What Is Post-Quantum Cryptography? The NIST Standards Explained
What is post-quantum cryptography?
Post-quantum cryptography (PQC) means cryptographic algorithms that run on ordinary computers but are designed to withstand attacks from large quantum computers. It is also called quantum-resistant cryptography. It is different from quantum cryptography such as quantum key distribution, which uses quantum physics hardware. PQC is software and math, so it can be rolled out over the existing internet.
Why is it needed?
Today's public key cryptography, including RSA and elliptic curve schemes, relies on problems like factoring and discrete logarithms. Peter Shor showed that a large quantum computer could solve these efficiently (arXiv:quant-ph/9508027). No such machine exists now, but data that must stay secret for many years could be recorded today and decrypted later, which is called harvest now, decrypt later, and moving whole systems to new cryptography takes years. See harvest now, decrypt later.
What are the NIST standards?
NIST ran a public competition from 2016 and announced its first three finalised standards on 13 August 2024:
| Standard | Algorithm | Original name | Used for |
|---|---|---|---|
| FIPS 203 | ML-KEM | CRYSTALS-Kyber | General encryption (key establishment) |
| FIPS 204 | ML-DSA | CRYSTALS-Dilithium | Digital signatures (primary) |
| FIPS 205 | SLH-DSA | SPHINCS+ | Digital signatures, as a backup that uses a different kind of math |
ML-KEM and ML-DSA are based on lattice problems. SLH-DSA is based only on hash functions, which makes it a conservative backup. NIST said a fourth standard based on Falcon, to be called FN-DSA, was planned. In March 2025 NIST selected a fifth algorithm, HQC, a code based key encapsulation method intended as a backup to ML-KEM, with a draft standard expected around 2026 and a final one around 2027. NIST said HQC is not a replacement for ML-KEM. Read government post-quantum deadlines.
What is NIST's advice?
NIST said administrators should start integrating the new standards immediately and that there is no need to wait for future standards. Its draft transition plan, NIST IR 8547, proposes retiring today's vulnerable public key algorithms by 2035. Migrating means inventorying where cryptography is used, choosing algorithms, testing performance and updating software and hardware. The key size cost is real: an ML-DSA signature is a few kilobytes, compared with 64 bytes for an Ed25519 signature. See crypto agility and size budgets.
What does it mean for blockchains?
Blockchains such as Bitcoin, Ethereum and Solana sign transactions with elliptic curve schemes, which a large quantum computer could break. Moving to post-quantum signatures means larger transactions, new wallet software and community agreement. Plans differ and are still developing. See what is a quantum-resistant cryptocurrency, blockchain vs quantum computing and Ethereum and Solana plans.
Does it affect QNT?
QUANTUM (QNT) is a token on Solana, so it relies on whatever signature scheme Solana uses and inherits any future Solana upgrade. The token does not perform quantum computation and is not a post-quantum asset by design.
Sources and further reading
- NIST: Post-Quantum Cryptography project
- NIST: first three finalized post-quantum encryption standards (13 August 2024)
- NIST: NIST selects HQC as fifth algorithm for post-quantum encryption (March 2025)
- Shor (arXiv:quant-ph/9508027)
- NIST IR 8547 (initial public draft): Transition to Post-Quantum Cryptography Standards
- NIST FIPS 203 (ML-KEM)
- NIST FIPS 204 (ML-DSA)
- NIST FIPS 205 (SLH-DSA)
Checked 2026-10-12. Company claims are the companies' own and roadmaps are plans, so check the primary sources. This is education, not investment or security advice. QUANTUM (QNT) is an independent community token on Solana and is not affiliated with Quantinuum (Nasdaq: QNT) or Quant Network (QNT on Ethereum).
Frequently asked questions
What is post-quantum cryptography?
Cryptographic algorithms that run on ordinary computers but are designed to resist attack by quantum computers.
What are the NIST post-quantum standards?
FIPS 203 (ML-KEM) for key exchange, FIPS 204 (ML-DSA) for signatures and FIPS 205 (SLH-DSA) as a hash based backup signature, finalised in August 2024. NIST also selected HQC as a backup key exchange method in March 2025.
Is post-quantum cryptography the same as quantum cryptography?
No. Post-quantum cryptography is ordinary software and math. Quantum cryptography, such as quantum key distribution, needs quantum hardware.
When should organisations migrate?
NIST says to start now. Its draft plan proposes retiring today's vulnerable public key algorithms by 2035.
Next read
Post-Quantum Cryptography and Crypto: What It MeansWhy large quantum computers could threaten blockchain signatures, and what post-quantum cryptography is doing about it.Read nextAlso useful: Government Post-Quantum Deadlines: NIST, NSA CNSA 2.0 and Federal Migration | Quantum-Resistant Signatures Explained | Harvest Now, Decrypt Later: The Quantum Threat Explained
Educational content, not financial advice. QUANTUM (QNT) is independent of Quantinuum (Nasdaq: QNT) and Quant Network (QNT on Ethereum). Live chart | Token facts