What is actually at risk
Shor's algorithm, published in 1994, factors large integers and solves discrete logarithms efficiently on a sufficiently large error-corrected quantum computer. That covers RSA, classic Diffie–Hellman and elliptic-curve cryptography, which between them protect most key exchange and digital signatures on the internet. Nobody has a machine anywhere near large enough; the estimates we have seen for breaking a 2048-bit RSA key run to millions of physical qubits, and the trends on sheet 01 suggest that is years away rather than months. But the estimates have been falling as algorithms improve, and it would be unwise to treat any one of them as a deadline.
Symmetric cryptography is in far better shape. Grover's algorithm gives only a square-root speed-up against brute force, so AES-256 retains security comparable to AES-128 against a quantum adversary. Hash functions are similarly resilient. The practical upshot is that the migration is about public-key algorithms, not about replacing everything.
Why the deadline is earlier than the computer
The argument that has driven government policy is usually called harvest now, decrypt later. Encrypted traffic recorded today can be stored and decrypted once a capable machine exists. For data that must stay confidential for a decade or more, the relevant question is not when the computer arrives but when the computer arrives minus how long the secret must last. That reasoning is why standards bodies moved before the hardware did.
The NIST process and the three standards
The US National Institute of Standards and Technology opened a public competition for post-quantum algorithms in 2016. It ran for several rounds of open cryptanalysis, during which some candidates were broken outright: the isogeny-based scheme SIKE fell to a classical attack in 2022, and the multivariate signature scheme Rainbow was broken the same year. Both breaks came from academic cryptanalysts working on ordinary computers, which is a useful reminder that "quantum-resistant" is a claim about one class of attack, not a guarantee against all of them.
In August 2024 NIST published three Federal Information Processing Standards. FIPS 203 specifies ML-KEM, a key-encapsulation mechanism derived from CRYSTALS-Kyber. FIPS 204 specifies ML-DSA, a signature scheme derived from CRYSTALS-Dilithium. FIPS 205 specifies SLH-DSA, a stateless hash-based signature scheme derived from SPHINCS+. The first two rest on structured lattice problems; the third rests only on hash functions, which makes it slower and larger but conservative in its assumptions. A further lattice signature, FN-DSA from Falcon, was drafted separately, and NIST has continued to evaluate additional key-encapsulation candidates as backups.
Trade-offs the standards carry
Post-quantum keys and signatures are bigger than their elliptic-curve predecessors, in some cases by an order of magnitude. That matters for handshakes over constrained links, for certificate chains, and for embedded devices with little memory. Lattice assumptions are also younger than factoring, which is why most real deployments are hybrid: a classical key exchange such as X25519 combined with ML-KEM, so that the connection is secure if either holds. Major browsers and TLS libraries have shipped hybrid key exchange in this form, and we would regard hybrid as the sensible default until the lattice schemes have absorbed another decade of attack.
The UK position
The UK National Cyber Security Centre has published guidance on migrating to post-quantum cryptography that sets out a phased approach: discovery of where vulnerable cryptography is used, migration of the highest-priority systems, and completion across the estate, with indicative dates stretching into the next decade. We would point readers to the NCSC's own pages for the current wording, since guidance of this kind is revised. The NCSC has also published a position on quantum key distribution stating that it does not endorse QKD for government or military applications, which brings us to the second approach.
Quantum key distribution is a different answer
QKD, beginning with the BB84 protocol of Bennett and Brassard in 1984, uses the physics of single photons to let two parties detect eavesdropping on a key exchange. China's Micius satellite, launched in 2016, demonstrated satellite-to-ground key distribution in experiments published in 2017, and a long fibre backbone linking Beijing and Shanghai has been built around trusted relay nodes.
The limitations are structural rather than incidental. QKD needs dedicated optical links, its range over fibre is limited by loss unless trusted nodes are inserted, and it still requires a classically authenticated channel, so it does not remove the need for post-quantum signatures. It also protects only the key exchange, not stored data or software. Our reading is that QKD is a genuine scientific achievement with a narrow set of high-value uses, while post-quantum cryptography is the general answer for everyone else. Treating them as rivals misunderstands both.
What an organisation can reasonably do
Inventory where public-key cryptography is used, including inside vendors' products. Prefer software that can swap algorithms without redesign. Deploy hybrid key exchange where the platform supports it. And classify data by how long it must stay secret, because that, not the state of the hardware, determines urgency.