrypt later" attack scenarios. Apple stated that they believe their PQ3 implementation provides protections that "surpass those in all other widely deployed messaging apps", because it uses ongoing keying. Apple intended to replace the existing iMessage protocol within all supported conversations with PQ3 by the end of 2024. Apple also defined a scale to make it easier to compare the security properties of messaging apps, with a scale represented by levels ranging from 0 to 3: 0 for no end-to-end by default, 1 for pre-quantum end-to-end by default, 2 for PQC key establishment only (e.g. PQXDH), and 3 for PQC key establishment and ongoing rekeying (PQ3).[99]

The Internet Engineering Task Force has prepared an Internet-Draft using PQC algorithms in Messaging Layer Security (MLS).[102] MLS will be used in RCS text messaging in Google Messages and Messages (Apple).

Other notable implementations include:

* bouncycastle[103]
* liboqs[104]

## Post-quantum cryptography in blockchain systems

Blockchain systems commonly rely on public-key cryptography, particularly elliptic-curve digital signature algorithms (ECDSA), to authenticate transactions and control asset ownership. These cryptographic schemes are vulnerable to quantum attacks, as Shor’s algorithm can efficiently solve the discrete logarithm problem on which they are based.[105]

In many blockchain protocols, public keys are not revealed until a transaction is executed; however, once exposed, they may become susceptible to quantum attacks if adversaries possess sufficiently advanced quantum capabilities. This has led to recommendations that users migrate assets to quantum-resistant address schemes prior to the emergence of large-scale quantum computers.[105]

The integration of post-quantum cryptographic algorithms into blockchain systems presents several technical challenges. Many post-quantum signature schemes require larger key and signature sizes, which can increase transaction size, storage requirements, and network bandwidth usage. Additionally, higher computational costs for verification may affect scalability and throughput in distributed networks.[106]

Hybrid cryptographic approaches combining classical and post-quantum signatures have been proposed as transitional solutions. These approaches aim to maintain backward compatibility while gradually introducing quantum-resistant security mechanisms. Ongoing research is focused on optimizing post-quantum schemes for decentralized environments while balancing security, efficiency, and scalability requirements.

### Physical layer complements

While post-quantum algorithms protect data content from future decryption, they do not prevent the interception and storage of the encrypted ciphertext itself (a threat model known as "Harvest now, decrypt later"). To mitigate this risk, some network architectures incorporate physical layer security (PLS) or optical chaos alongside PQC.[107]

By burying the optical signal within the noise floor (negative OSNR) using spectral phase encoding, these physical countermeasures aim to make the transmission unrecordable. This creates a "defense-in-depth" strategy: physical obfuscation prevents the harvesting of ciphertext entirely, ensuring that no data exists for future quantum decryption, while PQC algorithms provide necessary protection for data stored at the endpoints.[108]

### Hybrid encryption

Screenshot of Cloudflare Post-Quantum Key Agreement test page showing Firefox 135.0 using X25519MLKEM768

Google has maintained the use of "hybrid encryption" in its use of post-quantum cryptography: whenever a relatively new post-quantum scheme is used, it is combined with a more proven, non-PQ scheme. This is to ensure that the data are not compromised even if the relatively new PQ algorithm turns out to be vulnerable to non-quantum attacks before Y2Q. This type of scheme is used in its 2016 and 2019 tests for post-quantum TLS,[109] and in its 2023 FIDO2 key.[96] One of the algorithms used in the 2019 test, SIKE, was broken in 2022, but the non-PQ X25519 layer (already used widely in TLS) still protected the data.[109] Apple's PQ3 and Signal's PQXDH are also hybrid.[99]

The NSA and GCHQ argue against hybrid encryption, claiming that it adds complexity to implementation and transition. Daniel J. Bernstein, who supports hybrid encryption, argues that the claims are bogus.[109]

## Criticisms

Post-quantum cryptography's need is predicated on traditional, established cryptographic problems being quickly solved by a quantum computer. However, quantum computers are still under development, and have yet to demonstrated a large scale test of Shor's algorithm, verifying that a quantum speed-up mechanism is possible, and out-performs a classical computer on such problems. In 2019, a team using the IBM Q quantum computer could factor the numbers 15 and 21, but not 35.[110] Other attempts have been made to simulate quantum computers for larger numbers, but the simulations had no quantum advantage (i.e a speed-up over a classical computer).[111]

While the integer factorization, discrete logarithm, and elliptic-curve discrete logarithm problems are potentially broken by the proposed quantum speed-up mechanism, none of the cryptography based on these mathematically difficult problems have been proven unsafe, nor mathematically broken outside of Shor's algorithm, or its derivatives. These cryptograpic systems are used worldwide, and have been extensively tested for vulnerabilities for several decades. Additionally, while Shor's algorithm proposes a polynomial time (i.e. fast) solution, via a quantum period-finding mechanism (i.e. finding a repeating period where the quantum computer tests all possible periods in parallel, then collapsing on correct a solution, or solutions)[112], such a speed-up has never been proven to exist at scale.

Mathematicians Stephen Wolfram and Christopher Wolfram have created simulated models based on Branchial Graphs[113] to mimic quantum mechanics, and by extension can emulate systems utilized by quantum computers. Their research lead Stephen to publicly express mild doubts about the proposed quantum speed-up mechanism's existence, related to the systematic collapse/unwinding of the entangle quantum states down to a usable, error-corrected solution. That is, doubts about the mechanism responsible for the theoretical quantum advantage utilized by future quantum computers, at scale, where a large number of fully entangled qubits are capable of running Shor's Algorithm against a modern classical problem (e.g. RSA-2048, utilizing integer factorization).[114]

In 2013, Edward Snowden's NSA leaks confirmed that the largest supercomputers of the time could not break correctly implemented public key crypto systems. Also, the NSA had not found a mathematical shortcut, despite being the largest employer of mathematicians in the world. Security analyst and cryptographer, Bruce Schneier, who had access to the Snowden archive, concluded that the math was never broken.[115] Taken in aggregate, if the above criticisms prove to be true, then the need for post-quantum cryptography is put into question, along with the need to switch modern business infrastructure onto less-proven cryptographic schemes.

