↓ Skip to main content
Le Site de François
  1. Index/

PQC (Post-Quantum Cryptography)

Security Cryptography Standards Pki Tls Nist

Post-Quantum Cryptography (PQC) is the set of cryptographic algorithms designed to resist attacks from a Cryptographically Relevant Quantum Computer (CRQC) — a quantum computer large and stable enough to run Shor’s algorithm at scale. Shor’s algorithm can solve the integer factorisation and discrete logarithm problems that underpin RSA, ECDSA, and ECDH in polynomial time, meaning that every asymmetric algorithm in wide use today — TLS key exchange, X.509 certificate signatures, SSH host keys, code signing, and encrypted email — becomes trivially breakable by a CRQC. Symmetric algorithms (AES, SHA-256) are substantially less affected: Grover’s algorithm provides only a quadratic speedup against them, which is mitigated by doubling key lengths (AES-256 remains appropriate). PQC replaces the asymmetric primitives only, on hard mathematical problems for which no efficient quantum algorithm is known: structured lattices (the Learning With Errors and Module-LWE problems), hash functions (the security of SHA-3 family variants), and error-correcting codes.

The urgency of PQC migration is not determined solely by the timeline to a CRQC. The operative threat is HNDL (Harvest Now, Decrypt Later): nation-state adversaries are intercepting and archiving encrypted traffic today, at scale, with the expectation of decrypting it retroactively once a CRQC becomes available. Expert estimates for CRQC arrival range from 2029 to 2040; intelligence assessments suggest state-level adversaries are targeting long-lived secrets now. Any data with a confidentiality requirement extending beyond the expected CRQC arrival window — long-lived signing keys, archived medical or financial records, government communications, code-signing infrastructure — is already within the active HNDL risk window regardless of when a quantum computer actually arrives. This is why NIST, CISA, NSA, and equivalent bodies globally are mandating migration timelines anchored to now rather than to Q-Day: the White House NSM-10 (2022) requires US federal agencies to prioritise PQC migration, NIST IR 8547 targets deprecation of RSA and ECC for new systems after 2030 and disallowance including legacy interoperability after 2035, and CNSA 2.0 specifies the highest-assurance parameter sets for national security systems.

In August 2024, NIST published the first three finalised PQC standards, concluding an eight-year evaluation process that began in 2016 with 82 candidate submissions. FIPS 203 specifies ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism, derived from CRYSTALS-Kyber) in three parameter sets (ML-KEM-512, -768, -1024) for key establishment — the quantum-safe replacement for ECDH and RSA key transport in TLS and similar protocols. FIPS 204 specifies ML-DSA (Module-Lattice-Based Digital Signature Algorithm, derived from CRYSTALS-Dilithium) in three parameter sets (ML-DSA-44, -65, -87) as the primary quantum-safe signature algorithm, intended to replace ECDSA and RSA signatures in X.509 certificates, code signing, and authentication protocols. FIPS 205 specifies SLH-DSA (Stateless Hash-Based Digital Signature Algorithm, derived from SPHINCS+) as a conservative alternative signature algorithm whose security relies only on hash function properties rather than lattice hardness assumptions, providing algorithm diversity should lattice security be undermined. The recommended migration pattern during the transition period is hybrid schemes — running ML-KEM alongside ECDH in the same TLS handshake so that the session key is secure against both classical and quantum attackers simultaneously — which is the approach already deployed by default in Chrome and available in OpenSSL 3.4+. The practical challenge for infrastructure is key and signature size: ML-KEM-768 public keys are 1,184 bytes versus 65 bytes for P-256, and ML-DSA-65 signatures are 3,309 bytes versus 64 bytes for ECDSA — large enough to affect TCP congestion windows and certificate chain transmission, making PQC migration a deployment engineering problem as much as a cryptographic one. In the context of this glossary, PQC bears directly on TPM attestation keys, Secure Boot signing certificates, LUKS key wrapping, HSM-protected signing infrastructure, and any TLS termination point — all carry long-lived key material that must be treated as HNDL-exposed if it was generated under classical algorithms and has not yet been rotated to PQC.

Related

X.509

Security Cryptography Certificates Pki Tls Standards
X.509 is the ITU-T standard (first published in 1988, currently at version 3) that defines the structure of a digital certificate: a signed data structure that binds a public key to an identity and a set of constraints, issued by a Certificate Authority whose signature vouches for the binding. It is the near-universal format for certificates in PKI, TLS, code signing, S/MIME encrypted email, SPIFFE X.509-SVIDs, and SSH host certificates. When someone refers to a TLS certificate, a CA certificate, or a code-signing certificate, they are referring to an X.509 certificate. The format is defined using ASN.1 (Abstract Syntax Notation One) and most commonly serialised as DER (Distinguished Encoding Rules, binary) or PEM (base64-wrapped DER with -----BEGIN CERTIFICATE----- headers, the format seen in most configuration files).

ML-DSA (Module-Lattice-Based Digital Signature Algorithm)

Cryptography Pqc Signatures Pki Tls Nist Lattice
ML-DSA (Module-Lattice-Based Digital Signature Algorithm), standardised as NIST FIPS 204 in August 2024, is the primary post-quantum replacement for digital signatures. It replaces ECDSA, EdDSA, and RSA PSS/PKCS#1 signatures in X.509 certificates, code signing, TLS client and server authentication, SSH, JWT signing, and any other context where a party proves possession of a private key by producing a signature that others verify with the public key. ML-DSA is derived from CRYSTALS-Dilithium, the submission that won NIST’s lattice-based signature selection, and its security rests on the Module Learning With Errors (MLWE) and Module Short Integer Solution (MSIS) problems — the same mathematical family as ML-KEM, which is significant because both algorithms can share implementation code and hardware acceleration for the underlying polynomial arithmetic (NTT, number-theoretic transform).

PKI (Public Key Infrastructure)

Security Cryptography Certificates Identity Tls Pki
Public Key Infrastructure (PKI) is the framework that makes asymmetric cryptography operationally useful at scale. Asymmetric cryptography provides a mathematical relationship between a public key and a private key, but by itself it cannot answer the question a relying party cares about: whose public key is this? PKI answers that question by introducing a trusted third party — the Certificate Authority (CA) — that cryptographically binds a public key to an identity (a hostname, an organisation name, an email address, a SPIFFE ID) by signing a certificate. A relying party that trusts the CA can therefore trust any certificate the CA signs, without needing to know the subject directly. The chain of trust extends recursively: a Root CA signs Intermediate CA certificates, which sign end-entity certificates (also called leaf certificates). Root CA private keys are kept offline in HSMs and used rarely; intermediate CAs handle day-to-day issuance and can be revoked without rotating the root. The set of root CA certificates a system trusts is its trust store — browsers and operating systems ship with a pre-populated trust store of publicly-trusted roots, while private PKIs use custom roots distributed by administrators.