Post-Quantum Cryptography (PQC)
Post-Quantum Cryptography (PQC), also known as quantum-safe or quantum-resistant cryptography (in the IAM context, sometimes referred to as Quantum-Safe Authentication), is the family of public-key algorithms designed to withstand attacks from quantum computers. Traditional public-key cryptography underlying today's digital security (including RSA, ECDSA, and Diffie-Hellman key exchange) relies on mathematical problems like integer factorization and discrete logarithms. While these are computationally infeasible for classical computers, quantum algorithms such as Shor's algorithm can solve them efficiently, rendering current cryptographic protections obsolete once sufficiently powerful quantum computers become available.
The case for PQC does not rest only on quantum computers that may emerge in the next decade. The "harvest now, decrypt later" threat is immediate: adversaries are already capturing encrypted data today with the intention of decrypting it once quantum computers become available. For organizations handling sensitive information with long confidentiality requirements (such as healthcare records, financial data, or state secrets), the transition to quantum-resistant cryptography must begin now.
Standardized Algorithms and Deployment Path
NIST has finalized the first three post-quantum standards as Federal Information Processing Standards (FIPS 203, 204 and 205, August 2024), providing a concrete foundation for migration. ML-KEM (FIPS 203, formerly Kyber) is the standardized key encapsulation mechanism, replacing classical key exchange like ECDH in TLS 1.2/1.3, SSH, IKE/IPsec, and VPN connections. For digital signatures, ML-DSA (FIPS 204, formerly Dilithium) is the primary standard for X.509 certificates, code signing, and document authentication, and SLH-DSA (FIPS 205, formerly SPHINCS+) offers a hash-based alternative. FN-DSA (Falcon), which will offer more compact signatures, is still a draft (FIPS 206), and HQC, selected in 2025 as a code-based backup to ML-KEM, still awaits its own standard.
These algorithms represent three main cryptographic families. Lattice-based cryptography, exemplified by ML-KEM and ML-DSA, offers strong security guarantees with reasonable performance characteristics. Hash-based signatures like SLH-DSA provide conservative security assumptions at the cost of larger signature sizes. Code-based approaches such as HQC and Classic McEliece (which NIST has not standardized) offer extremely conservative security foundations but face deployment challenges due to large public key sizes.
The standardization extends beyond NIST, with Germany's Federal Office for Information Security (BSI) incorporating PQC recommendations into its Technical Guideline TR-02102-1, the European Telecommunications Standards Institute (ETSI) running quantum-safe cryptography working groups, and ISO/IEC updating standards for digital signatures and encryption. Security levels map to classical security equivalents, with ML-KEM-768 and ML-DSA-65 providing roughly AES-192 equivalent security (NIST Level 3).
Migration Strategy and Hybrid Cryptography
The transition to PQC follows a pragmatic hybrid approach combining classical and quantum-resistant algorithms during the migration period. This strategy provides layered security: if either the classical or PQC algorithm proves vulnerable, the other maintains protection. BSI recommends hybrid modes for critical systems, and NIST permits them, particularly in TLS 1.2/1.3 connections, X.509 PKI infrastructure, S/MIME email security, OpenPGP implementations, and federation protocols like OIDC and SAML.
Organizations must develop crypto-agility: the capability to switch cryptographic algorithms rapidly as threats evolve or standards mature. This requires abstracting cryptographic operations from application logic, maintaining algorithm catalogs, and establishing clear deprecation schedules. Systems that can change algorithms without a refactor will absorb the next deprecation as a configuration change.
System-Wide Impact and Deployment Considerations
Post-quantum cryptography affects virtually every component of modern identity and security infrastructure. PKI systems must update X.509 certificate signing algorithms, Online Certificate Status Protocol (OCSP) responders, and Certificate Transparency logs. Transport security protocols including TLS 1.2/1.3 and SSH require updates to both key exchange and authentication mechanisms. Secure messaging protocols must evolve: the double ratchet behind much end-to-end encrypted messaging now has an openly specified post-quantum counterpart, a sparse ratchet built on ML-KEM, and MLS (Messaging Layer Security) is incorporating PQC key schedules. Email security standards like S/MIME and OpenPGP require updates to signature and encryption algorithms, while DNSSEC must adopt quantum-resistant signing for DNS records. Federation protocols like OpenID Connect and OAuth 2.1 need revised token signing and JWKS endpoint configurations to support PQC algorithms.
Authentication systems change as well. FIDO2 and Passkeys implementations must accommodate quantum-resistant attestation and credential formats. Smart cards, Personal Identity Verification (PIV) cards, Trusted Platform Module (TPM) attestation, and hardware security modules (HSMs) require firmware updates and potentially new hardware supporting PQC operations. Digital identity wallets and verifiable credentials within Self-Sovereign Identity ecosystems must adopt PQC signature suites while maintaining backward compatibility.
The operational implications extend to performance and resource constraints. PQC algorithms typically involve larger key sizes, longer signatures, and increased computational requirements compared to classical alternatives. ML-KEM-768 public keys exceed 1 KB, and SLH-DSA signatures can reach tens of kilobytes. Organizations must validate latency impacts, adjust maximum transmission unit (MTU) settings and protocol buffers, and verify that constrained environments like IoT devices can accommodate these requirements. HSM and key management service (KMS) platforms require vendor support for PQC key generation, storage, and cryptographic operations.
Mission-critical systems demand prioritized attention, starting with internet-facing TLS endpoints, federation token signing infrastructure, code and firmware signing pipelines, and long-term data archives requiring timestamping and integrity protection. The transition demands thorough inventory of cryptographic touchpoints, risk-based prioritization, pilot deployments in isolated environments, and coordinated migration plans accounting for dependencies across the technology stack.
Timeline and Preparedness
While quantum computers capable of breaking current cryptography may still be years away, migration timelines extend considerably due to system complexity and interdependencies. The EU's Coordinated Implementation Roadmap (June 2025) sets the dates European organizations are measured against: national transition strategies started by the end of 2026, high-risk use cases migrated by the end of 2030, and as many remaining systems as practically feasible by 2035. BSI's TR-02102-1 follows it, recommending classical key agreement on its own only until the end of 2031, quantum-safe key agreement by the end of 2030 for applications with very high protection requirements, and classical signatures only until the end of 2035. France's national cybersecurity agency (ANSSI) intends to require PQC for product qualification from 2027. For identity systems that separates two deadlines. Key agreement comes first, because traffic to and from an identity provider can be recorded now and decrypted later; the signature keys behind tokens, federation metadata and certificates follow, with 2035 as the outer limit. Organizations should begin now with cryptographic inventory, proof-of-concept deployments in non-production environments, vendor engagement for roadmaps and support timelines, and staff training on PQC concepts and migration best practices.
Post-quantum cryptography changes cryptographic infrastructure across identity management, access control, secure communications, and data protection systems, well beyond swapping one algorithm for another. The NIST standards provide the foundation, but migration requires coordinated planning, iterative testing, and treating crypto-agility as a permanent operational requirement.