## See also

* NIST Post-Quantum Cryptography Standardization
* Quantum cryptography – cryptography based on quantum mechanics
* Crypto-shredding – Deleting encryption keys

## References

1. ↑ "Post-Quantum Cryptography: A New Security Paradigm for the Post-Quantum Era" (in en-US). 2025-06-05. https://www.pentasecurity.com/blog/security-issue-post-quantum-cryptography/.
2. ↑ Shor, Peter W. (1997). "Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer". SIAM Journal on Computing 26 (5): 1484–1509. doi:10.1137/S0097539795293172. Bibcode: 1995quant.ph..8027S.
3. ↑ 3.0 3.1 3.2 Bernstein, Daniel J. (2009). "Introduction to post-quantum cryptography" (in en). Post-Quantum Cryptography. http://www.pqcrypto.org/www.springer.com/cda/content/document/cda_downloaddocument/9783540887010-c1.pdf.
4. ↑ Kramer, Anna (2023). "'Surprising and super cool'. Quantum algorithm offers faster way to hack internet encryption". Science 381 (6664): 1270. doi:10.1126/science.adk9443. PMID 37733849. https://www.science.org/content/article/surprising-and-supercool-quantum-algorithm-offers-faster-way-hack-internet-encryption.
5. ↑ Regev, Oded (2025-02-28). "An Efficient Quantum Factoring Algorithm" (in en). Journal of the ACM 72 (1): 1–13. doi:10.1145/3708471. ISSN 0004-5411. https://dl.acm.org/doi/10.1145/3708471.
6. ↑ Gershon, Eric (2013-01-14). "New qubit control bodes well for future of quantum computing". phys.org. http://phys.org/news/2013-01-qubit-bodes-future-quantum.html.
7. ↑ Heger, Monica (2009-01-01). "Cryptographers Take On Quantum Computers". IEEE Spectrum. https://spectrum.ieee.org/cryptographers-take-on-quantum-computers.
8. ↑ 8.0 8.1 "Q&A With Post-Quantum Computing Cryptography Researcher Jintai Ding". IEEE Spectrum. 2008-11-01. https://spectrum.ieee.org/qa-with-postquantum-computing-cryptography-researcher-jintai-ding.
9. ↑ "ETSI Quantum Safe Cryptography Workshop". ETSI. October 2014. http://www.etsi.org/news-events/events/770-etsi-crypto-workshop-2014?highlight=YTozOntpOjA7czo3OiJxdWFudHVtIjtpOjE7czo0OiJzYWZlIjtpOjI7czoxMjoicXVhbnR1bSBzYWZlIjt9.
10. ↑ Gasser, Linus (2023), Mulder, Valentin; Mermoud, Alain; Lenders, Vincent et al., eds., "Post-quantum Cryptography" (in en), Trends in Data Protection and Encryption Technologies (Cham: Springer Nature Switzerland): pp. 47–52, doi:10.1007/978-3-031-33386-6_10, ISBN 978-3-031-33386-6
11. ↑ Townsend, Kevin (2022-02-16). "Solving the Quantum Decryption 'Harvest Now, Decrypt Later' Problem" (in en-US). https://www.securityweek.com/solving-quantum-decryption-harvest-now-decrypt-later-problem/.
12. ↑ "Quantum-Safe Secure Communications". October 2021. https://uknqt.ukri.org/wp-content/uploads/2021/10/Quantum-Safe-Secure-Communications.pdf.
13. ↑ Daniel J. Bernstein (2009-05-17). "Cost analysis of hash collisions: Will quantum computers make SHARCS obsolete?". http://cr.yp.to/hash/collisioncost-20090823.pdf.
14. ↑ Daniel J. Bernstein (2010-03-03). "Grover vs. McEliece". http://cr.yp.to/codes/grovercode-20100303.pdf.
15. ↑ NIST Releases First 3 Finalized Post-Quantum Encryption Standards, NIST, August 13, 2024
16. ↑ 16.0 16.1 Mosca, Michele (2018). "Cybersecurity in an era with quantum computers: Will we be ready?". IEEE Security & Privacy 16 (5): 38–41. doi:10.1109/MSP.2018.3761723.
17. ↑ ﻿Quantum-Safe Secure Communications﻿ (Report). UK National Quantum Technologies Programme. October 2021. https://uknqt.ukri.org/wp-content/uploads/2021/10/Quantum-Safe-Secure-Communications.pdf. Retrieved 28 February 2026.
18. ↑ "Experimenting with Post-Quantum Cryptography". 7 July 2016. https://security.googleblog.com/2016/07/experimenting-with-post-quantum.html.
19. ↑ "NIST Releases First 3 Finalized Post-Quantum Encryption Standards". 13 August 2024. https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards.
20. ↑ ﻿Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography﻿ (Report). European Commission. 23 June 2025. https://digital-strategy.ec.europa.eu/en/library/coordinated-implementation-roadmap-transition-post-quantum-cryptography. Retrieved 28 February 2026.
21. ↑ "A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography". European Union. 2025-06-23. https://digital-strategy.ec.europa.eu/en/library/coordinated-implementation-roadmap-transition-post-quantum-cryptography.
22. ↑ "The PQC Migration Handbook". General Intelligence and Security Service. 2024-12-01. https://english.aivd.nl/publications/publications/2024/12/3/the-pqc-migration-handbook.
23. ↑ Peikert, Chris (2014), Mosca, Michele, ed., "Lattice Cryptography for the Internet", Post-Quantum Cryptography, Lecture Notes in Computer Science (Cham: Springer International Publishing) 8772: pp. 197–219, doi:10.1007/978-3-319-11659-4_12, ISBN 978-3-319-11658-7, Bibcode: 2014LNCS.8772..197P, https://eprint.iacr.org/2014/070.pdf, retrieved 2025-07-24 .
24. ↑ 24.0 24.1 24.2 Güneysu, Tim; Lyubashevsky, Vadim; Pöppelmann, Thomas (2012), Prouff, Emmanuel; Schaumont, Patrick, eds., "Practical Lattice-Based Cryptography: A Signature Scheme for Embedded Systems", Cryptographic Hardware and Embedded Systems – CHES 2012 (Berlin, Germany; Heidelberg, Germany: Springer Berlin Heidelberg) 7428: pp. 530–547, doi:10.1007/978-3-642-33027-8_31, ISBN 978-3-642-33026-1, https://iacr.org/archive/ches2012/74280529/74280529.pdf, retrieved 2025-07-24 .
