Post-Quantum Cryptography (Kyber)
Post-Quantum Cryptography · Also known as: PQC, quantum-resistant cryptography, quantum-safe
Post-quantum cryptography comprises cryptographic algorithms believed to be secure against both classical and quantum computers. In 2022, NIST standardized post-quantum algorithms including ML-KEM (CRYSTALS-Kyber) for key encapsulation and ML-DSA (CRYSTALS-Dilithium) for signatures. Post-quantum cryptography is essential for systems requiring long-term confidentiality, as adversaries may record encrypted communications today and decrypt them once quantum computers become available.
Read the full method
Sign in with a free account to read this section.
Method map
The neighbourhood of related methods — select a node to explore.
When to use it
Post-quantum cryptography is essential for systems with long data retention requirements, classified information, and critical infrastructure. Use hybrid approaches (combining classical and post-quantum algorithms) during the transition period. Organizations should begin migration planning now despite quantum threats being years away.
Strengths & limitations
- Believed to be resistant to quantum computers, providing future-proof security
- NIST standardization ensures algorithms have undergone extensive peer review
- Practical implementations available with reasonable performance characteristics
- Enables forward secrecy for data encrypted today against future quantum decryption
- Larger key and ciphertext sizes compared to classical algorithms (especially compared to ECC)
- Newer algorithms with less deployed experience than RSA or ECC
- Transition period requires hybrid approaches adding complexity
- Standardization is recent; full ecosystem maturity will take time
Frequently asked
When will quantum computers break current cryptography?
Estimates vary; quantum computers capable of breaking RSA may be 15-20+ years away. However, adversaries storing encrypted data today could decrypt it in the future (harvest-now, decrypt-later attacks).
Should I deploy post-quantum cryptography now?
For systems with long data retention (>10 years), start planning migration now. Use hybrid approaches combining classical and post-quantum algorithms to provide defense-in-depth.
What is harvest-now, decrypt-later?
An adversary records encrypted communications today for future decryption once quantum computers are available. Post-quantum cryptography protects against this threat by being resistant to quantum decryption.
Are NIST-standardized algorithms the only post-quantum options?
NIST standards are recommended for most deployments due to extensive peer review. Other candidates exist but lack standardization support; using them increases risk.
How much larger are post-quantum keys compared to classical?
ML-KEM (Kyber) public keys are ~1.2 KB compared to ~600 bytes for RSA-3072. Ciphertexts are ~1 KB. Not dramatically larger but noticeable in bandwidth-constrained systems.
Sources
- Avanzi, R., Bos, J., Ducas, L., & Kiltz, E. (2022). CRYSTALS-Kyber algorithm specification and supporting documentation. NIST Post-Quantum Cryptography Project. link ↗
- National Institute of Standards and Technology (NIST). (2016). Post-Quantum Cryptography: Call for Proposals. NIST Special Publication 800-56C Rev. 1. link ↗
How to cite this page
ScholarGate. (2026, June 3). Post-Quantum Cryptography. ScholarGate. https://scholargate.app/en/cryptography/post-quantum-cryptography
Which method?
Set this method beside its closest kin and read them side by side — the library lays the books on the table; the choice is yours.
- Elliptic Curve CryptographyCryptography↔ compare
- Lattice-Based CryptographyCryptography↔ compare
- RSA CryptosystemCryptography↔ compare