Topic
Post-Quantum Cryptography
What the migration to ML-KEM and ML-DSA requires, why the harvest-now-decrypt-later threat starts the clock today, and which deadlines apply.
11 posts
Post-quantum cryptography is the set of algorithms that stay secure against an adversary holding a cryptographically relevant quantum computer. NIST standardized the first three in 2024: FIPS 203 (ML-KEM) for post-quantum key encapsulation, FIPS 204 (ML-DSA) for digital signatures, and FIPS 205 (SLH-DSA) as a hash-based signature alternative.
Migration fails on inventory, not on mathematics. Teams cannot list where cryptography runs, which algorithms and key sizes each system negotiates, or how long the protected data must stay confidential, and without that cryptographic bill of materials no schedule survives contact. The second trap is treating parameter sets as interchangeable: CNSA 2.0 requires ML-KEM-1024 and ML-DSA-87 for national security systems, so an ML-KEM-768 deployment does not clear that bar.
Posts under this hub cover the harvest-now-decrypt-later threat model, NIST IR 8547 and the dates it fixes, CNSA 2.0 timelines for national security systems, federal procurement signals, and what cryptographic agility demands of a data architecture. Several examine signature selection and why lineage structures need room to change algorithms.
Frequently asked questions
What is harvest now, decrypt later?
Harvest now, decrypt later describes an adversary who copies encrypted traffic or stored ciphertext today and holds it until a quantum computer can break the key exchange that protected it. The threat lands now because the exposure window equals the data's required confidentiality lifetime. Health records, genomic data, intelligence, and long-lived contracts are collectable today and still sensitive in 2040.
What is the difference between ML-KEM-768 and ML-KEM-1024?
Both are parameter sets of the FIPS 203 key encapsulation mechanism, differing in security category and message size. ML-KEM-768 targets NIST security category 3 and suits most commercial traffic. ML-KEM-1024 targets category 5, carries larger keys and ciphertexts, and is what CNSA 2.0 requires for national security systems. Choose by requirement, not by default.
When do organizations have to complete post-quantum migration?
NIST IR 8547 sets the federal floor: cryptographic algorithms providing 112 bits of classical security are deprecated after 2030 and disallowed after 2035. CNSA 2.0 moves faster for national security systems, with adoption milestones landing in 2027. Commercial deadlines follow sector regulators, and any data that must stay confidential past 2035 needs the earlier date.
Which NIST standards define post-quantum algorithms?
Three FIPS publications carry the standardized algorithms. FIPS 203 specifies ML-KEM for key encapsulation, FIPS 204 specifies ML-DSA for digital signatures, and FIPS 205 specifies SLH-DSA, a stateless hash-based signature scheme resting on different assumptions. NIST IR 8547 describes the transition itself, and FIPS 140-3 governs validation of the modules that implement them.