25. ↑ Zhang, Jiang; Zhang, Zhenfeng; Ding, Jintai; Snook, Michael; Dagdelen, Özgür (2015), Oswald, Elisabeth; Fischlin, Marc, eds., "Authenticated Key Exchange from Ideal Lattices", Advances in Cryptology – EUROCRYPT 2015 (Berlin, Germany; Heidelberg, Germany: Springer Berlin Heidelberg) 9057: pp. 719–751, doi:10.1007/978-3-662-46803-6_24, ISBN 978-3-662-46802-9, https://eprint.iacr.org/2014/589.pdf, retrieved 2025-07-24 .
26. ↑ 26.0 26.1 Ducas, Léo; Durmus, Alain; Lepoint, Tancrède; Lyubashevsky, Vadim (2013), Canetti, Ran; Garay, Juan A., eds., "Lattice Signatures and Bimodal Gaussians", Advances in Cryptology – CRYPTO 2013 (Berlin, Germany; Heidelberg, Germany: Springer Berlin Heidelberg) 8042: pp. 40–56, doi:10.1007/978-3-642-40041-4_3, ISBN 978-3-642-40040-7, Bibcode: 2013LNCS.8042...40D, https://eprint.iacr.org/2013/383.pdf, retrieved 2025-07-24 .
27. ↑ 27.0 27.1 Lyubashevsky, Vadim; Peikert, Chris; Regev, Oded (2010), Gilbert, Henri, ed., "On Ideal Lattices and Learning with Errors over Rings", Advances in Cryptology – EUROCRYPT 2010 (Berlin, Germany; Heidelberg, Germany: Springer Berlin Heidelberg) 6110: pp. 1–23, doi:10.1007/978-3-642-13190-5_1, ISBN 978-3-642-13189-9, Bibcode: 2010LNCS.6110....1L, https://eprint.iacr.org/2012/230.pdf, retrieved 2025-07-24 .
28. ↑ 28.0 28.1 28.2 28.3 28.4 28.5 28.6 Augot, Daniel; Batina, Lejla; Bernstein, Daniel J.. "Error: no `|title=` specified when using {{Cite web}}". http://pqcrypto.eu.org/docs/initial-recommendations.pdf.Error:+no+`|title=`+specified when+using+{{[[Template:Cite+web|Cite+web]]}}[[Category:Articles+with+incorrect+citation+syntax|Post-quantum+cryptography]]&rft.atitle=&rft.aulast=Augot&rft.aufirst=Daniel&rft.au=Augot, Daniel&rft.au=Batina, Lejla&rft.au=Bernstein, Daniel+J.&rft.au=Gueron, Shay&rft_id=http://pqcrypto.eu.org/docs/initial-recommendations.pdf&rfr_id=info:sid/en.wikibooks.org:Post-quantum_cryptography">
29. ↑ Stehlé, Damien; Steinfeld, Ron (2013-01-01). "Making NTRUEncrypt and NTRUSign as Secure as Standard Worst-Case Problems over Ideal Lattices". Cryptology ePrint Archive. http://eprint.iacr.org/2013/004.
30. ↑ Easttom, Chuck (2019-02-01). "An Analysis of Leading Lattice-Based Asymmetric Cryptographic Primitives". 2019 IEEE 9th Annual Computing and Communication Workshop and Conference (CCWC). pp. 811–818. doi:10.1109/CCWC.2019.8666459. ISBN 978-1-7281-0554-3.
31. ↑ "NIST Releases First 3 Finalized Post-Quantum Encryption Standards". National Institute of Standards and Technology. 13 August 2024. https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards.
32. ↑ Beullens, Ward (2022). "Advances in Cryptology - CRYPTO 2022". pp. 464–479. ISBN 978-3-031-15979-4.
33. ↑ Buchmann, Johannes; Dahmen, Erik; Hülsing, Andreas (2011). "Post-Quantum Cryptography. PQCrypto 2011". 7071. pp. 117–129. doi:10.1007/978-3-642-25405-5_8. ISBN 978-3-642-25404-8.
34. ↑ 34.0 34.1 Bernstein, Daniel J.; Hopwood, Daira; Hülsing, Andreas; Lange, Tanja; Niederhagen, Ruben; Papachristodoulou, Louiza; Schneider, Michael; Schwabe, Peter et al. (2015). "SPHINCS: Practical Stateless Hash-Based Signatures". in Oswald, Elisabeth. Advances in Cryptology – EUROCRYPT 2015. Lecture Notes in Computer Science. 9056. Springer Berlin Heidelberg. pp. 368–397. doi:10.1007/978-3-662-46800-5_15. ISBN 9783662467992.
35. ↑ Huelsing, A.; Butin, D.; Gazdag, S.; Rijneveld, J.; Mohaisen, A. (2018) (in en). RFC 8391 – XMSS: eXtended Merkle Signature Scheme. doi:10.17487/RFC8391. https://tools.ietf.org/html/rfc8391.
36. ↑ Naor, M.; Yung, M. (1989) (in en). Universal one-way hash functions and their cryptographic applications. ACM Press. pp. 33–43. doi:10.1145/73007.73011. ISBN 978-0-89791-307-2.
37. ↑ Overbeck, Raphael; Sendrier (2009). "Code-based cryptography". in Bernstein, Daniel. Post-Quantum Cryptography. pp. 95–145. doi:10.1007/978-3-540-88702-7_4. ISBN 978-3-540-88701-0.
38. ↑ "NIST Selects HQC as Fifth Algorithm for Post-Quantum Encryption". National Institute of Standards and Technology. 11 March 2025. https://www.nist.gov/news-events/news/2025/03/nist-selects-hqc-fifth-algorithm-post-quantum-encryption.
39. ↑ Castryck, Wouter; Lange, Tanja; Martindale, Chloe; Panny, Lorenz; Renes, Joost (2018). "CSIDH: An Efficient Post-Quantum Commutative Group Action". in Peyrin, Thomas; Galbraith, Steven (in en). Advances in Cryptology – ASIACRYPT 2018. Lecture Notes in Computer Science. 11274. Cham: Springer International Publishing. pp. 395–427. doi:10.1007/978-3-030-03332-3_15. ISBN 978-3-030-03332-3. https://research.tue.nl/en/publications/24dbb7c0-6ba1-4ecf-8150-25cd803113ec.
40. ↑ De Feo, Luca; Kohel, David; Leroux, Antonin; Petit, Christophe; Wesolowski, Benjamin (2020). "SQISign: Compact Post-quantum Signatures from Quaternions and Isogenies". in Moriai, Shiho; Wang, Huaxiong (in en). Advances in Cryptology – ASIACRYPT 2020. Lecture Notes in Computer Science. 12491. Cham: Springer International Publishing. pp. 64–93. doi:10.1007/978-3-030-64837-4_3. ISBN 978-3-030-64837-4. https://hdl.handle.net/handle/2013/ULB-DIPOT:oai:dipot.ulb.ac.be:2013/318983.
