Skip to content
Knowledge base Updated: April 8, 2026

Post-quantum cryptography - How to prepare for the era of quantum computers and secure data from quantum threats

Prepare your company for the era of quantum computers by learning about post-quantum cryptography and what it means for the future of data security.

Grzegorz Gnych Grzegorz Gnych

In today’s digital age, information security is the cornerstone of any organization’s operations. However, a new threat is on the horizon - quantum computers, which have the potential to break many of the cryptographic systems currently in use. The technological race between data protection and new computing capabilities requires organizations to take a strategic approach to securing their systems. This article provides a comprehensive look at post-quantum cryptography and practical steps organizations can take to prepare for the coming quantum age.

Shortcuts

What is post-quantum cryptography and why is it so important?

Post-Quantum Cryptography (PQC) is a set of cryptographic algorithms designed to resist potential attacks using quantum computers. Unlike traditional algorithms, which are based on difficult mathematical problems (such as factorization of large numbers or the discrete logarithm problem), post-quantum algorithms are based on mathematical problems whose solution remains difficult even for quantum computers.

The importance of post-quantum cryptography can hardly be overstated in the context of strategic security. According to experts, quantum computers capable of breaking current security systems may emerge within the next decade. This means that any data encrypted by today’s methods can be decrypted in the future by a sufficiently powerful quantum computer. For information with a long period of confidentiality (such as state secrets, medical data or intellectual property), this risk is particularly significant.

For enterprises, the implementation of post-quantum cryptography is no longer a question of “if,” but “when.” Organizations that start planning early for the transformation to post-quantum solutions will not only gain a technological advantage, but also build trust with customers and business partners, for whom data security becomes a priority. The introduction of post-quantum cryptography should be considered as part of a cybersecurity risk management strategy, not just as a response to an emerging threat.

Awareness of the importance of post-quantum cryptography is growing among both regulators and business leaders. In 2023, the White House issued a memorandum ordering federal agencies to prepare plans for migrating to post-quantum solutions, demonstrating the importance of the issue to national security and the economy.

📚 Read the complete guide: Ransomware: Ransomware - czym jest, jak się chronić, co robić po ataku

What threats do quantum computers pose to current cryptographic systems?

Quantum computers pose a fundamental threat to existing cryptographic systems due to their ability to process huge amounts of data in parallel and solve problems that are virtually unsolvable for classical computers. Think of it as the difference between looking for an exit from a maze by trial and error (a classical computer) and being able to look into all paths at once (a quantum computer).

Specifically, Shor’s algorithm (published in 1994) allows quantum computers to efficiently decompose large numbers into prime factors - a problem that underlies the security of the widely used RSA algorithm. It’s a bit like how a lock that, according to its manufacturer, takes a billion years to open without a key can suddenly be opened in an afternoon. According to a recent study published by a team from the University of Chicago in June 2024, a potential quantum computer with 8,000 stable cubits could crack a 2048-bit RSA key in just a few hours.

The problem is not limited to RSA. Public key algorithms based on the discrete logarithm problem, such as Diffie-Hellman or elliptic curve cryptography (ECC), are also vulnerable to quantum attacks. This means that virtually the entire Internet security infrastructure - from secure HTTPS connections to VPNs to digital signatures - will become vulnerable when sufficiently powerful quantum computers emerge.

There is also a threat known as “harvest now, decrypt later.” It’s like a thief taking a safe today that he can’t open, knowing that in a few years he will have the tool to crack it. Potential attackers may be collecting encrypted data now, hoping to be able to decrypt it with quantum computers in the future.

Recent research from IBM Quantum Research (2024) indicates that a significant acceleration in the development of quantum computers may come sooner than expected. Research published in Nature Electronics on superconducting qubits suggests that the first quantum computers capable of cracking RSA-2048 could appear as early as around 2028. A March 2024 McKinsey & Company report, on the other hand, suggests that companies in sensitive sectors should assume the emergence of such machines within 5-7 years as a scenario for planning their operations.

Which cryptographic algorithms are most vulnerable to quantum attacks?

Not all cryptographic algorithms are equally at risk from quantum computers. The highest level of risk is for asymmetric (public key) cryptography algorithms, which are the foundation of today’s digital security infrastructure. RSA, Diffie-Hellman and elliptic curve-based (ECC) algorithms are among the most vulnerable, as their security is based on mathematical problems that quantum computers can effectively solve.

In the case of RSA, standard implementations using keys of 2048 or 4096 bits, which are currently considered secure for many decades, could be broken by a quantum computer in time measured in hours or days. Similarly for algorithms based on elliptic curves, which have gained popularity in recent years due to their efficiency and shorter keys - they too are fundamentally vulnerable to quantum attacks.

Symmetric cryptography algorithms, such as AES, are much less at risk. Grover’s algorithm theoretically allows quantum computers to accelerate brute force attacks, but the scale of this acceleration is much smaller than for asymmetric algorithms. A practical solution is to double the key length (e.g., from AES-128 to AES-256), which effectively neutralizes the advantage of quantum computers.

For hash functions, which are used for digital signatures and password storage, among other things, the situation is similar to symmetric algorithms. A potential quantum attack requires increased resilience through the use of longer hashes, but the basic security properties of hash functions such as SHA-256 or SHA-3 remain preserved even in the quantum age, as long as the appropriate lengths are used.

What are the main types of post-quantum cryptography?

image 31

Post-quantum cryptography includes several categories of algorithms that are based on various mathematical problems that are resistant to quantum attacks. To understand these complex technologies, it is useful to use analogies from everyday life.

Lattice-based cryptography is currently the most mature class of post-quantum algorithms. It can be compared to a lock system, in which the unlocking point of the mechanism is hidden in a multidimensional lattice - a classical computer and a quantum computer have to search through a huge space to find it. Algorithms in this class, such as CRYSTALS-Kyber (chosen by NIST as the standard for post-quantum encryption), offer good performance and relatively small keys.

