Post-Quantum Cryptography: Why Migration Needs to Start Now
A quantum computer will break RSA and ECC, and the "collect now, decrypt later" attack is underway today. We discuss ML-KEM, ML-DSA, hybrid modes and migration plan.
- AUTHOR
- Karol Rapacz / Penetration Tester (OSCP, PNPT)
- PUBLISHED
- 3 July 2026
- READING TIME
- 12 min read
- TOPIC
- Cryptography and PKI
“A quantum computer capable of breaking RSA doesn’t exist yet, so we have time” is the most common and misleading argument in conversations about post-quantum cryptography (PQC). Misleading because it ignores an attack that is happening today: intercepting and storing encrypted data with the intention of decrypting it in the future. If your data needs to remain confidential for 10-15 years, the migration deadline has passed before it even started.
Why quantum breaks today’s cryptography
Modern asymmetric cryptography (RSA, ECDH, ECDSA) is based on problems that are difficult for classical computers: factorization of large numbers and discrete logarithm on elliptic curves. Shor’s algorithm, run on a sufficiently large, stable quantum computer, solves both in polynomial time - that is, effectively breaks them. It is not a question of a “faster computer”, but of a fundamentally different calculation model.
Symmetric cryptography (AES) and hash functions are in a better situation. Grover’s algorithm only gives a quadratic speedup for a brute-force attack, which effectively means “double the key length”: AES-256 remains secure, AES-128 loses the margin. So the problem is mainly on the asymmetric side - which is what TLS key exchange, signatures and PKI are based on.
“Harvest now, decrypt later” - the clock is already ticking
Key concept: SNDL (store now, decrypt later), i.e. “collect now, decrypt later”. An adversary - especially a well-funded, state-owned one - can today intercept encrypted traffic and archive it while waiting for a mature quantum computer. The day such a computer is created, the entire archive becomes readable backwards.
This means that the urgency of migration is determined not by the date of creation of the quantum computer, but by the lifetime of the confidentiality of your data. Medical records, personal information, trade secrets, long-lived keys—anything that will be secret a decade from now—are at risk now.
New standards: ML-KEM, ML-DSA, SLH-DSA
In 2024, NIST finalized the first standards for post-quantum cryptography. It’s worth knowing them by name because they are included in libraries and products:
- FIPS 203 - ML-KEM (formerly Kyber): Key Encapsulation Engine (KEM), successor to ECDH-like key exchange. This is the most important element for TLS.
- FIPS 204 - ML-DSA (formerly Dilithium): digital signature scheme, successor to RSA/ECDSA.
- FIPS 205 - SLH-DSA (formerly SPHINCS+): pure hash signature - slower, but with a different, conservative security foundation (risk diversification).
They all belong to the family of problems considered difficult also for quantum computers - mainly lattice-based, hence the characteristic grid motif. Key practical difference: PQC keys and signatures are larger than ECC, which has implications for protocols, packet sizes, and performance.
Hybrid Modes - A safe way to transition
No one is forcing you to throw away proven cryptography overnight. The transitional standard is hybrid mode: key exchange combines a classical algorithm (e.g. X25519) with a post-quantum one (ML-KEM) in such a way that to crack you have to defeat both at the same time. If a defect is found in the PQC, it protects the classic; if the quantum arrives, it protects the PQC.
This is not theory - hybrid key exchange (X25519 with ML-KEM) is already enabled by default in popular browsers and large CDN providers for a significant portion of TLS 1.3 traffic. In practice, some of your HTTPS traffic may already be post-quantum, even if you don’t know it.
Migration plan for the company
PQC migration is a multi-year project, but it starts with immediately actionable steps:1. Crypto Inventory You can’t migrate what you don’t know. Collect where and what cryptography is used: TLS, VPN, code signatures, PKI, database and backup encryption, hardware (HSM), libraries in applications. This is the foundation - the equivalent of SBOM for cryptography (so-called CBOM). 2. Prioritization by confidentiality lifetime. First, data that must remain secret the longest and long-valid keys. They are the target of SNDL. 3. Crypto-agility. Design systems so that the algorithm can be replaced without rewriting the application - abstraction over the cryptographic library, configuration instead of hard coding. This is the most important feature of architecture for the next decade. 4. Enabling hybrid modes where already available. TLS 1.3 with hybrid KEM, up-to-date libraries, vendor support. 5. Verify Supplier Readiness Ask key vendors (cloud, HSM, CA, software) about the PQC roadmap - this is part of supplier risk management.
Regulatorily, the direction is clear: the American NSA in the CNSA 2.0 guidelines has set a schedule for the transition to PQC for national security systems, and European agencies recommend a hybrid approach. For companies, this means that PQC goes from being an “academic curiosity” to a due diligence requirement - also linked to technical data protection measures.
What not to do
- Do not write your own PQC implementation. Cryptography is implemented from audited, standard libraries - a standalone implementation is a direct route to side-channel vulnerabilities.
- Don’t abandon the classics for “pure PQC” by force. The hybrid mode is today a safer choice than the early, stand-alone PQC.
- Don’t put off taking inventory. This is the cheapest step that can be done right away, and without it, the rest of the migration is blind.
Summary
Post-quantum cryptography is not a “will there be a quantum computer one day” problem - it is a “how long must my data be secret” problem. The SNDL attack is underway today, the standards (ML-KEM, ML-DSA, SLH-DSA) are ready, and hybrid modes allow you to migrate safely and without revolution. Start with a crypto inventory and crypto agility - it’s an investment that will protect your data for decades.
If you want to assess where your organization is using quantum-sensitive cryptography and how to plan for the migration, contact us - security architecture consulting also covers this area.
Frequently asked questions (FAQ)
Does a quantum computer capable of breaking RSA already exist? No - current quantum computers are too small and too unstable to run Shor’s algorithm against real keys. The problem is that data captured today may be decrypted when such a computer is created. Therefore, it is the required data confidentiality period that determines the urgency, not the hardware breakthrough date.
Is AES-256 safe against quantum computers? Yes, in practice. Grover’s algorithm only gives a quadratic speedup, which lowers the effective security level, but AES-256 maintains a solid margin. Primarily asymmetric cryptography (RSA, ECC), not symmetric, is at risk.
Where exactly to start in a small or medium-sized company? From the inventory: where do you use TLS, VPN, signatures, PKI and data encryption and what libraries are behind them. Then ensure that the software is up to date (many libraries already support hybrid KEM) and ask cloud providers and key systems about their PQC plans. This is a real, doable start.
What is hybrid mode and is it safe? Hybrid key exchange combines a classical algorithm (e.g. X25519) with a post-quantum one (ML-KEM), so that the attacker must break both. This is more secure than relying solely on the relatively new PQC and is already being implemented in TLS 1.3 by browsers and CDN providers.