41. ↑ Castryck, Wouter; Decru, Thomas (2023), Hazay, Carmit; Stam, Martijn, eds., "An Efficient Key Recovery Attack on SIDH" (in en), Advances in Cryptology – EUROCRYPT 2023 (Cham: Springer Nature Switzerland) 14008: pp. 423–447, doi:10.1007/978-3-031-30589-4_15, ISBN 978-3-031-30588-7, https://link.springer.com/10.1007/978-3-031-30589-4_15, retrieved 2023-06-21
42. ↑ "Is SIKE broken yet?". https://issikebrokenyet.github.io/.
43. ↑ Perlner, Ray A.; Cooper, David A. (2009-04-14) (in en). Quantum resistant public key cryptography: a survey. ACM. pp. 85–93. doi:10.1145/1527017.1527028. ISBN 978-1-60558-474-4. https://dl.acm.org/doi/10.1145/1527017.1527028.
44. ↑ Campagna, Matt; Hardjono, Thomas; Pintsov, Leon; Romansky, Brian; Yu, Taylor (2013). "Kerberos Revisited Quantum-Safe Authentication". ETSI. http://docbox.etsi.org/Workshop/2013/201309_CRYPTO/S03_INDUSTRY_SESSION/PITNEYBOWES_PINTSOV.pdf.
45. ↑ Akleylek, Sedat; Bindel, Nina; Buchmann, Johannes; Krämer, Juliane; Marson, Giorgia Azzurra (2016), Pointcheval, David; Nitaj, Abderrahmane; Rachidi, Tajjeeddine, eds., "An Efficient Lattice-Based Signature Scheme with Provably Secure Instantiation", Progress in Cryptology – AFRICACRYPT 2016 (Cham: Springer International Publishing) 9646: pp. 44–60, doi:10.1007/978-3-319-31517-1_3, ISBN 978-3-319-31516-4, https://eprint.iacr.org/2016/030, retrieved 2025-07-27
46. ↑ Nejatollahi, Hamid; Dutt, Nikil; Ray, Sandip; Regazzoni, Francesco; Banerjee, Indranil; Cammarota, Rosario (2019-02-27). "Post-Quantum Lattice-Based Cryptography Implementations: A Survey" (in en). ACM Computing Surveys 51 (6): 1–41. doi:10.1145/3292548. ISSN 0360-0300. https://dl.acm.org/doi/10.1145/3292548.
47. ↑ Bulygin, Stanislav; Petzoldt; Buchmann (2010). "Towards Provable Security of the Unbalanced Oil and Vinegar Signature Scheme under Direct Attacks". Progress in Cryptology – INDOCRYPT 2010. Lecture Notes in Computer Science. 6498. pp. 17–32. doi:10.1007/978-3-642-17401-8_3. ISBN 978-3-642-17400-1.
48. ↑ Pereira, Geovandro; Puodzius, Cassius; Barreto, Paulo (2016). "Shorter hash-based signatures". Journal of Systems and Software 116: 95–100. doi:10.1016/j.jss.2015.07.007.
49. ↑ Garcia, Luis. "On the security and the efficiency of the Merkle signature scheme". IACR. http://eprint.iacr.org/2005/192.pdf.
50. ↑ Blaum, Mario; Farrell; Tilborg (31 May 2002). Information, Coding and Mathematics. Springer. doi:10.1007/978-1-4757-3585-7. ISBN 978-1-4757-3585-7.
51. ↑ Wang, Yongge (2016). "Quantum resistant random linear code based public key encryption scheme RLCE". 2016 IEEE International Symposium on Information Theory (ISIT). pp. 2519–2523. doi:10.1109/ISIT.2016.7541753. ISBN 978-1-5090-1806-2. Bibcode: 2015arXiv151208454W.
52. ↑ Delfs, Christina; Galbraith, Steven D. (February 2016). "Computing isogenies between supersingular elliptic curves over F_p" (in en). Designs, Codes and Cryptography 78 (2): 425–440. doi:10.1007/s10623-014-0010-1. ISSN 0925-1022. http://link.springer.com/10.1007/s10623-014-0010-1.
53. ↑ National Institute of Standards and Technology (2024-08-13). ﻿Module-Lattice-Based Digital Signature Standard﻿ (Report). Gaithersburg, MD: National Institute of Standards and Technology. doi:10.6028/nist.fips.204. https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.204.pdf.
54. ↑ Chopra, Arjun (2017). "GLYPH: A New Insantiation of the GLP Digital Signature Scheme". Cryptology ePrint Archive. https://eprint.iacr.org/2017/766.
55. ↑ 55.0 55.1 Alkim, Erdem; Ducas, Léo; Pöppelmann, Thomas; Schwabe, Peter (2015). "Post-quantum key exchange – a new hope". Cryptology ePrint Archive, Report 2015/1092. http://eprint.iacr.org/2015/1092.
56. ↑ Wang, Yongge (2017). "Revised Quantum Resistant Public Key Encryption Scheme RLCE and IND-CCA2 Security for McEliece Schemes". Cryptology ePrint Archive. https://eprint.iacr.org/2017/206.
57. ↑ Misoczki, R.; Tillich, J. P.; Sendrier, N.; Barreto, P. S. L. M. (2013). "MDPC-McEliece: New McEliece variants from Moderate Density Parity-Check codes". 2013 IEEE International Symposium on Information Theory. pp. 2069–2073. doi:10.1109/ISIT.2013.6620590. ISBN 978-1-4799-0446-4.
58. ↑ Costello, Craig; Longa, Patrick; Naehrig, Michael (2016). "Efficient Algorithms for Supersingular Isogeny Diffie–Hellman". Advances in Cryptology – CRYPTO 2016. Lecture Notes in Computer Science. 9814. pp. 572–601. doi:10.1007/978-3-662-53018-4_21. ISBN 978-3-662-53017-7. http://eprint.iacr.org/2016/413.pdf.
59. ↑ 59.0 59.1 Costello, Craig; Jao. "Efficient Compression of SIDH public keys". https://eprint.iacr.org/2016/963.
60. ↑ Ding, Jintai; Xie, Xiang; Lin, Xiaodong (2012-01-01). "A Simple Provably Secure Key Exchange Scheme Based on the Learning with Errors Problem". Cryptology ePrint Archive. http://eprint.iacr.org/2012/688.
