RSA and elliptic-curve cryptography secure almost everything that travels over the public internet — TLS, code signatures, identity, financial messages. A sufficiently large quantum computer breaks both, and 'harvest now, decrypt later' attacks mean the clock started years ago. Migrating to post-quantum cryptography (PQC) is a multi-year programme, and 2026 is the year boards are signing off the budget.
The standardised algorithms you should know
| Standard | Use case | Replaces |
|---|---|---|
| ML-KEM (FIPS 203) | Key encapsulation / key exchange | RSA, ECDH |
| ML-DSA (FIPS 204) | Digital signatures | RSA, ECDSA |
| SLH-DSA (FIPS 205) | Stateless hash-based signatures | Long-term signing |
Five steps to start this quarter
- Build a cryptographic inventory — every certificate, every library, every hardcoded algorithm in the stack.
- Classify by data sensitivity and lifetime — anything that must remain confidential beyond 2030 is high priority.
- Pilot hybrid TLS — combine classical and PQC key exchange so a break in either does not compromise the session.
- Renegotiate vendor SLAs — your PQC posture is bounded by the weakest dependency in the chain.
- Establish crypto-agility — the next algorithm change will not be the last; design for swap-ability.
The crypto-agility mindset
PQC is not a one-and-done migration. The real architectural shift is moving from 'pick an algorithm and bake it in' to 'algorithms are configuration'. That means abstracting cryptographic primitives behind a thin internal API, versioning suites, and rehearsing rollbacks. The teams that nail this will absorb the next two algorithm transitions without a single all-hands.
Working on a security or platform programme that needs to be quantum-aware? Reach out via the contact section.
Frequently asked questions
- No. Sequence by data confidentiality lifetime and exposure. Long-lived secrets and externally-facing TLS endpoints come first; ephemeral session data can wait.
- Hybrid combines a classical algorithm (e.g. ECDH) with a PQC algorithm (e.g. ML-KEM) in the same handshake. A weakness in either does not compromise the connection — useful while PQC implementations mature.
- Most ML-KEM and ML-DSA workloads are within a small percentage of classical performance. Bandwidth (larger keys and signatures) is the more visible cost — relevant on constrained devices and high-throughput links.
