Home / Post-quantum cryptography
Post-quantum cryptography · PQC
The cryptography that withstands the quantum computer
Post-quantum cryptography, or PQC, is the family of algorithms designed to remain secure once a quantum computer capable of breaking RSA, ECC and Diffie-Hellman exists. Cyte has built it and run it in banking production since 2023, a year before NIST published the standard.
In one sentence: post-quantum cryptography replaces the mathematical problems a quantum computer solves quickly, such as factoring large numbers or computing discrete logarithms, with problems that neither classical nor quantum computers can solve, such as lattices and error-correcting codes.
Today's cryptography has an expiry date
Almost all of today's digital security rests on two mathematical problems: factoring large numbers, the basis of RSA, and the discrete logarithm, the basis of elliptic curves (ECC) and Diffie-Hellman. A classical computer would take thousands of years to solve them. In 1994 Peter Shor showed that a sufficiently large quantum computer solves them in hours.
What falls is not a product: it is the trust layer of the internet. TLS key exchange, digital signatures, certificate authority certificates, VPNs, session tokens, code and document signing, and encrypted channels between systems all depend on those two problems.
Symmetric cryptography, such as AES, and hash functions, such as SHA-2, hold up better: Grover's algorithm only halves their effective security, and longer keys are enough. That is why post-quantum migration focuses on public-key cryptography.
The attack has already begun: harvest now, decrypt later
There is no need to wait for Q-Day, the moment a cryptographically relevant quantum computer exists, to be at risk. An adversary able to intercept traffic can store encrypted information today and decrypt it once the machine arrives. The tactic has a name: harvest now, decrypt later.
That is why the deadline is set not by the date of Q-Day but by the lifetime of the data. A medical record, a contract, a trade secret or a master key that must still be confidential ten years from now should already travel and be stored with post-quantum cryptography.
The Quantum Safe Observatory, an initiative of Universidad de los Andes with Cyte as technology sponsor, measures live how many public servers still negotiate keys with classical cryptography: as of this guide, more than half.
NIST · August 2024
The standards already exist
After eight years of public competition, NIST published the first three post-quantum cryptography standards in August 2024. Since then "post-quantum" stopped being a research promise and became a specification you can require in a contract.
FIPS 203 · ML-KEM
Lattice-based key encapsulation mechanism, formerly known as CRYSTALS-Kyber. It replaces RSA and elliptic-curve key exchange in TLS, VPNs and any encrypted channel.
FIPS 204 · ML-DSA
Lattice-based digital signature, formerly CRYSTALS-Dilithium. It is the primary replacement for RSA and ECDSA in certificates, code signing and document signing.
FIPS 205 · SLH-DSA
Hash-based digital signature, formerly SPHINCS+. Slower and with larger signatures, but built on different mathematical assumptions: it is the conservative alternative.
HQC · 2025
In March 2025 NIST selected HQC as a second key encapsulation mechanism, based on error-correcting codes. If an attack on lattices ever appeared, HQC would still stand. Cyte already had it on its roadmap.
The deadlines are already written
The question is no longer whether to migrate but when you fall out of compliance. NIST IR 8547 deprecates 112-bit-security RSA and ECC after 2030 and disallows them after 2035. Europe and sector regulators have set equivalent or stricter timelines.
- United States, NIST IR 8547: RSA and ECC deprecated after 2030 and disallowed after 2035. The NSA requires post-quantum cryptography in national security systems under CNSA 2.0.
- European Union, 2025 coordinated roadmap: inventories and national plans by 2026, high-risk use cases migrated by 2030 and full transition by 2035.
- France, ANSSI: from 2027 it stops certifying security products without post-quantum protection.
- Germany, BSI: migration of critical systems between 2030 and 2032.
- Financial sector, G7: roadmap for banking with a 2032 to 2035 horizon.
- Google has pointed to 2029 as the year from which it drops RSA and elliptic curves across its infrastructure.
