As of 2026-07-10Level 3

Post-Quantum Migration

Post-quantum migration is the worldwide transition of cryptography to quantum-resistant algorithms: NIST finalized FIPS 203/204/205 in August 2024, and US Executive Order 14412 (June 2026) sets federal deadlines — PQC encryption for sensitive systems by end of 2030.

What it means

A large fault-tolerant quantum computer running Shor's algorithm would break RSA and elliptic-curve cryptography — the locks securing most of today's internet.No such machine exists, yet migration is urgent because of 'harvest now, decrypt later': adversaries can record encrypted traffic today and decrypt it once a quantum computer arrives, so any secret that must stay secret for years is already at risk.The standards are ready: NIST finalized FIPS 203 ML-KEM (key encapsulation), FIPS 204 ML-DSA and FIPS 205 SLH-DSA (signatures) in August 2024, and selected HQC on March 11, 2025 (NIST IR 8545) as a fifth algorithm — a non-lattice backup KEM in case lattice assumptions fail.Not everything is done: FIPS 206 (FN-DSA, based on FALCON) is NOT final as of July 2026.Policy has hard dates now: US Executive Order 14412 (June 22, 2026) requires PQC encryption for sensitive federal systems by December 31, 2030, and post-quantum authentication by December 31, 2031.Urgency also rose on the cryptanalysis side: Gidney's May 2025 preprint (arXiv:2505.15917 — not peer-reviewed) revised the estimated cost of factoring RSA-2048 to under 1 million noisy qubits running under one week, down from 20 million qubits and 8 hours in the 2019 estimate.Deployment is already mainstream: Chrome has defaulted to the hybrid X25519MLKEM768 key exchange since Chrome 124 (April 2024), and Apple's iMessage PQ3 shipped in February 2024.The balanced view: migration is a decade-scale inventory-and-replace program, and hybrid modes (classical + PQC together) hedge against undiscovered flaws in the new algorithms.

Everyday analogy

Everyone's diaries are locked with locks that a future super-key (a big quantum computer) might open. So the whole world is swapping every lock for a new kind before that key even exists. And there's a reason to hurry: sneaky people are photocopying locked diaries right now, hoping to open the copies later — so the swap has to happen before the secrets stop mattering.
It's like Y2K, but without a fixed date: an inventory-everything, replace-everywhere engineering program. 'Harvest now, decrypt later' means your real deadline is set by how long your data must stay secret — not by when the quantum computer finally arrives.

Common misconceptions

  • 'No large quantum computer exists, so there is no rush' — wrong twice: harvested ciphertext can be decrypted later, and full migration of large organizations takes many years; that is why EO 14412 sets 2030/2031 deadlines now.
  • 'The PQC standards are all finished' — FIPS 203/204/205 were finalized in August 2024 and HQC was selected in March 2025, but FIPS 206 (FN-DSA/FALCON) is NOT final as of July 2026.
  • Post-quantum cryptography is not quantum technology: it is classical mathematics (lattices, hash functions, codes) chosen to resist quantum attack, and it runs on today's ordinary computers and phones.

Key takeaways

  • Shor's algorithm on a future fault-tolerant quantum computer breaks RSA/ECC; 'harvest now, decrypt later' makes migration urgent before such a machine exists.
  • NIST standards: FIPS 203 ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA (August 2024); HQC selected March 11, 2025 (NIST IR 8545) as a non-lattice backup KEM; FIPS 206 (FN-DSA/FALCON) NOT final as of July 2026.
  • US Executive Order 14412 (June 22, 2026): PQC encryption for sensitive federal systems by Dec 31, 2030; post-quantum authentication by Dec 31, 2031.
  • Gidney's preprint (arXiv:2505.15917, May 2025 — not peer-reviewed) cut the RSA-2048 factoring estimate to <1M noisy qubits and <1 week, from 20M qubits / 8 hours in 2019 — a key reason timelines accelerated.
  • Deployment is mainstream: Chrome defaults to hybrid X25519MLKEM768 since Chrome 124 (April 2024); Apple iMessage PQ3 since February 2024. Hybrid modes hedge against flaws in the new algorithms.

Check your understanding

Why must organizations migrate to post-quantum cryptography before a large quantum computer exists?

  1. A.Because quantum computers already break AES everywhere
  2. B.Because of 'harvest now, decrypt later': encrypted data recorded today can be decrypted once a quantum computer arrives, and migration itself takes years
  3. C.Because classical cryptography stops working in 2030
  4. D.Because PQC is faster than all classical cryptography
Show the answer

Answer: B. Because of 'harvest now, decrypt later': encrypted data recorded today can be decrypted once a quantum computer arrives, and migration itself takes years

Why: Adversaries can store today's ciphertext and decrypt it later with a future quantum computer, so long-lived secrets are at risk now — and enterprise-wide migration takes years, which is why EO 14412 sets 2030/2031 deadlines.

Which post-quantum standard is NOT final as of July 2026?

  1. A.FIPS 203 (ML-KEM)
  2. B.FIPS 204 (ML-DSA)
  3. C.FIPS 205 (SLH-DSA)
  4. D.FIPS 206 (FN-DSA/FALCON)
Show the answer

Answer: D. FIPS 206 (FN-DSA/FALCON)

Why: FIPS 203/204/205 were finalized in August 2024. FIPS 206, based on FALCON (FN-DSA), remains unfinalized as of July 2026. HQC was additionally selected in March 2025 as a non-lattice backup KEM.

Builds on

Shor's AlgorithmML-KEM (Module-Lattice Key Encapsulation)

Graded 2026-07-10 (human sign-off): timebound, asOfDate 2026-07-10 — standards and policy are moving targets: FIPS 206 (FN-DSA/FALCON) is NOT final as of July 2026, EO 14412 deadlines (Dec 31 2030 / Dec 31 2031) may be amended, the Gidney RSA-2048 resource estimate (arXiv:2505.15917) is a preprint, and browser/messenger deployment status changes with releases.

Learn it hands-on

This concept is part of a 46-level curriculum with an interactive simulator and Lumen, a tutor whose answers are verified before you see them. Levels 1–5 are free.

Start freeSee the curriculum