Quantum safe encryption, also called post-quantum cryptography, means algorithms designed to resist attacks by both ordinary and future quantum computers. NIST published its first three standards in August 2024, FIPS 203, 204 and 205. The practical first step is not choosing an algorithm. It is finding where you use public key cryptography today.
What exactly is at risk?
NIST describes quantum computers as machines that may be years or decades away but could eventually break many widely used cryptographic systems. The systems most exposed are public key schemes used for key exchange and digital signatures, the ones behind TLS handshakes, code signing and certificates. Symmetric encryption and hashing are affected differently, mainly by needing larger parameters, so most of the migration effort lands on public key use.
Why act before such machines exist? Because data encrypted today can be recorded and decrypted later. Information that must stay secret for many years, such as health records or long lived trade secrets, is the first concern.
What has NIST standardized?
According to NIST's post-quantum cryptography project page:
- FIPS 203 specifies ML-KEM, a module lattice based key encapsulation mechanism, for establishing shared keys.
- FIPS 204 specifies ML-DSA, a module lattice based digital signature standard.
- FIPS 205 specifies SLH-DSA, a stateless hash based digital signature standard.
These were published on 13 August 2024 and derive from the algorithms known as CRYSTALS-Kyber, CRYSTALS-Dilithium and SPHINCS+. NIST also selected the HQC key encapsulation mechanism for standardization on 11 March 2025, and the Falcon signature algorithm is also in the standardization process. NIST states that organizations should begin migrating to quantum resistant cryptography.
NIST has also published a draft report on its expected transition approach for quantum vulnerable algorithms. Because it is a draft, read the current version before you rely on specific timelines.
What about "quantum safe" claims from vendors?
Be careful with the phrase. A product might use a NIST standardized algorithm, a hybrid of classical and post-quantum methods, or something unreviewed. Ask which algorithm, which standard and which version. Quantum key distribution is a separate physics based approach with different trade-offs and is not what the NIST standards cover.
A constructed inventory entry
A software company lists its uses of public key cryptography. Entry 14: the update server signs release packages with an RSA key, and installed clients verify signatures. Signed software lives for years, so this one is high priority. The entry records the algorithm, key length, where the private key is kept, who owns it, how a replacement would reach clients and whether clients can be updated to verify a new signature type. That last question usually drives the schedule.
Which data should move first?
Prioritize by lifetime. Data that must stay confidential for decades, such as medical, legal or state secrets, is the first concern because it can be recorded today. Signatures matter for another reason: software and firmware signed now may need to be trusted long after, and devices that cannot be updated in the field will need a plan before they ship.
Short lived session data matters less, though key exchange protects it, so TLS is still on the list.
How to check or apply this
- Build a cryptographic inventory: protocols, libraries, certificates, signing keys, hardware modules and vendors.
- Rank by how long the protected data or signature must remain trustworthy.
- Ask each vendor for its post-quantum plan and which standard it targets.
- Make crypto agility a requirement: algorithms should be replaceable without a redesign.
- Test post-quantum or hybrid TLS in a non-production environment for size and latency effects.
- Update procurement language to require support for the NIST standards.
- Track NIST updates and revisit the plan twice a year.
Quick check
Is AES encryption broken by quantum computers?
NIST's focus is on public key schemes, which are most exposed. Symmetric algorithms are generally handled by larger parameters. Check current NIST guidance for specifics.
Do I need to switch everything now?
No, but you should start the inventory and planning now, since migration across vendors and devices takes years.
Sources
- NIST Post-Quantum Cryptography project
- NIST FIPS 203, ML-KEM Standard
- NIST IR 8547 (initial public draft), Transition to Post-Quantum Cryptography Standards
Last reviewed: 18 October 2026.
