Post-Quantum Cryptography, Explained
By Dylan Rudy, Isabella Bello Martinez, and Taylor Brady
By Dylan Rudy, Isabella Bello Martinez, and Taylor Brady
Here’s what you need to know about post-quantum cryptography (PQC)—the advanced encryption approach that every government and commercial enterprise must adopt to ensure digital security against the impending threat of quantum computers.
Computers deploy a collection of cryptographic algorithms, known as a cryptosuite, to protect vulnerable information. Any security service that employs a cryptosuite to secure data is known as a cryptosystem.
A cryptosystem supports secure communication by deploying algorithms to establish a shared secret value, known as a key, used for encryption and decryption purposes. A cryptosystem also allows communicating entities to verify one another’s identity via a digital signature. A digital signature authenticates a user using a pair of values – a private value known only to the user and public value accessible to all parties. The algorithms underlying these signatures and key exchanges are known as asymmetric cryptographic algorithms or public-key cryptography.
Cryptosystems permeate our daily activities. To read this explanation of PQC, your laptop established a key with Booz Allen Hamilton’s server. A secure session was established, and the server provided your computer with a digital signature and a method to authenticate the digital signature, allowing you to read on with the confidence that this article is really from Booz Allen.
Global cryptosystems are essential in today’s digital world: protecting access to utilities, ensuring financial transactions, verifying proper access to information, and more. Failed cryptosystems would create severe risks to both economic and national security. If these cryptosystems stop working, all internet-based activity is vulnerable.
Quantum computers are computational devices that exploit the properties of quantum physics to solve certain problems differently and, in some cases, faster or more efficiently than what is otherwise possible. In 1994, a mathematician by the name of Peter Shor developed a quantum algorithm (Shor’s Algorithm) that can rapidly solve the same math problems that underpin the security of today’s asymmetric cryptographic algorithms at a much faster pace. This means that, if a bad actor had access to sufficiently advanced quantum computing hardware, they could use this algorithm to break digital communications secured with today’s cryptosystems.
Although a quantum computer capable of running Shor’s Algorithm at scale does not currently exist, quantum developers are working to build one in the next few decades. To mitigate the threat these cryptographically-relevant quantum computers pose, any plan to modernize and secure cryptosystems must take the quantum threat into consideration.
“Safeguarding U.S. infrastructure and interests requires federal and commercial organizations to stay ahead of future quantum computing threats. Quantum computing is rapidly evolving toward practical applications. One of the first noticeable impacts society will see is existing asymmetric cryptography being vulnerable to decryption with quantum computers. Now is the time to prepare with new cryptographic solutions.”
In the future, adversaries could launch cyberattacks using quantum computers executing quantum algorithms. Organizations that protect critical infrastructure will need a new approach to secure their data: post-quantum cryptography (PQC). PQC algorithms run on “classical” computers, rather than quantum computers, and use underlying mathematical problems that are difficult for classical and quantum computers alike. Organizations that deploy PQC are protected from hackers with both classical and quantum computing hardware and—because the solution is classical—they can start the transition today.
The National Institute of Standards and Technology (NIST) has been at the forefront of the PQC effort, collaborating with cryptographers worldwide to create algorithms resistant to quantum attacks. In August 2024, NIST released the first finalized post-quantum encryption standards—part of an eight-year effort to future-proof digital security. This initial set of algorithms will help organizations begin the transition to quantum-safe systems.
When public key algorithms were first brought in to secure our digital spaces, it was not seriously considered that the underlying math behind every public key cryptographic algorithm could one day be vulnerable to attack. Because of this, these algorithms have been embedded deep into hardware, software, and digital protocols where they were often expensive, time-consuming, or even impossible to update. This is where cryptographic agility comes into play. Crypto-agility refers to the ability to swiftly adapt cryptographic systems. It addresses an enterprise’s capacity to navigate future cryptographic changes. Crypto-agility is a critical consideration for future quantum threats, but its significance extends beyond post-quantum cybersecurity. When undertaken proactively and in concert with other cyber modernization priorities, PQC strategies that emphasize agility can increase the overall effectiveness and efficiency of organizations’ procurement decisions.
Preparing for quantum computers and adopting PQC will be difficult and time-consuming. As this overhaul will impact numerous facets of a cryptosystem (i.e. the authentication of users, digital signatures), the process of fully migrating to PQC could take decades. Anything not updated to PQC may become vulnerable as soon as a quantum computer is available. In addition, bad actors could steal encrypted information now and hold onto it until they have the quantum computers to decrypt them, a strategy known as Harvest Now Decrypt Later. Whether it’s patient health record confidentiality, bank account integrity, or battlefield intelligence; bad actors and adversaries will be able to steal, change, or delete information. With so much at stake, organizations will need support to align their migration processes with NIST’s standards for systematically implementing robust PQC algorithms over time.
Anything not updated to PQC may become vulnerable as soon as a CRQC is available. Whether it’s social media accounts, patient health records, bank account passwords, or battlefield intelligence, bad actors and adversaries will be able to steal, change, or delete information. With so much at stake, organizations will need support to align their migration processes with NIST’s standards and systematically implement robust PQC algorithms over time.
The U.S. federal government has been actively preparing for the quantum era and the cybersecurity challenges it will bring. Several key initiatives and directives have laid the groundwork for transitioning to post-quantum cryptography (PQC) and enhancing the nation’s cyber resilience:
Organizations should begin the journey of transitioning to PQC as soon as possible. Adopting a multi-phased approach to PQC adoption will help to ensure communication systems and data remain secure. An effective transition strategy should first inventory all cryptography-dependent systems and services while assessing available algorithms and relevant cryptographic standards. Next, organizations should seek to improve their crypto-agility by defining how to quickly integrate the first slate of new PQC standards while ensuring enough flexibility to be able to incorporate changes in the future. They should then test how their systems will perform with those new algorithms.
Booz Allen conducts PQC prototyping in sandbox environments to help our clients rapidly evaluate the impact of PQC adoption on mission-critical use cases. This testing enables clients to assess the impact of the future migration process, including its potential costs and computing requirements.
Quantum technologies are advancing rapidly, underscoring the need for organizations to begin planning their migrations to PQC as soon as possible. Booz Allen’s cybersecurity practitioners work with nearly every federal, defense, and intelligence agency as well as commercial organizations in all critical infrastructure sectors. We combine our extensive cybersecurity experience with cutting-edge quantum expertise to deliver defensive solutions to help our clients stay ahead of emerging threats.
Through legislation and executive action, the federal government is working to ensure U.S. leadership in the field of quantum information science. Booz Allen is committed to supporting this vision.
Booz Allen’s team of quantum researchers is working to demonstrate how today’s challenging financial questions can be addressed with quantum technology.
The federal government has mandated multiple agencies to support research and development in quantum sciences and technology and to develop programs for growing the future quantum workforce.
Isabella Bello Martinez is a quantum technologist at Booz Allen. She specializes in strategic thinking for long-term quantum growth strategies and quantum technologies application research. She leads the company’s outreach initiatives for quantum investment and the delivery of analytical products for a variety of clients. She holds degrees from Brown University and the University of Notre Dame.
