Quantum computing security covers two different things: defending against attacks by quantum computers, and using quantum physics to protect communication. The first is post-quantum cryptography, new algorithms for ordinary hardware, and it is what standards bodies tell organizations to adopt. The second, quantum key distribution, is not recommended as a primary defense by the UK NCSC.
What is post-quantum cryptography?
Post-quantum cryptography, or PQC, means algorithms based on mathematical problems that quantum computers are not known to solve efficiently. They run on today's servers, phones and browsers as software. The NCSC calls migration to PQC the primary mitigation against the risk that future large quantum computers break current public-key cryptography.
NIST has published the first standards. FIPS 203 specifies a key-encapsulation mechanism, used to establish a shared secret key between two parties over a public channel. FIPS 204 and FIPS 205 specify digital signature schemes, used to detect modification of data and to authenticate the signer. They derive from three separate submissions to NIST's standardization project: CRYSTALS-Kyber, CRYSTALS-Dilithium and SPHINCS+.
Note the two jobs. Key establishment protects confidentiality, signatures protect integrity and identity. A migration has to cover both.
What is quantum key distribution?
Quantum key distribution, QKD, uses properties of quantum physics to distribute encryption keys between two endpoints. The NCSC describes it as relying on specialised hardware combined with existing networking infrastructure, which makes integration much harder than a software change.
Why does the NCSC advise against relying on QKD?
The NCSC's position paper is direct. QKD does not provide authentication, and neither do other quantum techniques. It must be combined with other cryptographic services to be secure against quantum attack, so it should not be relied on as a mechanism that provides substantial security value on its own. The NCSC states it will not support the use of QKD for government or military applications, and it says QKD should not be solely relied on to generate and distribute keys. It adds that building QKD systems secure against well-resourced adversaries remains an ongoing challenge.
A constructed contrast: a bank with two data centers can buy a pair of QKD devices and connect them across one site-to-site link. That protects one link. The same bank has thousands of other connections: browsers, mobile apps, partner APIs, code-signing, internal certificates. PQC covers those because it is software that can be shipped through normal update channels.
Where does PQC apply in practice?
Anywhere public-key cryptography is used: TLS connections, VPN key exchange, email encryption, document and code signing, certificate authorities and hardware devices with burned-in keys. Devices that cannot be updated are the hard cases, which is why the NCSC notes that a small set of rarely used technologies may not finish migrating by 2035.
CISA says federal agencies must establish and maintain an inventory of IT vulnerable to quantum decryption. The same exercise is useful for any organization.
How to check or apply this
- Treat PQC as the main track and QKD as a research topic unless you have a specific need and an independent assessment.
- Inventory where public-key cryptography is used, across protocols, libraries, devices and certificates.
- Separate confidentiality uses from signature uses, and start with confidentiality of long-lived data.
- Ask vendors which of FIPS 203, 204 and 205 they support, and when.
- Pilot the new algorithms in non-critical systems before touching production, and keep the old ones available until the pilot passes.
- Follow the NCSC milestones: discovery and plan by 2028, priority migrations by 2031, finished by 2035.
Safeguard's dependency scanning and SBOM views help you find cryptographic libraries in your software supply chain, which is a starting point for the inventory. They do not test protocols in transit.
Quick check
Is QKD the same as post-quantum cryptography?
No. PQC is software that runs on ordinary hardware and relies on hard math problems. QKD uses quantum physics and specialised hardware to distribute keys, and needs other cryptography for authentication.
Which standards should I start with?
NIST's FIPS 203 for key establishment and FIPS 204 and 205 for signatures, all approved in August 2024.
Sources
- NIST, Approval of three post-quantum cryptography FIPS (August 2024)
- NCSC, Quantum networking technologies
- NCSC, Timelines for migration to post-quantum cryptography
- CISA, Post-Quantum Cryptography Initiative
Last reviewed: 18 October 2026.