61. ↑ Peikert, Chris (2014-01-01). "Lattice Cryptography for the Internet". Cryptology ePrint Archive. Lecture Notes in Computer Science. 8772. p. 197. doi:10.1007/978-3-319-11659-4_12. ISBN 978-3-319-11658-7. Bibcode: 2014LNCS.8772..197P. http://eprint.iacr.org/2014/070.
62. ↑ Singh, Vikram (2015). "A Practical Key Exchange for the Internet using Lattice Cryptography". Cryptology ePrint Archive. http://eprint.iacr.org/2015/138. Retrieved 2015-04-18.
63. ↑ 63.0 63.1 Zhang, Jiang; Zhang, Zhenfeng; Ding, Jintai; Snook, Michael; Dagdelen, Özgür (2015-04-26). "Authenticated Key Exchange from Ideal Lattices". in Oswald, Elisabeth. Advances in Cryptology – EUROCRYPT 2015. Lecture Notes in Computer Science. 9057. Springer Berlin Heidelberg. pp. 719–751. doi:10.1007/978-3-662-46803-6_24. ISBN 978-3-662-46802-9.
64. ↑ Krawczyk, Hugo (2005-08-14). "HMQV: A High-Performance Secure Diffie–Hellman Protocol". in Shoup, Victor. Advances in Cryptology – CRYPTO 2005. Lecture Notes in Computer Science. 3621. Springer. pp. 546–566. doi:10.1007/11535218_33. ISBN 978-3-540-28114-6.
65. ↑ "NTRU Algorithm Specifications And Supporting Documentation" (PDF in .tar.gz). 2020. https://ntru.org/release/NIST-PQ-Submission-NTRU-20201016.tar.gz.
66. ↑ (in en) Measurements of key-encapsulation mechanisms, 2026, https://bench.cr.yp.to/results-kem.html, retrieved 2026-04-07
67. ↑ Naor, Dalit; Shenhav, Amir; Wool, Avishai (November 2006). "One-Time Signatures Revisited: Practical Fast Signatures Using Fractal Merkle Tree Traversal". 2006 IEEE 24th Convention of Electrical & Electronics Engineers in Israel. IEEE. pp. 255–259. doi:10.1109/EEEI.2006.321066. ISBN 978-1-4244-0229-8.
68. ↑ Barreto, Paulo S. L. M.; Biasi, Felipe Piazza; Dahab, Ricardo; López-Hernández, Julio César; Morais, Eduardo M. de; Oliveira, Ana D. Salina de; Pereira, Geovandro C. C. F.; Ricardini, Jefferson E. (2014). Koç, Çetin Kaya. ed. A Panorama of Post-quantum Cryptography. Springer International Publishing. pp. 387–439. doi:10.1007/978-3-319-10683-0_16. ISBN 978-3-319-10682-3.
69. ↑ De Feo, Luca; Jao (2011). "Towards Quantum-Resistant Cryptosystems From Supersingular Elliptic Curve Isogenies". http://eprint.iacr.org/2011/506.pdf.
70. ↑ Azarderakhsh, Reza; Jao, David; Kalach, Kassem; Koziel, Brian; Leonardi, Christopher. "Key Compression for Isogeny-Based Cryptosystems". http://eprint.iacr.org/2016/229.
71. ↑ Ristic, Ivan (2013-06-25). "Deploying Forward Secrecy". SSL Labs. https://community.qualys.com/blogs/securitylabs/2013/06/25/ssl-labs-deploying-forward-secrecy.
72. ↑ "Does NTRU provide Perfect Forward Secrecy?". https://crypto.stackexchange.com/a/19115.
73. ↑ 73.0 73.1 "Open Quantum Safe". https://openquantumsafe.org/.
74. ↑ Stebila, Douglas; Mosca, Michele. "Post-Quantum Key Exchange for the Internet and the Open Quantum Safe Project". http://eprint.iacr.org/2016/1017.
75. ↑ "liboqs: C library for quantum-resistant cryptographic algorithms". 26 November 2017. https://github.com/open-quantum-safe/liboqs.
76. ↑ "oqsprovider: Open Quantum Safe provider for OpenSSL (3.x)". 12 August 2024. https://github.com/open-quantum-safe/oqs-provider/.
77. ↑ "NIST Releases First 3 Finalized Post-Quantum Encryption Standards". NIST. 13 August 2024. https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards.
78. ↑ "BIKE – Bit Flipping Key Encapsulation". https://bikesuite.org/.
79. ↑ "Module-Lattice-Based Key-Encapsulation Mechanism Standard". 2024. doi:10.6028/NIST.FIPS.203. https://csrc.nist.gov/pubs/fips/203/final.
80. ↑ Schwabe, Peter. "Dilithium". https://pq-crystals.org/dilithium/.
81. ↑ "Cryptographic Suite for Algebraic Lattices, Digital Signature: Dilithium". https://csrc.nist.gov/CSRC/media/Presentations/Crystals-Dilithium/images-media/CRYSTALS-Dilithium-April2018.pdf.
82. ↑ "Module-Lattice-Based Digital Signature Standard". 2024. doi:10.6028/NIST.FIPS.204. https://csrc.nist.gov/pubs/fips/204/final.
83. ↑ "Stateless Hash-Based Digital Signature Standard". 2024. doi:10.6028/NIST.FIPS.205. https://csrc.nist.gov/pubs/fips/205/final.
84. ↑ "NIST Releases First 3 Finalized Post-Quantum Encryption Standards". NIST. 13 August 2024. https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards.
85. ↑ Bos, Joppe; Costello, Craig; Ducas, Léo; Mironov, Ilya; Naehrig, Michael; Nikolaenko, Valeria; Raghunathan, Ananth; Stebila, Douglas (2016-01-01). "Frodo: Take off the ring! Practical, Quantum-Secure Key Exchange from LWE". Cryptology ePrint Archive. http://eprint.iacr.org/2016/659.
86. ↑ "FrodoKEM" (in en). https://frodokem.org/.
87. ↑ "HQC". https://pqc-hqc.org/.
88. ↑ "Fast and Efficient Hardware Implementation of HQC". https://csrc.nist.gov/csrc/media/Events/2022/fourth-pqc-standardization-conference/documents/papers/fast-and-efficient-hardware-impl-of-hqc-pqc2022.pdf.
89. ↑ "NTRUOpenSourceProject/NTRUEncrypt" (in en). https://github.com/NTRUOpenSourceProject/NTRUEncrypt.
90. ↑ Stebila, Douglas (26 Mar 2018). "liboqs nist-branch algorithm datasheet: kem_newhopenist". https://github.com/open-quantum-safe/liboqs/blob/7cc365a363a05cdb233b9d72d0164c123d7b0b65/docs/algorithms/kem_newhopenist.md.
91. ↑ Bernstein, Daniel J.; Chou, Tung; Schwabe, Peter (2015-01-01). "McBits: fast constant-time code-based cryptography". Cryptology ePrint Archive. https://eprint.iacr.org/2015/610.