Code-based cryptography exploits the difficulty of decoding random linear codes. It’s like trying to read a message that has been deliberately distorted with noise in such a way that only the holder of a special key can filter out the noise. Imagine it as a box with millions of switches, only a few percent of which line up in a certain way to open the lock. Algorithms like Classic McEliece have a solid security foundation, but their key challenge is the large size of the keys.

Hash-based cryptography is like a recipe that is easy to make, but impossible to reproduce the ingredients from the finished dish. It uses the properties of hash functions to create secure digital signatures. Examples include XMSS and SPHINCS+. These algorithms are like very robust safes - they may take longer to open and close (they are slower), but they offer exceptional security.

Multivariate systems (Multivariate cryptography) can be compared to a complex Gordian knot with many interconnected ropes. They are based on the difficulty of solving polynomial systems of many variables. It’s like trying to simultaneously solve thousands of equations with thousands of unknowns - a task virtually impossible even for quantum computers.

Isogeny-based cryptography uses the advanced mathematical properties of elliptic curves. It can be compared to a maze that constantly changes its shape - even knowing the starting and ending points, it is difficult to reconstruct the path between them when the structure of the maze changes.

In practice, organizations are likely to use a mix of different types of algorithms, just as a modern bank vault uses a combination of security systems (PIN codes, access cards, biometric scanners, time locks) rather than relying on a single mechanism.

Post-quantum technologies - summary fiche

Network algorithms (Lattice-based)

  • Main representatives: CRYSTALS-Kyber, NTRU

  • Application: Encryption, key exchange

  • Pros: good performance, moderate key size

  • Disadvantages: Relatively new, still being studied security fundamentals

Code-based algorithms (Code)

  • Main representatives: Classic McEliece

  • Application: Encryption

  • Pros: Long history of research, strong safety record

  • Cons: Very large public keys

Hash-based algorithms

  • Main representatives: SPHINCS+, XMSS

  • Application: digital signatures

  • Advantages: strongest theoretical basis, minimal security assumptions

  • Cons: Large signatures, lower performance

Multivariate algorithms (Multivariate)

  • Main representatives: Rainbow, GeMSS

  • Application: digital signatures

  • Pros: quick verification of signatures

  • Cons: Large keys, some schemes have already been broken

Isogeny-based algorithms

  • Main representatives: SIKE (broken in 2022)

  • Application: Key replacement

  • Advantages: very compact wrenches

  • Cons: Slower, newer and less researched, some schemes found to be susceptible

What is “Q Day” and why should companies prepare for it?

“Q Day” (Q-Day) is a hypothetical moment in the future when quantum computers will achieve enough computing power to break commonly used cryptographic algorithms such as RSA or ECC. The term has come to symbolize a breakthrough that will fundamentally change the cybersecurity landscape and trigger a massive migration to post-quantum cryptography.

Preparing for Q Day is crucial for companies for several reasons. First, the transformation of cryptographic infrastructure in large organizations is a lengthy and complex process that can take years. It involves identifying all systems using compromised algorithms, developing migration strategies, and testing new solutions for compatibility and performance.

The actual implementation should have minimal impact on business continuity. Starting the process now gives companies time to take a methodical approach instead of costly ad hoc actions under time pressure.

Second, there is the aforementioned “harvest now, decrypt later” threat. Organizations with data that has a long period of confidentiality need to realize that even if Q Day happens in a few years, data encrypted with today’s methods can be intercepted and stored until it can be decrypted.

For sectors such as health care, finance or defense, where information confidentiality must be assured for decades, the threat is already real.

Third, preparing for the quantum era may become a legal and regulatory requirement. In the U.S., federal agencies have already received guidance on migrating to post-quantum solutions, and similar regulations can be expected in the European Union and other jurisdictions. Organizations that implement appropriate solutions early will avoid the risk of non-compliance and potential penalties.

The latest data from the Quantum Threat Timeline Report 2023, published by the Global Risk Institute, suggests that there is a 50% probability of the emergence of a quantum computer capable of cracking RSA-2048 by 2031. The study is based on a survey of more than 40 of the world’s leading quantum computer experts. Even more alarming is data from the QuSecure Quantum Security Assessment (2024) report, which indicates that some advanced state quantum programs could achieve this capability as early as 2027-2028.

Regardless of the exact date, companies should treat preparing for the quantum era as an investment in long-term security and business continuity, not as a cost or burden.

What post-quantum cryptography standards have been approved by NIST in 2024?

The National Institute of Standards and Technology (NIST) in the US has been conducting a systematic process of standardizing post-quantum cryptography algorithms since 2016. In 2024, this process reached an important milestone with the publication of final standards for key cryptographic applications. These standards are the result of a rigorous, multi-year evaluation process that assessed the security, performance and practicality of numerous algorithmic candidates.

CRYSTALS-Kyber has been approved as a standard for Key Encapsulation Mechanisms (KEM), which enable secure exchange of cryptographic keys. Kyber stands out for its good balance between security and performance, offering reasonable key sizes and fast operations. It is based on mathematical problems related to crystal networks, which are considered resistant to quantum attacks. Thanks to its versatility, Kyber is suitable for both high-performance devices and systems with limited resources.

In the category of digital signature schemes, NIST has approved CRYSTALS-Dilithium as the main algorithm. Dilithium, like Kyber, is based on crystal networks and offers good performance with moderate signature and key sizes. As a complement, NIST has also approved SPHINCS+, a signature scheme based on hash functions. Although SPHINCS+ is slower and generates larger signatures than Dilithium, it has an extremely strong security foundation based on minimal cryptographic assumptions.

