Which Algorithms Are Ready for Quantum Computing?

Quantum computing does not render all modern cryptography useless. 

Symmetric encryption and cryptographic hash functions do not rely on the factorization and discrete-logarithm problems attacked by Shor’s algorithm, but they face a different type of quantum threat. 

Symmetric Encryption 

Many are familiar with AES, the standard for symmetric encryption. Instead of having a public and private key, both sides share a secret key. 

For an ideal 256-bit key, there are 2²⁵⁶ possible keys. A classical brute-force attack could therefore require searching an unimaginably large number of possibilities. 

Quantum computing introduces Grover’s algorithm, which provides a quadratic speedup for this type of unstructured search problem. 

In simplified security estimates, that means: 

AES-256 classical search: approximately 2²⁵⁶ operations 

AES-256 with Grover: approximately 2¹²⁸ quantum queries 

That is a substantial theoretical reduction. 

But 2¹²⁸ is still extraordinarily large. 

The practical advantage is also more complicated. Grover’s algorithm requires a large number of sequential quantum operations, quantum hardware is significantly more difficult to construct than conventional computing infrastructure, and the attack does not parallelize as conveniently as classical brute-force attacks. 

NIST currently states that applications can continue using AES with 128-, 192- and 256-bit keys and notes that the practical advantage provided by Grover’s algorithm may be considerably smaller than the simplified “security is cut in half” description suggests. 

So while quantum computing affects symmetric cryptography, it does not produce the same fundamental failure seen with RSA and ECC. 

Cryptographic Hashing 

Hash functions such as SHA-256 and SHA-3 are also not vulnerable to Shor’s algorithm. Hash functions take information of arbitrary length and produce a fixed-length output. They are commonly used to verify integrity, protect credentials when combined with appropriate password-storage schemes, construct digital signatures and perform many other cryptographic functions. 

Quantum algorithms can provide advantages against some properties of hash functions, including searching for inputs that produce particular outputs. However, sufficiently strong modern hash functions retain substantial security in a post-quantum environment. 

NIST’s PQC guidance continues to make use of existing symmetric and hash primitives, including SHA-family algorithms and AES. 

What Replaces RSA and ECC? 

The solution is post-quantum cryptography, or PQC. 

Despite the name, PQC does not require a quantum computer. Post-quantum algorithms run on conventional computers, servers, applications and network infrastructure. 

We instead change the math behind them. Instead of relying on integer factorization or discrete logarithms, PQC algorithms rely on other mathematical problems for which researchers currently know no efficient attacks using either classical or quantum computers. 

NIST finalized its first three post-quantum cryptographic standards in August 2024. 

ML-KEM: Establishing Shared Secrets 

FIPS 203 defines ML-KEM, the Module-Lattice-Based Key-Encapsulation Mechanism, which is used for key establishment. 

Two systems communicating over an untrusted network can use ML-KEM to establish a shared secret. That secret can then be used with symmetric cryptography such as AES to encrypt the actual communications. 

ML-KEM’s security is related to the difficulty of the Module Learning with Errors problem, which is part of lattice-based cryptography. NIST currently specifies ML-KEM-512, ML-KEM-768 and ML-KEM-1024 parameter sets. 

In a future TLS connection, for example, ML-KEM or another quantum-resistant mechanism can take over a role currently performed by vulnerable RSA or elliptic-curve key-establishment methods. 

ML-DSA: Digital Signatures 

FIPS 204 defines ML-DSA, the Module-Lattice-Based Digital Signature Algorithm. It’s purpose isn’t encrypting information but rather verifying digital signatures. Those signatures can help prove who generated information and whether that information was modified after being signed. 

That makes ML-DSA a potential replacement for vulnerable signature algorithms such as RSA signatures and ECDSA. NIST states that ML-DSA is believed to remain secure even against an adversary possessing a large-scale quantum computer. 

SLH-DSA: A Different Approach to Signatures 

FIPS 205 defines SLH-DSA, the Stateless Hash-Based Digital Signature Algorithm. Unlike ML-KEM and ML-DSA, which rely on lattice-based mathematics, SLH-DSA builds its security primarily around cryptographic hash functions. 

Having mathematical diversity is valuable. If a previously unknown weakness were eventually discovered in one class of post-quantum mathematics, having standards based on different mathematical foundations provides additional options. 

SLH-DSA is specifically designed for digital signatures rather than key establishment. 

NIST is also developing FIPS 206 for FN-DSA, derived from FALCON, and selected HQC in 2025 for future standardization as an additional key-establishment algorithm based on different mathematics. 

Algorithm	Standard	What It Does	Why It Matters	Security Basis
ML-KEM	FIPS 203	Allows two systems to establish a shared secret over an untrusted network. That secret can then be used with symmetric encryption such as AES.	Provides a quantum-resistant replacement for vulnerable public-key key-establishment mechanisms used in protocols such as TLS.	Module Learning with Errors, a lattice-based mathematical problem
ML-DSA	FIPS 204	Generates and verifies digital signatures.	Can replace vulnerable RSA and ECDSA signatures used for authentication, integrity, certificates, and software signing.	Module-lattice-based cryptography
SLH-DSA	FIPS 205	Generates and verifies digital signatures using hash-based cryptography.	Provides a post-quantum signature option based on a different mathematical foundation than ML-DSA, reducing reliance on a single class of problems.	Cryptographic hash functions

The Quantum Problem Is Really a Cryptographic Assumption Problem 

The significance of quantum computing becomes much clearer once it is separated from the idea that quantum computers are simply extremely fast machines. 

For decades, digital infrastructure has been built around a basic assumption that certain mathematical problems cannot be solved efficiently enough for an attacker to derive our private cryptographic keys. 

RSA assumes integer factorization is difficult. Diffie-Hellman assumes discrete logarithms are difficult. Elliptic-curve cryptography assumes elliptic-curve discrete logarithms are difficult. For classical computers, those assumptions have served us extraordinarily well. 

Shor’s algorithm tells us that they do not hold in the same way for sufficiently capable quantum computers. That is why the transition to post-quantum cryptography is not simply an upgrade from one encryption strength to another. 

Much of the architecture of secure communications can remain but the mathematics we use to establish keys, authenticate systems and create many of our digital signatures has to change. 

The quantum threat ultimately comes down to the one distinction that the lock does not suddenly become too small. The mathematical problem that made the lock difficult to open is no longer difficult in the same way.