92. ↑ "Lattice Cryptography Library". 19 Apr 2016. https://www.microsoft.com/en-us/research/project/lattice-cryptography-library/.
93. ↑ "SIDH Library – Microsoft Research" (in en-US). Microsoft Research. https://www.microsoft.com/en-us/research/project/sidh-library/.
94. ↑ Feo, Luca De; Jao, David; Plût, Jérôme (2011). "Towards Quantum-Resistant Cryptosystems from Supersingular Elliptic Curve Isogenies". Post-Quantum Cryptography. Lecture Notes in Computer Science. 7071. p. 19. doi:10.1007/978-3-642-25405-5_2. ISBN 978-3-642-25404-8. Bibcode: 2011LNCS.7071...19J. https://eprint.iacr.org/2011/506.
95. ↑ "Microsoft/Picnic" (in en). https://github.com/Microsoft/Picnic/blob/master/spec/design-v1.0.pdf.
96. ↑ 96.0 96.1 "Toward Quantum Resilient Security Keys" (in en). https://security.googleblog.com/2023/08/toward-quantum-resilient-security-keys.html.
97. ↑ Fiedler, Rune; Janson, Christian (2024). "A Deniability Analysis of Signal's Initial Handshake PQXDH". Proceedings on Privacy Enhancing Technologies 2024 (4): 907–928. doi:10.56553/popets-2024-0051. ISSN 2299-0984.
98. ↑ Ehren Kret, Rolfe Schmidt (September 19, 2023). "Quantum Resistance and the Signal Protocol". Signal Foundation. https://signal.org/blog/pqxdh/.
99. ↑ 99.0 99.1 99.2 Apple Security Engineering and Architecture (SEAR) (February 21, 2024). "iMessage with PQ3: The new state of the art in quantum-secure messaging at scale". Apple Inc.. https://security.apple.com/blog/imessage-pq3. "With compromise-resilient encryption and extensive defenses against even highly sophisticated quantum attacks, PQ3 is the first messaging protocol to reach what we call Level 3 security — providing protocol protections that surpass those in all other widely deployed messaging apps."
100. ↑ Rossignoi, Joe (February 21, 2024). "Apple Announces 'Groundbreaking' New Security Protocol for iMessage". https://www.macrumors.com/2024/02/21/apple-announces-imessage-security-upgrade/.
101. ↑ Potuck, Michael (February 21, 2024). "Apple launching quantum computer protection for iMessage with iOS 17.4, here's what that means". https://9to5mac.com/2024/02/21/imessage-quantum-security-ios-17-4/.
102. ↑ Mahy, Rohan; Barnes, Richard (2025-03-03). ﻿ML-KEM and Hybrid Cipher Suites for Messaging Layer Security﻿ (Report). Internet Engineering Task Force. https://datatracker.ietf.org/doc/draft-mahy-mls-pq/00/.
103. ↑ "Bouncy Castle Betas". https://downloads.bouncycastle.org/betas.
104. ↑ "Open Quantum Safe". https://openquantumsafe.org/liboqs/.
105. ↑ 105.0 105.1 Aggarwal, Divesh (2018). "Quantum attacks on Bitcoin, and how to protect against them". Ledger 3: 68–90. doi:10.5195/ledger.2018.127.
106. ↑ Nejatollahi, Hamid (2019). "Post-Quantum Lattice-Based Cryptography Implementations: A Survey". ACM Computing Surveys 51 (6): 1–41. doi:10.1145/3292548.
107. ↑ Sadot, Dan (2025). "Photonic Layer Security in High-Speed Optical Communications". Journal of Lightwave Technology (IEEE) 43 (4): 1671–1677. doi:10.1109/JLT.2024.3522110. https://ieeexplore.ieee.org/document/10812060.
108. ↑ Cohen, Roi; Wohlgemuth, Eyal; Yoffe, Yaron; Yalinevich, Yarden; Attia, Ido; Yalinevich, Almog; Yehoash, Rami; Rabinovich, Aviv et al. (2024). "Cryptanalysis of Practical Optical Layer Security Based on Phase Masking of Mode-Locked Lasers and Multi-Homodyne Coherent Detection". Journal of Lightwave Technology (IEEE) 42 (19): 6712–6730. doi:10.1109/JLT.2024.3410646. Bibcode: 2024JLwT...42.6712C.
109. ↑ 109.0 109.1 109.2 Bernstein, Daniel J. (2024-01-02). "Double encryption: Analyzing the NSA/GCHQ arguments against hybrids. #nsa #quantification #risks #complexity #costs". https://blog.cr.yp.to/20240102-hybrid.html.
110. ↑ Amico, Mirko (2019-07-08). "Experimental study of Shor's factoring algorithm using the IBM Q Experience". Physical Review A 100 (1). doi:10.1103/PhysRevA.100.012305. Bibcode: 2019PhRvA.100a2305A. https://journals.aps.org/pra/abstract/10.1103/PhysRevA.100.012305.
111. ↑ Yan, Bao; Tan, Ziqi; Wei, Shijie; Jiang, Haocong; Wang, Weilong; Wang, Hong; Luo, Lan; Duan, Qianheng; Liu, Yiting; Shi, Wenhao; Fei, Yangyang; Meng, Xiangdong; Han, Yu; Shan, Zheng; Chen, Jiachen; Zhu, Xuhao; Zhang, Chuanyu; Jin, Feitong; Li, Hekang; Song, Chao; Wang, Zhen; Ma, Zhi; Wang, H.; Long, Gui-Lu (2022). "Factoring integers with sublinear resources on a superconducting quantum processor". arXiv:2212.12372 [quant-ph].
112. ↑ Schuld, Maria (2025-04-16). Period finding: A problem at the heart of quantum computing. https://pennylane.ai/qml/demos/tutorial_period_finding. Retrieved 2026-04-30.
113. ↑ "The Concept of Branchial Graphs". https://www.wolframphysics.org/technical-introduction/the-updating-process-for-string-substitution-systems/the-concept-of-branchial-graphs/.
114. ↑ Fridman, Lex (2020-09-18). "The Hope for Quantum Computers | Stephen Wolfram and Lex Fridman". https://www.youtube.com/watch?v=szozqGl97E0.
115. ↑ Schneier, Bruce (2013-09-05). "The NSA Is Breaking Most Encryption on the Internet". https://www.schneier.com/blog/archives/2013/09/the_nsa_is_brea.html.