For more specialized applications, particularly in scenarios requiring the highest level of security or resilience to future advances in cryptanalysis, NIST also recommends Classic McEliece, a code-based key encapsulation algorithm that has the longest research history of all post-quantum candidates. Its main limitation is very large public keys, making it less practical for many general applications.

Standardization by NIST is crucial to the global adoption of post-quantum cryptography. These standards will not only be implemented by U.S. federal agencies, but are likely to become de facto global standards, affecting cybersecurity products and services around the world. Organizations should follow these standards and incorporate them into their migration strategies to post-quantum solutions.

How can organizations assess their readiness for the quantum era?

Assessing an organization’s readiness for the era of quantum computers should be a systematic process that includes several key steps to identify both threats and countermeasures. The first step is to conduct a comprehensive cryptographic audit that identifies all places in the IT infrastructure where algorithms vulnerable to quantum attacks are used. This audit should cover not only central systems and applications, but also edge devices, embedded systems, IoT communications and third-party solutions.

A key component of the assessment is an inventory of cryptographic assets, including algorithms used, key lengths and use cases. Special attention should be paid to data with long confidentiality periods, which may need to be protected for decades. The result of this analysis should be a map of cryptographic dependencies, indicating which systems are most vulnerable and should be migrated first.

Organizations should also assess their supply chain for quantum readiness. This includes verifying that software, appliance and service providers have plans to migrate to post-quantum cryptography and the pace of implementation. In many cases, organizations will depend on the speed at which their vendors update their products, which can be a bottleneck in the migration process.

Another aspect of the assessment is the Business Impact Analysis (BIA) for a cryptographic security breach scenario. Organizations should understand what the consequences of a breach of their cryptographic systems would be, both financially, operationally and reputational. This analysis will help prioritize actions and allocate resources in the migration process.

As part of the readiness assessment, it is also worth conducting a skill gap analysis among IT and security personnel. Post-quantum cryptography requires specialized knowledge that may be lacking in many organizations. Identifying training needs and planning for competency development should be an integral part of a strategy to prepare for the quantum era.

What are the main challenges in implementing post-quantum cryptography?

The implementation of post-quantum cryptography poses a number of complex technical, operational and business challenges for organizations. One of the biggest challenges is ensuring backward compatibility and interoperability during migration. Systems using new post-quantum algorithms must be able to interoperate with existing systems that still use traditional algorithms. This need for a “two-pronged” approach significantly increases implementation complexity and may require hybrid techniques that combine classical and post-quantum algorithms.

Performance aspects present another significant challenge. Most post-quantum algorithms require more computing resources, memory and network bandwidth than their classical counterparts. For example, public keys in some post-quantum algorithms can be tens or even hundreds of times larger than those of RSA or ECC. This difference can have a significant impact on system performance, especially in resource-constrained environments such as IoT devices, embedded systems and mobile applications.

The limited maturity of post-quantum algorithms is also a challenge. Although algorithms such as CRYSTALS-Kyber and CRYSTALS-Dilithium have been approved by NIST, their implementations in commercial products are still at an early stage. Proven, mature libraries, tools and best practices are lacking, which increases the risk of implementation errors. The history of cryptography shows that even minor implementation errors can lead to serious security vulnerabilities.

From a business perspective, a significant challenge is convincing decision makers to invest in migrating to post-quantum cryptography now, when the quantum threat may seem remote. Many organizations are struggling with limited cyber security budgets and must prioritize investments based on the most pressing threats. Justifying the business value of preparing for the quantum era requires educating stakeholders and presenting clear, measurable benefits of early adoption.

In addition, organizations face a shortage of professionals with the necessary expertise in post-quantum cryptography. This relatively new discipline requires a unique set of skills combining advanced mathematics, theoretical cryptography and practical aspects of security system implementation. Developing or acquiring such competencies can be time-consuming and expensive.

How to perform a safe migration to post-quantum systems?

Secure migration to systems using post-quantum cryptography requires a methodical, phased approach that minimizes risk and ensures operational continuity. The process should begin with a detailed inventory of all cryptographic assets in the organization, including algorithms, protocols, key lengths and use cases. This in-depth analysis will identify critical systems and data in need of immediate protection, which should be a priority in the migration process.

Based on the inventory, a comprehensive migration strategy should be developed, taking into account the specifics of the organization’s IT environment and available resources. The strategy should define clear goals, milestones, timelines and metrics for success. It’s also crucial to define prioritization rules to focus first on the highest-risk systems, such as PKI (Public Key Infrastructure), VPN systems, or applications that process sensitive data.

In practice, most organizations should consider a hybrid approach as an interim strategy. It involves using both classical and post-quantum algorithms in parallel. For example, TLS protocols can use hybrid key exchange mechanisms that combine traditional algorithms (such as ECDHE) with new post-quantum algorithms (such as Kyber). This approach provides both compatibility with existing systems and protection against future quantum attacks.

Testing and validation of new post-quantum solutions in an isolated (sandbox) environment is a key step before production deployment. Testing should include not only security aspects, but also performance, scalability and compatibility with existing infrastructure. Special attention should be paid to potential bottlenecks, such as increased bandwidth or memory requirements caused by larger key and signature sizes in post-quantum algorithms.

Production deployment should take place gradually, starting with less critical systems and systematically expanding the scope of the migration. At each stage, it is essential to monitor performance and security indicators and be ready to react quickly to potential problems. It is also worth remembering to document the migration process and gather lessons learned that can be used in subsequent phases.

A key aspect of safe migration is also the preparation of a fallback plan in case of unexpected problems. Such a plan should specify procedures for reverting to previous solutions in the event of critical failures and define criteria for making such a decision.

