up:: [[Quantum Cryptography]] > [!tip] Go deeper in my PQC wiki > Read **[Post-Quantum Cryptography (PQC)](https://fieldguide.lamarrlabs.com/Post-Quantum-Cryptography-(PQC))** in the [Post-Quantum Field Guide](https://fieldguide.lamarrlabs.com), my free public wiki on the post-quantum transition. # Post-Quantum Cryptography (PQC) Post-Quantum Cryptography (PQC) refers to [[cryptographic algorithms]] specifically designed to be secure against potential threats posed by [[Quantum Computing|quantum computers]]. While traditional cryptographic systems, like [[RSA]] and [[Elliptic Curve Cryptography|ECC]], rely on the difficulty of problems such as integer factorization or [[Elliptic Curve Cryptography|elliptic curve]] logarithms, PQC aims to base security on mathematical problems believed to be resistant to quantum attack. ## Key Features - **[[Quantum-Resistant]]**: Unlike some classical [[cryptographic algorithms]], the security of PQC methods isn't compromised by the capabilities of [[Quantum Computing|quantum computers]]. - **Variety of Approaches**: PQC encompasses various cryptographic systems including: - [[Lattice-based cryptography]] - [[Code-based cryptography]] - [[Multivariate polynomial cryptography]] - [[Hash-based cryptography]] - [[Isogeny-based cryptography]] - [[Zero Knowledge Proof-based cryptography]] - **NIST Standardization**: NIST published its first post-quantum standards in August 2024 (FIPS 203, 204 and 205), with FN-DSA (FIPS 206) still in draft and HQC selected in March 2025 as a backup KEM. See [[NIST Post-Quantum Cryptography Standardization]]. ## Leading Algorithms | Algorithm | NIST status | Type | Primary Use | Key Size (approx.) | Signature Size (approx.) | Performance | Known Vulnerabilities | Security Level | Pros | Cons | | -------------------------- | ----------- | -------------------------- | ----------------- | ------------------ | ------------------------ | ----------- | ---------------------------------- | -------------- | ------------------------------------------ | --------------------------------------------- | | **[[CRYSTALS-KYBER]]** | Standardized as ML-KEM (FIPS 203, Aug 2024) | Lattice-based | Key Encapsulation | 800-1632 bytes | N/A | Fast | Resistant to known attacks | High | Efficient, compact keys | Lattice-based attacks are an evolving area | | **[[CRYSTALS-Dilithium]]** | Standardized as ML-DSA (FIPS 204, Aug 2024) | Lattice-based | Digital Signature | 1312-2592 bytes | 2420-4595 bytes | Moderate | Resistant to known attacks | High | High security, non-interactive | Larger key sizes compared to some others | | **[[FALCON]]** | Being standardized as FN-DSA (draft FIPS 206) | Lattice-based (NTRU) | Digital Signature | 1280-2304 bytes | 690-1280 bytes | Fast | Side-channel vulnerabilities | High | Very efficient, small signatures | Complex implementation | | **[[NTRU]]** | Round 3 finalist, not selected | Lattice-based (NTRU) | Key Encapsulation | 699-1230 bytes | N/A | Fast | Resistant to known attacks | High | Fast key generation, small ciphertexts | Requires careful parameter selection | | **[[SIKE]]** | Broken in 2022, not selected | Isogeny-based | Key Encapsulation | 564-610 bytes | N/A | Slow | Broken by an efficient classical key-recovery attack on SIDH ([2022](https://eprint.iacr.org/2022/975)) | Broken | None today | Slow, especially in key generation | | **[[SPHINCS+]]** | Standardized as SLH-DSA (FIPS 205, Aug 2024) | Hash-based | Digital Signature | 32-64 bytes | 8-30 KB | Slow | Resistant to known attacks | High | Stateless, high security level | Very large signatures | | **[[Picnic]]** | Not selected | Zero-knowledge proof-based | Digital Signature | 33 bytes | 17-209 KB | Very slow | Resistant to known attacks | High | Very high security against quantum attacks | Extremely large signatures | | **[[BIKE]]** | Round 4 candidate, not selected (HQC chosen, Mar 2025) | Code-based | Key Encapsulation | 2 KB | N/A | Moderate | Vulnerable to decryption failures | Medium | Strong classical security | Not selected by NIST | Sizes are approximate. For exact parameter sizes of the standardized algorithms, see the [Post-Quantum Field Guide](https://fieldguide.lamarrlabs.com/The-New-Standards-MOC). Status