Post-quantum cryptography: what it protects today

Say a law firm sends a client the draft of a shareholder agreement today, and someone copies the encrypted transfer on the way. The copy is useless to them: no computer today can break the cryptography that protects it. But the agreement may still matter in 2040, and nobody knows what computers will be able to do by then. Post-quantum cryptography deals with that gap between how long a secret has to last and how long its protection lasts.

Encrypted communication uses two kinds of cryptography. A symmetric cipher such as AES encrypts the data itself. Public-key methods such as RSA and elliptic curves do the harder part: they let two parties who have never met agree on that AES key over an open network, and they let anyone check a digital signature.

In 1994, Peter Shor (opens in a new tab) showed that a large enough quantum computer could solve the mathematical problems behind RSA and elliptic curves efficiently, which would expose recorded key exchanges and allow forged signatures. Symmetric ciphers fare far better: NIST expects AES-256 to “still be safe for a very long time”.

No such machine exists, and nobody knows when one will. In the 2023 Quantum Threat Timeline survey, which partners from 21 European states cite in a joint statement, 17 of 37 experts put the chance of one within ten years above 5 percent. Informed guesses, then. For planning they are enough, because the attack that matters starts much earlier.

Anyone who records encrypted traffic today, or copies encrypted files along with the key exchange that protects them, can keep it all and wait. NIST calls this “harvest now, decrypt later”, the European statement “store now, decrypt later”.

The researcher Michele Mosca reduced the question to a sum, which NIST’s transition report repeats: if X is the number of years your data must stay secret and Y the years a migration takes, you have to start before X plus Y exceeds Z, the years until a capable quantum computer exists. Nobody knows Z. You do know X.

In client work, X is long. A shareholder agreement, a personnel file or the plans of a building can stay sensitive for ten years or more, long after anyone remembers the connection they travelled over.

After an open, international selection that began in 2016, NIST published its first three post-quantum standards on 13 August 2024: FIPS 203 (ML-KEM) for establishing a shared secret key over a public channel, FIPS 204 (ML-DSA) as the main standard for signatures, and FIPS 205 (SLH-DSA), a hash-based signature scheme on different mathematics, as a backup. In March 2025 NIST picked HQC as a backup for ML-KEM; its standardisation is still under way.

RSA and elliptic curves have survived decades of attacks, the new algorithms only years, and their implementations even fewer. The European joint statement, which Austria’s A-SIT and Federal Chancellery also signed, therefore strongly recommends hybrid deployment for most use cases: an established method and a post-quantum one, combined so that the result stays secure even if one of them is broken. The EU’s coordinated roadmap recommends standardised, tested hybrids wherever feasible.

Think of a door with two locks from different makers. A burglar who learns to pick one still faces the other.

Post-quantum protection has been part of Encloq’s end-to-end encryption from the start. Keys are agreed with ML-KEM-1024 together with elliptic-curve Diffie-Hellman on P-521, and signatures pair ML-DSA-87 with ECDSA on P-521. File and message content is encrypted with AES-256-GCM.

We chose these parameter sets on purpose. They sit in NIST’s highest security category, 5, which means that breaking them should take at least the resources of a key search on AES-256. NIST recommends the smaller ML-KEM-768 as the default, but FIPS 203 also says that “when initially establishing cryptographic protections for data, the strongest possible parameter set should be used.” Client files can stay sensitive for decades, so we accept the larger keys and messages. The protection is part of every plan, and there is no switch for it.

Signing in, for one. NIST’s transition report points out that authentication only has to be secure at the moment it happens: a sign-in recorded today gives a future attacker nothing to decrypt. Passkeys will still need post-quantum signatures by the time capable quantum computers exist; our passkey explainer covers how they work today.

The connection, for another. In August 2026 the IETF published hybrid post-quantum key agreement for TLS 1.3 as RFC 10024, and whether a connection uses it depends on browser and server. For end-to-end encrypted content, TLS is the outer envelope and mainly protects metadata.

Metadata and devices lie outside entirely. Stronger content encryption does not hide who exchanges files with whom, and when; our architecture page shows which metadata stays visible. And content is readable wherever it is decrypted, so no algorithm helps against malware or an unlocked laptop.

The EU’s coordinated roadmap of June 2025 asks member states to start their national transition by the end of 2026 and to move high-risk use cases by the end of 2030 at the latest. By 2035 the transition should be complete for as many systems as practically feasible; from then on, quantum-vulnerable public-key methods should no longer be used on their own even for medium-risk use cases.

In the US, NIST’s transition report, finalised in October 2026, deprecates quantum-vulnerable public-key algorithms after 2030 and disallows them under NIST standards after 2035. Federal systems with the most sensitive data have to move faster: post-quantum key establishment by the end of 2030, signatures by the end of 2031.

These dates are aimed at governments, operators and vendors. For a five-person firm, they are a fair yardstick for the tools it relies on.

1. 1

   Find your long-lived secrets.

   Which files and conversations must stay confidential for ten years or more? They come first.

2. 2

   Ask your providers.

   Is the key exchange post-quantum today or only planned? Is it hybrid? What exactly does the claim cover?

3. 3

   Distrust absolutes.

   No honest provider promises that its encryption can never be broken. Look for named standards and a stated scope.

4. 4

   Keep the basics.

   Passkeys, updated devices and careful sharing stop the attacks that happen today.