PQC migration strategy - summary fiche

Step 1: Inventory and risk assessment

  • Identification of all systems using compromised algorithms

  • Categorization of data according to the required protection period

  • Assessing the impact of a potential cryptographic security breach

  • Identification of external dependencies and system constraints

Stage 2: Planning and prioritization

  • Development of a detailed migration road map

  • Prioritization of systems by level of risk and criticality

  • Allocation of resources and budget

  • Identify success metrics and checkpoints

Stage 3: Hybrid implementation

  • Implementation of hybrid solutions combining classical and post-quantum algorithms

  • Testing in an isolated environment before production deployment

  • Gradual implementation starting with low-risk systems

  • Continuous monitoring of performance and security

Stage 4: Finalization and maintenance

  • Full migration to post-quantum algorithms

  • Phasing out obsolete algorithms after the end of the transition period

  • Update security policies and procedures

  • Continuous evaluation and adaptation to new standards and risks

Which sectors of the economy are most vulnerable to quantum threats?

Threats from quantum computers do not affect all industries equally. Particularly vulnerable are industries where data security is critical and information needs to be protected for a long time. The financial sector tops the list of those most at risk, due to the critical importance of the confidentiality of financial transactions, customer data and the integrity of payment systems. Banks, payment institutions and exchanges are particularly vulnerable, as potential breaches of their cryptographic systems could lead to catastrophic financial losses and loss of customer confidence.

The healthcare sector is also extremely sensitive due to the long period of required confidentiality of medical data. Patient records, genetic test results or treatment information often have to remain confidential for a patient’s lifetime, and sometimes even longer. In this context, a “harvest now, decrypt later” attack poses a real threat, as medical data captured today could be decrypted in the future when sufficiently powerful quantum computers emerge.

The energy industry, especially critical infrastructure such as power grids, nuclear facilities and gas distribution systems, is also at high risk. SCADA systems and other industrial automation components, which are increasingly connected to the Internet, could become targets for attacks that exploit cryptographic vulnerabilities. Security breaches of these systems could lead to physical damage to infrastructure, power outages and the potential threat to human life.

The defense and government sectors are obvious targets due to the strategic importance of classified information. Diplomatic communications, intelligence data, information on weapons systems - all these categories of data often need to be protected for decades. Countries investing in the development of quantum computers may be particularly interested in intercepting other countries’ encrypted communications with the intention of decrypting them later.

The telecommunications industry represents another high-risk sector, as telecom operators are responsible for the security of the vast amounts of data transmitted over their networks. The PKI (Public Key Infrastructure) infrastructure, which is the foundation of Internet security, relies on algorithms that are particularly vulnerable to quantum attacks. A breach of these systems could lead to massive compromise of Internet communications, including e-banking, e-commerce and government services.

What steps should be taken to secure IT infrastructure against quantum threats?

Securing IT infrastructure against quantum threats requires a comprehensive approach, including both technical and organizational measures. A key first step is to conduct a thorough cryptographic inventory that identifies all places in the infrastructure where algorithms compromised by quantum computers are used. This inventory should include not only central IT systems, but also network devices, IoT systems, mobile applications and cloud solutions.

Once the vulnerable elements have been identified, organizations should develop a detailed cryptographic strategy that takes into account the quantum era. This strategy should define the cryptographic standards to be used in the organization, taking into account the recommendations of NIST and other standardization bodies. It is crucial to take into account the principle of “cryptographic agility,” which will allow rapid replacement of algorithms in case new vulnerabilities are discovered or better solutions emerge.

The implementation of hybrid solutions, combining classical and post-quantum algorithms, is a practical approach during the transition period. For example, TLS protocols can employ key exchange mechanisms that use both existing algorithms (e.g., ECDHE) and new post-quantum solutions (e.g., Kyber). This approach ensures compatibility with existing systems while introducing safeguards against future quantum attacks.

Modernizing the PKI (Public Key Infrastructure) is particularly important, as it is the foundation of trust in the digital environment. Organizations should prepare to migrate their CAs, certificates and time-stamping services to post-quantum solutions. This process requires careful planning to avoid interruptions in service availability or loss of trust in the certificate chain.

Equally important is the implementation of appropriate cryptographic key management practices that take into account the peculiarities of post-quantum algorithms. This includes procedures for key generation, storage, distribution, rotation and revocation. Due to the larger key sizes in many post-quantum algorithms, key management systems may need to be expanded and optimized.

Organizations should also actively monitor progress in the development of quantum computers and post-quantum cryptography. The rapidly changing field requires keeping abreast of new research, standards and best practices. Collaboration with outside experts, participation in industry groups and information-sharing forums can help keep knowledge current.

How to manage cryptographic keys in the post-quantum era?

Managing cryptographic keys in the post-quantum era poses new challenges for organizations, requiring a fundamental rethinking of existing practices and systems.

Effective management of post-quantum keys requires taking into account their unique properties, such as much larger key sizes compared to traditional algorithms. For example, public keys in the Classic McEliece algorithm can be more than 1 MB in size, a huge increase compared to RSA or ECC keys.

This difference requires modifications to the systems for storing, distributing and managing certificates.

Organizations should start by updating their key management policies to take into account the specifics of post-quantum algorithms. These policies should define acceptable algorithms, minimum key lengths, key generation procedures, periodicity of rotation, and storage and archiving rules.

Special attention should be paid to the issue of key lifespan - during the transition period, when the security of new algorithms is still under intensive study, it may be necessary to renew keys more frequently.

A key element of post-quantum key management is the implementation of the cryptographic agility principle. Systems should be designed to allow easy replacement of cryptographic algorithms without requiring deep rebuilding of applications or infrastructure.

Practically, this means using abstract cryptographic layers that separate business logic from specific cryptographic implementations, and using data formats that can support different key types and sizes.

Due to higher security requirements, organizations should consider implementing advanced key management solutions such as HSMs (Hardware Security Modules) with support for post-quantum algorithms.

These devices provide hardware-based key protection and can perform cryptographic operations without revealing key material. However, it is worth noting that not all current HSMs support post-quantum algorithms, so it may be necessary to plan to upgrade or replace these devices.