## Further reading

* Bagirovs, Emils; Provodin, Grigory; Sipola, Tuomo; Hautamäki, Jari (2024). "Applications of Post-quantum Cryptography". European Conference on Cyber Warfare and Security 23 (1): 49–57. doi:10.34190/eccws.23.1.2247.
* Bavdekar, Ritik; Chopde, Eashan Jayant; Bhatia, Ashutosh; Tiwari, Kamlesh; Daniel, Sandeep Joshua (2022). "Post Quantum Cryptography: Techniques, Challenges, Standardization, and Directions for Future Research". arXiv:2202.02826 [cs.CR].
* Bavdekar, Ritik; Jayant Chopde, Eashan; Agrawal, Ankit; Bhatia, Ashutosh; Tiwari, Kamlesh (2023). "Post Quantum Cryptography: A Review of Techniques, Challenges and Standardizations". 2023 International Conference on Information Networking (ICOIN). pp. 146–151. doi:10.1109/ICOIN56518.2023.10048976. ISBN 978-1-6654-6268-6.
* Bernstein, Daniel J.; Buchmann, Johannes; Dahmen, Erik, eds (2008). Post-Quantum Cryptography. Springer. pp. 245. ISBN 978-3-540-88701-0. https://www.springer.com/mathematics/numbers/book/978-3-540-88701-0.
* Bernstein, Daniel J.; Lange, Tanja (2017). "Post-quantum cryptography". Nature 549 (7671): 188–194. doi:10.1038/nature23461. PMID 28905891. Bibcode: 2017Natur.549..188B. https://research.tue.nl/nl/publications/5bbd4ea6-f4a5-452c-b9aa-f535cd8f4a50.
* Buchmann, Johannes A.; Butin, Denis; Göpfert, Florian; Petzoldt, Albrecht (2016). "Post-Quantum Cryptography: State of the Art" (in en). The New Codebreakers: Essays Dedicated to David Kahn on the Occasion of His 85th Birthday. Springer. pp. 88–108. doi:10.1007/978-3-662-49301-4_6. ISBN 978-3-662-49301-4. https://link.springer.com/chapter/10.1007/978-3-662-49301-4_6?fromPaywallRec=true.
* Campagna, M.; Hardjono, T.; Pintsov, L.; Romansky, B.; and Yu, T. "Kerberos Revisited: Quantum-Safe Authentication". ETSI Quantum-Safe-Crypto Workshop. September 26, 2013.
* Campagna, Matt; LaMacchia, Brian; Ott, David (2021). "Post Quantum Cryptography: Readiness Challenges and the Approaching Storm". Computing Community Consortium.
* [Certera]. X9 PKI: PQC Readiness and Crypto-Agility for Financial Services. Certera.
* Chase, Melissa; Derler, David; Goldfeder, Steven; Orlandi, Claudio; Ramacher, Sebastian; Rechberger, Christian; Slamanig, Daniel; Zaverucha, Greg (29 November 2017). The Picnic Signature Scheme Design Document Version 1.0.
* Dam, Duc-Thuan; Tran, Thai-Ha; Hoang, Van-Phuc; Pham, Cong-Kha; Hoang, Trong-Thuc (2023). "A Survey of Post-Quantum Cryptography: Start of a New Race". Cryptography 7 (3): 40. doi:10.3390/cryptography7030040.
* Jao, David (September 19, 2011). Isogenies in a Quantum World; . University of Waterloo.
* Joseph, David; Misoczki, Rafael; Manzano, Marc; Tricot, Joe; Pinuaga, Fernando Dominguez; Lacombe, Olivier; Leichenauer, Stefan; Hidary, Jack et al. (2022). "Transitioning organizations to post-quantum cryptography". Nature 605 (7909): 237–243. doi:10.1038/s41586-022-04623-2. PMID 35546191. Bibcode: 2022Natur.605..237J.
* Kret, Ehren; Rolfe Schmidt (2024-01-23) [2023-05-24]. The PQXDH Key Agreement Protocol Specification, Revision 3.
* Kumar, Manoj; Pattnaik, Pratap (2020). "Post Quantum Cryptography – an overview: (Invited Paper)". 2020 IEEE High Performance Extreme Computing Conference. pp. 1–9. doi:10.1109/HPEC43674.2020.9286147. ISBN 978-1-7281-9219-2.
* Li, Silong; Chen, Yuxiang; Chen, Lin; Liao, Jing; Kuang, Chanchan; Li, Kuanching; Liang, Wei; Xiong, Naixue (2023). "Post-Quantum Security: Opportunities and Challenges". Sensors 23 (21): 8744. doi:10.3390/s23218744. PMID 37960442. Bibcode: 2023Senso..23.8744L.
* Lyubashevsky, Vadim; Chris Peikert; Oded Regev. "On Ideal Lattices and Learning with Errors Over Rings".
* Mamatha, G S; Dimri, Namya; Sinha, Rasha (2024). "Post-Quantum Cryptography: Securing Digital Communication in the Quantum Era". arXiv:2403.11741 [cs.CR].
* Rawal, Bharat S.; Curry, Peter J. (2024). "Challenges and opportunities on the horizon of post-quantum cryptography". APL Quantum 1 (2). doi:10.1063/5.0198344.
* Richter, Maximilian; Bertram, Magdalena; Seidensticker, Jasper; Tschache, Alexander (2022). "A Mathematical Perspective on Post-Quantum Cryptography". Mathematics 10 (15): 2579. doi:10.3390/math10152579.
* Sood, Neerav (2024). "Cryptography in Post Quantum Computing Era". SSRN Electronic Journal. doi:10.2139/ssrn.4705470.
* Singh, Balvinder; Ahateshaam, Md; Lahiri, Abhisweta; Sagar, Anil Kumar (2024). "Future of Cryptography in the Era of Quantum Computing". Innovations in Electrical and Electronic Engineering. Lecture Notes in Electrical Engineering. 1115. pp. 13–31. doi:10.1007/978-981-99-8661-3_2. ISBN 978-981-99-8660-6.
* Yalamuri, Gagan; Honnavalli, Prasad; Eswaran, Sivaraman (2022). "A Review of the Present Cryptographic Arsenal to Deal with Post-Quantum Threats". Procedia Computer Science 215: 834–845. doi:10.1016/j.procs.2022.12.086.