sources: [NIST, Aug 2024](https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards), [NIST IR 8545](https://csrc.nist.gov/pubs/ir/8545/final). ## Advantages - **Future-Proof Security:** Ensures long-term security of data against emerging quantum threats. - **Variety of Choices:** Offers multiple cryptographic solutions, allowing selection based on performance, security level, and operational needs. - **Adaptability:** Can coexist with existing cryptographic systems to provide layered security. ## Exploitable Mechanisms/Weaknesses The main challenge for PQC is ensuring that these new cryptographic systems are as reliable and well-tested as classical systems. As these [[Algorithm|algorithms]] are relatively new, their resistance to all forms of [[cryptanalysis]] (both classical and quantum) is not yet fully understood. ## Common Tools/Software - **Open Quantum Safe (libOQS):** An open-source project aimed at supporting the development and prototyping of [[quantum-resistant]] cryptography. - **Microsoft's Quantum Development Kit:** Includes tools for experimenting with [[quantum-resistant]] [[cryptographic algorithms]]. - **Google's Cirq:** An open-source framework for Noisy Intermediate Scale Quantum (NISQ) computers, including tools for [[quantum cryptography]] research. ## Related Cybersecurity Policies - **[[NIST Post-Quantum Cryptography Standardization]]:** A project initiated by NIST to identify and standardize one or more [[quantum-resistant]] public-key [[cryptographic algorithms]]. - **European Union's Quantum Technologies Flagship:** Supports research and development in quantum technologies, including [[cryptography]], to enhance long-term security measures. - **ETSI (European Telecommunications Standards Institute) Quantum-Safe Cryptography Working Group:** Develops and standardizes quantum-safe mechanisms for communications technology. ## Best Practices - **Early Adoption and Testing:** Organizations should begin testing [[quantum-resistant]] algorithms to understand their impact on system performance and security. - **Hybrid Approach:** Use a combination of classical and [[quantum-resistant]] [[Algorithm|algorithms]] to ensure security during the transition period. - **Regular Updates:** Stay informed of the latest developments in [[quantum computing]] and [[cryptography]] to ensure that the cryptographic measures remain effective. ## Implications - **Transition Challenges**: Moving from classical to post-quantum cryptographic methods will be a massive undertaking, affecting countless systems worldwide. - **Hybrid Systems**: In the transition phase, hybrid cryptographic systems might be used, combining classical and post-quantum methods to ensure robust security. - **Long-Term Security**: PQC provides a proactive approach to ensuring that encrypted data remains secure, even in a potential future where [[Quantum Computing|quantum computers]] are commonplace. ## Current Status - **Standards and ongoing research**: NIST published its first three PQC standards on August 13, 2024: ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) ([NIST](https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards)). FN-DSA (FIPS 206) is still in draft, and on March 11, 2025 NIST selected HQC as a backup to ML-KEM ([NIST](https://www.nist.gov/news-events/news/2025/03/nist-selects-hqc-fifth-algorithm-post-quantum-encryption)). Research continues on additional signature schemes. - **Adoption**: While full adoption is still in the future, some organizations are beginning to experiment with and implement PQC algorithms to future-proof their security. - **April 19, 2024**: Cryptographers have recently been discussing that they do not think [[lattice-based cryptography]] will be around much longer. ## Related Concepts - **[[Quantum Computing]]**: The study and development of computers that use principles of [[quantum mechanics]]. - **[[Shor's Algorithm]]**: A [[quantum algorithm]] capable of factoring integers exponentially faster than the best-known classical [[Algorithm|algorithms]], thus threatening [[RSA]]-based [[cryptography]]. - **[[RSA]] and [[Elliptic Curve Cryptography|ECC]]**: Classical cryptographic schemes vulnerable to quantum attacks.