In the context of PKI infrastructure, post-quantum certificate management requires special attention. Larger public key sizes affect the size of certificates, which can be important for communication protocols limited by packet size or memory-constrained devices.

Organizations should analyze the impact of these changes on their infrastructure and plan modifications accordingly.

The key distribution process also needs to be revised. Traditional key exchange methods, based on algorithms such as Diffie-Hellman or ECDH, are vulnerable to quantum attacks.

Organizations need to implement new post-quantum key exchange protocols that provide security in the face of quantum threats. Hybrid solutions, combining classical and post-quantum mechanisms, can provide backward compatibility while introducing new security features.

How can systems be tested for resistance to quantum attacks?

Testing the resilience of systems to potential quantum attacks requires a specialized approach that differs from traditional security testing. Since practical quantum computers capable of cracking commonly used cryptographic algorithms are not yet available, testing is mainly based on theoretical analysis, modeling and simulations. The main tool is cryptographic analysis, which assesses whether the algorithms used fall into the category of susceptible to quantum attacks (mainly algorithms based on the problem of factorization of large numbers, such as RSA, or the problem of discrete logarithm, such as DSA and ECC).

Organizations can conduct cryptographic audits aimed at identifying all places in the IT infrastructure where algorithms vulnerable to quantum attacks are used. Such an audit should include an analysis of source code, system configurations and network traffic. Special attention should be paid to components responsible for security, such as implementations of TLS, VPN, digital signatures or authentication protocols. The results of the audit allow the creation of a map of quantum threats in the organization.

Another important element is testing implementations of post-quantum algorithms for correct implementation. Even the most theoretically secure algorithm can be vulnerable to attacks if it is implemented incorrectly. Existing test suites for post-quantum algorithms, provided by NIST and other standardization organizations, can be used for this purpose. These tests verify that the implementation conforms to the specification and is resistant to known implementation attacks.

Performance and load tests are an important aspect of assessing the readiness of systems for the quantum age. Post-quantum algorithms often require more computing and memory resources than their classical counterparts. Performance testing identifies potential bottlenecks and determines whether the existing infrastructure can handle the increased load. These tests should include peak load scenarios to ensure that systems remain stable even under extreme conditions.

Simulations of quantum attacks, based on current knowledge of quantum algorithms and their complexity, can help understand the potential impact of quantum computers on an organization’s security. While it is not possible to accurately predict the capabilities of future quantum computers, such simulations can provide valuable information about potential attack vectors and the most vulnerable infrastructure elements.

Interoperability testing is key in the context of the transition to post-quantum cryptography. Organizations should verify that systems using new post-quantum algorithms can interoperate effectively with existing systems and with solutions from other business partners. This is especially important during the transition period, when different organizations may be at different stages of migration to post-quantum cryptography.

What are the costs and benefits of early implementation of post-quantum cryptography?

Early deployment of post-quantum cryptography comes with certain costs, but also offers significant strategic and operational benefits. From a cost perspective, organizations need to consider both direct financial expenses and indirect costs associated with the migration.

Direct costs include the purchase of new hardware and software to support post-quantum algorithms, upgrading or replacing HSMs (Hardware Security Modules), investing in increased network bandwidth and memory capacity, and potential consulting fees for outside experts.

Indirect costs can be just as significant and include time and resources spent on systems analysis, migration planning, testing new solutions and staff training.

In addition, there may be costs associated with potential system downtime during deployment, the need to maintain parallel systems during the transition period, and expenses for migration risk management. Total costs are difficult to estimate precisely and will vary depending on the size of the organization, the complexity of its IT infrastructure and specific security requirements.

On the other hand, early implementation of post-quantum cryptography offers significant advantages. First and foremost, it provides protection against the “harvest now, decrypt later” threat, which is particularly important for data that requires long-term confidentiality. Organizations that deploy post-quantum solutions early can be confident that their data will remain secure even in the future, when powerful quantum computers become a reality.

There is also a strategic advantage to be gained from a proactive approach to security. Organizations can use early adoption of post-quantum cryptography as a differentiator in marketing communications, building an image as an innovative and responsible business partner.

In sectors where data security is crucial (e.g., finance, health care), this can make a compelling argument for customers choosing between different providers.

Early deployment also enables a methodical, staggered approach to migration, rather than costly ad hoc efforts under time pressure. Organizations can plan migrations in a way that minimizes operational disruption and risk of errors. They can also spread the cost of migration over a longer period, making it easier to manage IT budgets.

Specific strategies for small and medium-sized enterprises (SMEs)

Small and medium-sized enterprises face particular challenges in implementing post-quantum cryptography due to limited financial and technical resources. However, there are practical strategies that allow SMEs to prepare for the quantum era without excessive expenditures.

The first step should be to conduct a simplified crypto inventory, focusing on key systems and data. SMEs can start by identifying key business processes that use cryptography, such as payment systems, customer authentication and intellectual property protection.

A good strategy for SMEs is to take advantage of cloud services that have already begun implementing post-quantum security. Providers such as AWS, Microsoft Azure and Google Cloud are investing significant resources in post-quantum cryptography and are likely to offer these protections as part of standard services. Outsourcing critical security systems to such providers can be a cost-effective solution for smaller companies.

SMEs can also take advantage of open-source implementations of post-quantum algorithms, such as the Liboqs library or Open Quantum Safe, instead of investing in expensive commercial solutions. These free tools, while requiring some technical knowledge, can significantly lower the barrier to entry for post-quantum cryptography.

Another practical approach is to implement post-quantum cryptography in stages, starting with the least complex but business-critical systems. Smaller companies can, for example, secure e-mail communications or financial data transmission first, before moving on to more complex systems.

SMEs can also consider working with local technology partners or taking advantage of consulting services offered by industry organizations or business support programs, often at reduced costs for smaller companies.