## External links

* PQCrypto, the post-quantum cryptography conference
* ETSI Quantum Secure Standards Effort
* NIST's Post-Quantum crypto Project
* PQCrypto Usage & Deployment
* ISO 27001 Certification Cost
* ISO 22301:2019 – Security and Resilience in the United States
* Vulnerability Score of Common Encryption Algorithms
* Dilithium and SPHINCS+, explanation and demonstration in Excel (without macros) by Tim Wambach

* v
* t
* e

Quantum mechanics

Background|

* Introduction
* History
* timeline
* Glossary
* Classical mechanics
* Old quantum theory

Fundamentals|

* Bra–ket notation
* Casimir effect
* Complementarity
* Density matrix
* Energy level
* ground state
* excited state
* degenerate levels
* Vacuum state
* Zero-point energy
* QED vacuum
* QCD vacuum
* Hamiltonian
* Operator
* Quantum coherence
* Quantum decoherence
* Measurement
* Quantum
* Quantum realm
* Quantum system
* Quantum state
* Quantum number
* Quantum entanglement
* Quantum superposition
* Quantum nonlocality
* Quantum tunnelling
* Quantum levitation
* Quantum fluctuation
* Quantum annealing
* Quantum foam
* Quantum noise
* Heisenberg uncertainty principle
* Spontaneous parametric down-conversion
* Von Neumann entropy
* Spin
* Scattering theory
* Symmetry in quantum mechanics
* Symmetry breaking
* Spontaneous symmetry breaking
* Wave propagation
* Quantum interference
* Wave function
* Wave function collapse
* Wave–particle duality
* Matter wave
* Qubit
* Qutrit
* Observable
* Probability distribution

Formulations|

* Formulations
* Heisenberg
* Interaction
* Matrix mechanics
* Schrödinger
* Path integral formulation
* Phase space

Equations|

* Dirac
* Klein–Gordon
* Pauli
* Rydberg
* Schrödinger

Interpretations|

* Interpretations
* Bayesian
* Consistent histories
* Copenhagen
* de Broglie–Bohm
* Ensemble
* Hidden variables
* Many worlds
* Objective collapse
* Quantum logic
* Relational
* Stochastic
* Transactional
* Cosmological

Experiments|

* Afshar
* Bell's inequality
* Cold Atom Laboratory
* Davisson–Germer
* Delayed-choice quantum eraser
* Double-slit
* Franck–Hertz experiment
* Leggett–Garg inequality
* Mach-Zehnder inter.
* Elitzur–Vaidman
* Popper
* Quantum eraser
* Schrödinger's cat
* Quantum suicide and immortality
* Stern–Gerlach
* Wheeler's delayed choice

Science|

* Q-analog
* List
* Quantum algebra
* Quantum calculus
* Quantum differential calculus
* Quantum geometry
* Quantum group
* Quantum Bayesianism
* Quantum biology
* Quantum chemistry
* Quantum chaos
* Quantum cognition
* Quantum cosmology
* Quantum dynamics
* Quantum economics
* Quantum evolution
* Quantum finance
* Quantum game theory
* Quantum measurement problem
* Quantum mind
* Quantum probability
* Quantum social science
* Quantum stochastic calculus
* Quantum spacetime

Technology|

* Quantum algorithms
* Quantum amplifier
* Quantum cellular automata
* Quantum finite automata
* Quantum electronics
* Quantum logic gates
* Quantum clock
* Quantum channel
* Quantum bus
* Quantum circuit
* Phase qubit
* Matrix isolation
* Quantum dot
* Quantum dot display
* Quantum dot solar cell
* Quantum dot cellular automaton
* Quantum dot single-photon source
* Quantum dot laser
* Quantum well
* Quantum computing
* Timeline
* Quantum cryptography
* Post-quantum cryptography
* Quantum error correction
* Quantum imaging
* Quantum image processing
* Quantum information
* Quantum key distribution
* Quantum machine
* Quantum machine learning
* Quantum metamaterial
* Quantum metrology
* Quantum network
* Quantum neural network
* Quantum optics
* Quantum programming
* Quantum sensors
* Quantum simulator
* Quantum teleportation
* Quantum levitation
* Time travel
* Quantum complexity theory

Extensions|

* Quantum statistical mechanics
* Relativistic quantum mechanics
* Quantum field theory
* Axiomatic quantum field theory
* Quantum field theory in curved spacetime
* Thermal quantum field theory
* Topological quantum field theory
* Local quantum field theory
* Conformal field theory
* Two-dimensional conformal field theory
* Liouville field theory
* History
* Quantum gravity

* Category
* Physics Portal
* Physics WikiProject
* Commons

* v
* t
* e

Quantum information science

General|

* Quantum computing
* Qubit
* physical vs. logical
* DiVincenzo's criteria
* Quantum information
* Quantum programming
* Quantum processors
* Cloud-based quantum computing
* Timeline of quantum computing

Theorems|

* Bell's theorem
* Gleason's theorem
* Gottesman–Knill theorem
* Holevo's theorem
* Margolus–Levitin theorem
* No-broadcast theorem
* No-cloning theorem
* No-communication theorem
* No-deleting theorem
* No-hiding theorem
* No-teleportation theorem
* PBR theorem
* Quantum threshold theorem

Quantum
communication|

* Quantum capacity
* Classical capacity
* Entanglement-assisted classical capacity
* Quantum channel
* Quantum network
* Quantum cryptography
* Quantum key distribution
* BB84
* SARG04
* Three-stage quantum cryptography protocol
* Quantum teleportation
* Superdense coding
* LOCC
* Entanglement distillation

Quantum algorithms|

* Universal quantum simulator
* Deutsch–Jozsa algorithm
* Grover's algorithm
* Quantum Fourier transform
* Shor's algorithm
* Simon's problem
* Quantum phase estimation algorithm
* Quantum counting algorithm
* Quantum annealing
* Quantum algorithm for linear systems of equations
* Amplitude amplification

Quantum
complexity theory|

* Quantum Turing machine
* EQP
* BQP
* QMA
* PostBQP
* QIP

Quantum
computing models|

* Quantum circuit
* Quantum logic gate
* One-way quantum computer
* cluster state
* Adiabatic quantum computation
* Topological quantum computer

Quantum
error correction|

* Stabilizer codes
* Entanglement-Assisted Quantum Error Correction
* Shor code
* Steane code
* CSS code
* Quantum convolutional codes
* Toric code

Physical
implementations|

| Quantum optics|

* Cavity QED
* Circuit QED
* Linear optical quantum computing
* KLM protocol
* Boson sampling

|

Ultracold atoms|

* Trapped ion quantum computer
* Optical lattice

Spin-based|

* Nuclear magnetic resonance QC
* Kane QC
* Loss–DiVincenzo QC
* Nitrogen-vacancy center

Superconducting
quantum computing|

* Charge qubit
* Flux qubit
* Phase qubit
* Transmon

Software|

* libquantum
* OpenQASM
* Q#
* Qiskit
* IBM Q Experience

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Post-quantum cryptography. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Post-quantum_cryptography&oldid=4411908"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template