# What is Post-Quantum Cryptography (PQC)?

> Post-quantum cryptography (PQC) is cryptography designed to resist attacks from both conventional and cryptographically relevant quantum computers while running on conventional computing and communications systems.

- Canonical URL: https://yellowcube.eu/glossary/post-quantum-cryptography/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Its immediate purpose is to replace quantum-vulnerable public-key mechanisms for key establishment and digital signatures with standardized alternatives whose security rests on mathematical problems not known to be efficiently solved by either type of computer.

The U.S. National Institute of Standards and Technology (NIST) has finalized Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) in Federal Information Processing Standard (FIPS) 203, Module-Lattice-Based Digital Signature Algorithm (ML-DSA) in FIPS 204, and Stateless Hash-Based Digital Signature Algorithm (SLH-DSA) in FIPS 205. Other candidates remain under development, so selections should follow current protocol and authority guidance.

### Key points

- **Inventory and urgency:** Find public-key cryptography in applications, protocols, certificates, devices, firmware, libraries, backups, and suppliers, then prioritize by data lifetime, replacement difficulty, and exposure to collection now and decryption later.
- **Migration design:** Update protocols and trust infrastructure, test interoperability and performance, protect downgrade choices, and build crypto agility so algorithms and parameters can change without redesigning every dependent system.
- **Implementation:** Use standardized schemes through maintained libraries, account for larger keys, ciphertexts, and signatures, validate randomness and error handling, and test resistance to implementation and side-channel attacks.
- **Important limitation:** “Post-quantum” does not mean permanently secure or quantum-powered. PQC does not repair compromised endpoints, weak identity binding, poor key management, or data already exposed, and immature or proprietary schemes should not be treated as substitutes for reviewed standards.

### Related terms

[Cryptography](<https://yellowcube.eu/glossary/cryptography/>) · [Quantum computing security](<https://yellowcube.eu/glossary/quantum-computing-security/>) · [Quantum key distribution (QKD)](<https://yellowcube.eu/glossary/quantum-key-distribution/>) · [Public key infrastructure (PKI)](<https://yellowcube.eu/glossary/public-key-infrastructure/>) · [Digital certificate](<https://yellowcube.eu/glossary/digital-certificate/>)

### Sources

[NIST, Post-Quantum Cryptography Standardization](https://csrc.nist.gov/Projects/Post-Quantum-Cryptography/Post-Quantum-Cryptography-Standardization) · [NIST FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard](https://csrc.nist.gov/pubs/fips/203/final) · [NIST FIPS 204, Module-Lattice-Based Digital Signature Standard](https://csrc.nist.gov/pubs/fips/204/final) · [NIST FIPS 205, Stateless Hash-Based Digital Signature Standard](https://csrc.nist.gov/pubs/fips/205/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.