PQC cost-benefit analysis - summary fiche

Implementation costs

  • Direct: New hardware and software, HSM upgrade, increased network capacity

  • Indirect: Time and resources for analysis, planning, testing and training

  • Operational: Potential downtime, maintaining parallel systems, risk management

  • Scale: Depends on the size of the organization and the complexity of the IT infrastructure.

Strategic benefits

  • Security: protection against “harvest now, decrypt later” attacks

  • Competitiveness: Stand out as a leader in security and innovation

  • Efficiency: a methodical approach instead of costly ad hoc measures

  • Compliance: Get ahead of future regulatory requirements

Strategies for SMEs

  • Prioritization: Focus on key systems and most sensitive data

  • Cloud services: leveraging providers already implementing post-quantum security

  • Open source: using free libraries and tools instead of commercial solutions

  • Phased deployment: start with the simplest but critical systems

  • Collaboration: Partnership with local experts or support programs

How to prepare the IT team to work with new post-quantum algorithms?

Preparing an IT team to work effectively with post-quantum algorithms requires a comprehensive approach to competence development that goes beyond standard cybersecurity training. The first step should be to conduct a skill gap analysis to identify areas that need to be supplemented with knowledge and skills. This analysis should take into account the various roles on the IT team, from security architects and developers to system administrators and support specialists.

Based on the identified training needs, organizations should develop a tiered educational program. For executives and architects, it will be crucial to understand the fundamental principles of quantum computers, their impact on existing cryptographic systems, and the strategic aspects of migrating to post-quantum solutions. Developers and security engineers will need more technical knowledge, covering the principles of post-quantum algorithms, the practical aspects of their implementation, and best practices for integration with existing systems.

Hands-on workshops and pilot projects are invaluable tools for skill acquisition. Teams should have the opportunity to experiment with post-quantum algorithm implementations in a safe test environment where they can learn about their performance characteristics, resource requirements and potential implementation pitfalls. It is good practice to start with smaller, non-critical projects that will allow the team to gain experience before migrating key systems.

The formation of internal expert groups (Community of Practice) can significantly accelerate the knowledge transfer process within an organization. Such groups, made up of individuals with a particular interest and commitment to post-quantum cryptography, can act as internal consultants, supporting other teams in the migration process, developing internal standards and best practices, and monitoring the latest trends and research in the field.

External cooperation is equally important in the process of competence building. This includes participation in industry conferences, webinars and training sessions led by experts, as well as collaboration with universities, research institutes and standardization organizations. Establishing relationships with security solution providers who are already working on post-quantum algorithm implementations can be particularly valuable.

Documentation and knowledge management are a key component of building sustainable organizational competencies. Teams should create and update internal knowledge libraries that include implementation guides, case studies, lessons learned from pilot projects, and best practices. This documentation should be easily accessible and regularly updated to reflect the latest developments in post-quantum cryptography.

How do regulations affect the adoption of post-quantum cryptography?

The regulatory landscape for post-quantum cryptography is evolving rapidly, exerting increasing influence on organizations’ decisions regarding the adoption of new cryptographic solutions. In the United States, the National Institute of Standards and Technology (NIST) plays a key role in the standardization of post-quantum algorithms.

NIST’s publication of official standards in 2024 marks a turning point that is likely to accelerate adoption of these solutions, especially in the public sector and in organizations working with government agencies.

In May 2022, the Biden administration issued the Quantum Security Memorandum (NSM-10), which directs federal agencies to prepare comprehensive plans for migrating to post-quantum cryptography.

The memorandum establishes specific deadlines for systems inventory, risk assessment and implementation of post-quantum solutions. While only federal agencies are directly affected by this regulation, it has a broader impact on the cybersecurity ecosystem, as vendors working with the government will have to adapt their products to the new requirements.

In the European Union, the eIDAS 2.0 regulation, which is currently being finalized, introduces quantum resilience requirements for trust services such as electronic signatures, electronic seals and certificates.

This regulation will have a significant impact on trust service providers and organizations using these services in the EU. In parallel, the European Union Cyber Security Agency (ENISA) has published guidelines for preparing for the quantum age, which provide a reference point for European organizations.

Sector regulations are also beginning to take quantum risks into account. In the financial sector, the Bank for International Settlements’ (BIS) operational risk management guidelines for banks include recommendations to include quantum risks in risk analysis.

Similarly, the European Central Bank (ECB) has begun integrating quantum readiness assessments into its supervisory processes for eurozone banks.

In the data protection sector, while current regulations (such as RODO in the EU or CCPA in California) do not directly address quantum threats, they do contain general requirements for the use of up-to-date and adequate security measures.

Supervisory authorities may in the future interpret these requirements as also including protection against quantum threats, especially for data requiring long-term confidentiality.

Industry standards are also evolving to address quantum threats. The Payment Card Industry Data Security Standard (PCI DSS), in its latest version, is beginning to address post-quantum cryptography issues, which will affect organizations that process payment card data.

Likewise, ISO 27001 standards and related guidance increasingly consider quantum risks in the context of risk assessment and information security management.

International organizations such as the Internet Engineering Task Force (IETF) are working to incorporate post-quantum algorithms into key Internet protocols such as TLS, IPsec and SSH. This standardization work, while not legal in nature, will have a significant practical impact, as it will determine how post-quantum cryptography is implemented in the global Internet infrastructure.

European PQC Transition Roadmap (2025)

In April 2024, the European Commission issued a recommendation on coordinating the transition to post-quantum cryptography, and in June 2025 published a landmark document — “A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography” (link to document). This is the first coordinated European roadmap with concrete deadlines for all EU Member States.

