Lesson 4.12: Getting ready for post-quantum cryptography
A large quantum computer would break RSA and elliptic-curve cryptography: key exchange and signatures, though not AES-256 or SHA-256. Nobody knows when, but data recorded today can be decrypted later ('harvest now, decrypt later'), and devices signed today may live for decades. NIST published the first post-quantum standards in 2024 (ML-KEM, ML-DSA, SLH-DSA), and browsers, CDNs and OpenSSH already use hybrid key exchange. In the lab you work through Northwind's crypto inventory, find quantum-vulnerable key exchange, apply Mosca's inequality to prioritise, spot long-lived signatures, and write a migration plan.
17 min
You will learn to
- Explain what quantum computers threaten (and what they don't)
- Explain harvest-now-decrypt-later
- Use a crypto inventory to find vulnerable algorithms
- Apply Mosca's inequality
- Name the NIST PQC standards and hybrid key exchange
Key terms
- CRQC
- A cryptographically relevant quantum computer: large enough to run Shor's algorithm against RSA and ECC.
- Harvest now, decrypt later
- Recording encrypted traffic today to decrypt it once a CRQC exists.
- ML-KEM / ML-DSA / SLH-DSA
- NIST's post-quantum standards for key encapsulation and signatures (FIPS 203, 204, 205; August 2024).
- Hybrid key exchange
- Combining a classical and a post-quantum key exchange, secure if either holds.
- Mosca's inequality
- If x + y > z (secrecy time + migration time > time to a CRQC), you need to act now.
- Crypto agility
- The ability to find and replace algorithms across systems without redesigning them.
← Encrypting files with AES · All lessons · Capstone: the weekly threat briefing →