PQC Migration Timeline in the EU

The roadmap sets three key milestones:

By 31 December 2026 — First Steps:

  • Identify and involve stakeholders
  • Support mature cryptographic asset management
  • Create dependency maps
  • Perform quantum risk analysis
  • Include the supply chain
  • Create a national awareness and communication program
  • Share knowledge and get involved with the NIS CG work stream on PQC
  • Develop a timeline and an implementation plan
  • PQC transition planning and pilots for high- and medium-risk use cases must be initiated

By 31 December 2030 — Next Steps:

  • Support cryptographic agility and a quantum-safe upgrade path
  • Allocate resources for the transition
  • Adapt certification schemes
  • Evolve the rules
  • Implement pilot use cases and contribute to testing centres
  • PQC transition for high-risk use cases completed
  • Quantum-safe software and firmware upgrades enabled by default

By 31 December 2035:

  • PQC transition for medium-risk use cases completed
  • PQC transition for low-risk use cases completed as much as feasible

What This Means for Organizations in 2026

While the roadmap is a recommendation (not a hard regulatory requirement), its implications are significant:

  1. DORA (Digital Operational Resilience Act) — in effect since January 2025, requires financial institutions to manage ICT risk, including cryptographic risk. Lack of cryptographic asset inventory and quantum risk assessment may be interpreted as a gap in operational risk management.

  2. NIS2 Directive — imposes obligations on essential and important entities to use up-to-date cryptographic measures and manage risk appropriately.

  3. Indirect regulatory pressure — even without explicit PQC mandates from national regulators, organizations in financial services, energy, and public sectors should treat quantum risk analysis as part of compliance with existing regulations.

Practical takeaway: organizations that do not have at least a cryptographic asset inventory and quantum risk assessment completed by end of 2026 may find themselves in an unfavorable regulatory position — not because of violating a specific PQC regulation, but due to inadequate risk management under DORA, NIS2, and sector-specific security standards.

Polish context of post-quantum cryptography

Poland’s cybersecurity sector is gradually increasing its awareness of quantum threats, although the level of preparation among organizations remains varied. According to a survey conducted by NASK (Scientific and Academic Computer Network) in 2023, only about 15% of large Polish companies are actively preparing for the quantum era, while the percentage falls below 5% for SMEs.

At the government level, Poland participates in European initiatives related to quantum technologies, including the EuroQCI (European Quantum Communication Infrastructure) program, which aims to build a secure communication infrastructure resistant to quantum attacks. A Polish team of researchers from the AGH University of Science and Technology in Krakow and the Warsaw University of Technology is actively involved in research on post-quantum algorithm implementations, with a particular focus on their applications in devices with limited resources.

In the Polish banking sector, major financial institutions such as PKO BP and Santander Bank Polska have already started the first pilot projects related to post-quantum cryptography. They are mainly focused on securing electronic banking channels and payment card systems. The National Bank of Poland has begun to include the need to plan for migration to post-quantum solutions in its recommendations on the security of IT systems in the banking sector.

The Ministry of Digitization, in cooperation with the NASK, has developed the 2023 “Strategic Directions for Quantum Security” document, which provides recommendations for public administration and critical infrastructure entities to prepare for the quantum era. The document emphasizes the need for increased awareness of quantum threats and the gradual implementation of post-quantum solutions, especially in systems that process data with a long period of confidentiality.

The Polish telecommunications sector, represented by operators such as Orange Polska and T-Mobile Polska, has also begun work on assessing the impact of quantum technologies on the security of its networks. Particular emphasis is being placed on securing 5G infrastructure, which will be the foundation of the digital economy in the coming decades.

A challenge specific to the Polish market is the relatively small number of specialists with competence in post-quantum cryptography. Technical universities are just beginning to introduce these issues into their curricula, and companies often have to compete for a limited pool of experts. Initiatives such as “Quantum Ready Poland,” implemented by the Secure Cyberspace Foundation, aim to increase awareness and competence in this area through training and workshops for IT professionals.

What interim solutions can be used on the way to full PQC implementation?

In the transition period to the full implementation of post-quantum cryptography, organizations can employ a number of practical solutions that enhance security without the need for an immediate, comprehensive migration.

Hybrid cryptography represents one of the most important transitional solutions, involving the parallel use of both classical and post-quantum algorithms. For example, a mechanism can be implemented in the TLS protocol that performs key exchange using both a traditional algorithm (e.g., ECDHE) and a post-quantum algorithm (e.g., Kyber).

This approach ensures compatibility with existing systems while introducing protection against future quantum attacks.

Increasing the length of keys in existing algorithms can provide some level of additional protection, although it should be noted that this is not a long-term solution for algorithms that are fundamentally vulnerable to quantum attacks (such as RSA or ECC).

However, in some cases, increasing the length of keys can be a temporary solution that extends the time it takes to break security, giving organizations more time to fully migrate to post-quantum algorithms.

Composite Cryptography is an approach in which data is secured by multiple, independent cryptographic layers using different types of algorithms.

For example, a message may first be encrypted using a symmetric algorithm (e.g. AES-256), then secured with a key exchanged using a post-quantum algorithm, and the whole thing may be further protected with a traditional asymmetric algorithm. This multi-layered approach ensures that a potential attacker would have to breach all layers to gain access to the data.

Network segmentation and Zero Trust implementation can significantly reduce the potential impact of a cryptographic security breach.

By dividing the infrastructure into isolated segments and requiring multi-factor authentication for every access to resources, organizations can minimize risk even if some cryptographic algorithms are compromised. This approach does not eliminate the need to migrate to post-quantum cryptography, but it can be an important addition to a security strategy in the interim.

Prioritization of critical systems is a pragmatic approach that allows organizations to focus limited resources on the most sensitive infrastructure components.

Systems that process the most sensitive data or require long-term protection should be migrated to post-quantum solutions first. For less critical systems, a more gradual approach can be taken, deploying post-quantum solutions as part of planned upgrade cycles.

Certificates with shorter lifecycles can reduce the risks associated with potential cryptographic algorithmic breaches. Shortening the life cycle of certificates from typically 1-2 years to a few months or even weeks reduces the time window in which a certificate can be compromised.

This strategy can be particularly useful for SSL/TLS certificates, which are widely used in securing Internet communications.

PQC transition solutions - summary fiche

Hybrid cryptography

  • How it works: Parallel application of classical and post-quantum algorithms

  • Application: TLS protocols, VPN, digital signatures

  • Advantages: Maintain compatibility while enhancing safety

  • Challenges: Increased computational load, implementation complexity

Increased key lengths

  • How it works: Using longer keys in existing algorithms

  • Application: AES (moving from 128 to 256 bits), increasing the length of RSA keys

  • Advantages: relatively simple implementation, minimal changes to existing systems

  • Challenges: Does not resolve fundamental vulnerabilities of asymmetric algorithms

Layered cryptography

  • How it works: Securing data with multiple, independent cryptographic layers

  • Application: Protection of sensitive data, communication with high security requirements

  • Advantages: High level of security, resistance to breakage of a single algorithm

  • Challenges: Implementation complexity, potential impact on performance

Segmentation and Zero Trust

  • How it works: Dividing infrastructure into isolated segments, verification on each access

  • Application: Network architectures, resource access management

  • Advantage: Reduce the potential impact of a security breach

  • Challenges: Requires deep changes in security architecture

Short-term certificates

  • How it works: Significant reduction in the validity period of cryptographic certificates

  • Application: SSL/TLS certificates, digital signatures, access control

  • Advantages: Limiting the time window for a potential attack

  • Challenges: Increased administrative burden, need for automation

Glossary of key terms

Shor algorithm - A quantum algorithm developed by Peter Shor in 1994 that can efficiently decompose large numbers into prime factors. It is a major threat to cryptographic algorithms based on the factorization problem (e.g. RSA).

Post-quantum cyber-security - The field of cyber-security that deals with the creation, analysis and implementation of cryptographic systems resistant to attacks carried out using quantum computers.

Cryptographic ag ility - The ability of a system or application to quickly switch to new cryptographic algorithms without requiring significant changes in code or architecture.

Q-Day (Q-Day) - A hypothetical moment in the future when quantum computers achieve enough computing power to break commonly used cryptographic algorithms such as RSA or ECC.

ECC (Elliptic Curve Cryptography), a type of asymmetric cryptography based on the mathematics of elliptic curves. Popular due to shorter keys than RSA, but vulnerable to quantum attacks.

Harvest now, decrypt later - An attack strategy of harvesting encrypted data now, with the intention of decrypting it in the future when sufficiently powerful quantum computers emerge.

HSM (Hardware Security Module) - A physical device that provides secure generation, storage and management of cryptographic keys without the ability to extract them.

Hybrid cryptography - An approach that combines classical (pre-quantum) and post-quantum cryptographic algorithms to ensure both backward compatibility and security in the quantum age.

Quantum cryptography - The field dealing with the use of the phenomena of quantum mechanics (such as entanglement or the indeterminacy principle) for secure communication. It should not be confused with post-quantum cryptography.

Post-quantum cryptography (PQC) - A collection of cryptographic algorithms designed to resist attacks using quantum computers. It is based on mathematical problems that remain difficult even for quantum computers.

Cubit (qubit) - The basic unit of quantum information, analogous to a bit in classical computer science, but which can be in a superposition of states 0 and 1.

Lattice-based cryptography - Cryptography based on crystal networks, one of the main families of post-quantum algorithms, based on the difficulty of solving mathematical problems related to networks in multidimensional space.

NIST PQC Standardization - A standardization process for post-quantum cryptography algorithms conducted by the National Institute of Standards and Technology in the US, with the goal of identifying algorithms recommended for widespread use.

PKI (Public Key Infrastructure) - Public Key Infrastructure, a set of roles, policies and procedures needed to create, manage, distribute, use and revoke digital certificates and manage public keys.

Quantum advantage - The point at which a quantum computer will perform a specific task faster than the fastest known classical algorithm on the best available supercomputer.

Quantum supremacy - The theoretical point at which a quantum computer can solve a problem that is impossible for a classical computer to practically solve.

RSA - A widely used asymmetric cryptography algorithm whose security is based on the difficulty of factorizing large numbers. It is vulnerable to attacks using the Shora algorithm on a quantum computer.

TLS (Transport Layer Security) - A cryptographic protocol for secure network communication, commonly used to secure websites (HTTPS), email and other services.

Zero Trust - A security model that assumes that no user or device should be considered trustworthy by default, regardless of whether they are inside or outside an organization’s network. Requires constant verification every time resources are accessed.# Post-quantum cryptography - How to prepare for the era of quantum computers and secure data against quantum threats

Learn key terms related to this article in our cybersecurity glossary:

  • Ransomware — Ransomware is a type of malicious software (malware) that blocks access to a…
  • Network Security — Network security is a set of practices, technologies, and strategies aimed at…
  • Wireless Network Security — Wireless network security refers to the measures and practices used to protect…
  • Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
  • Encryption — Encryption is the process of converting data from a human-readable format to…

Learn More

Explore related articles in our knowledge base:

Explore Our Services

Need cybersecurity support? Check out:

See also:

Tags:

Encryption Cybersecurity Network Compliance Ransomware

Share:

Talk to an expert

Have questions about this topic? Get in touch with our specialist.

Sales Representative
Grzegorz Gnych

Grzegorz Gnych

Sales Representative

+48 664 003 003grzegorz.gnych@nflo.pl
Response within 24 hours
Free consultation
Individual approach

Providing your phone number will speed up contact.

Want to Reduce IT Risk and Costs?

Book a free consultation - we respond within 24h

Response in 24h Free quote No obligations
Book a Call +48 22 487 86 36

Or download free guide:

Download NIS2 Checklist