How to migrate without breaking operations
A post-quantum migration is not a library swap: it is a program that starts by knowing what is there and ends when the last vulnerable algorithm has been replaced and verified. These are the five stages Cyte runs with its clients.
Inventory (CBOM)
Discover every certificate, key, algorithm and library across network, cloud, code and legacy systems. Without this map there are no priorities, only hunches.
Prioritize by data lifetime
First whatever exposes long-lived data externally; then internal systems; last, whatever can wait.
Hybrid classical + PQC
Combine the classical and post-quantum algorithms on the same channel, gaining the new protection without losing today's interoperability.
Crypto-agility
Leave the algorithm as a configuration parameter, not as code, so that the next change is a routine and not a project.
Verify and measure again
The CBOM is measured again: progress is verifiable before auditors and regulators, not merely declared.
Post-quantum, quantum-safe and hybrid
The three terms are often mixed up and worth separating. Quantum-safe is the goal: a system that stays secure against an adversary with a quantum computer. Post-quantum cryptography is the way to get there with software and mathematics, with no special hardware, which is why NIST, the NSA and European regulators recommend it. Quantum key distribution (QKD) is also quantum-safe, but it requires dedicated optical hardware and does not solve digital signatures.
Hybrid is the transition strategy: a key exchange or signature that combines a classical algorithm with a post-quantum one. If either falls, the other holds. It is how Cyte deploys ML-KEM over TLS today, and what allows you to migrate without waiting for the whole ecosystem to do it at once.
Post-quantum in production, not on a slide
Cyte has built its own cryptography for more than thirty years. Post-quantum migration did not require learning a new domain: it required changing algorithms. Every encryption product incorporates the NIST standards and ships with crypto-agility by default.
Web-Armor®
Hybrid ML-KEM encryption over TLS, end to end, for web and mobile applications.
Notyfind®
Builds the CBOM and renews certificates automatically, post-quantum ones included.
Fields-Encrypt®
Field-level encryption and tokenization with NIST-approved algorithms.
Crypto-Vault® Ultra
Managed file transfer with post-quantum encryption and full traceability.
Total transition
The service: scanning, CBOM, gaps, roadmap and compliance until the last algorithm is migrated.
Quantum Center of Excellence
Capability installed in your team to sustain post-quantum security without depending on anyone.
Frequently asked questions
Post-quantum or postquantum cryptography?
Both spellings are used. In Spanish the Royal Academy recommends "poscuántica", while the industry and translated NIST documents mostly use "post-cuántica"; in English, "post-quantum" is standard. On cyte.co we use both so that anyone searching for either finds the same answer.
Does post-quantum cryptography need a quantum computer?
No. They are mathematical algorithms that run on today's processors: servers, phones, ATMs, mainframes. Quantum is the threat, not the defense.
When does Q-Day arrive?
Nobody has the date. Google has set 2029 as its horizon for dropping RSA and elliptic curves; NIST disallows those algorithms after 2035. What matters is that the harvest attack is already under way: data encrypted with RSA today will be readable on that day.
What about AES and SHA-256?
They hold. Grover's algorithm only halves their effective security, so AES-256 and SHA-384 remain adequate. Migration focuses on public-key cryptography: key exchange and signatures.
How much larger are post-quantum keys and signatures?
Larger than elliptic-curve ones: an ML-KEM-768 public key weighs about 1.2 KB and an ML-DSA-65 signature about 3.3 KB. Manageable in TLS and document signing, but it must be tested on every channel, especially legacy systems and constrained networks. That is one of the typical findings of a CBOM.
Where do you start?
With the inventory. Without a complete CBOM there is no way to know which algorithm sits in which system protecting which data, and any plan is a bet. Cyte delivers the first CBOM in an initial scan, and the roadmap comes out of it.
Related articles
Our articles are published in Spanish.
El robo masivo cuántico ya empezó y nadie ha roto una sola cerradura
El Q-Day ya tiene fechas puestas por reguladores y por la propia física. Qué se rompe, cuánto tarda migrar y por qué EY y Cyte convocan a Quantum Mission para armar el plan.
Firma digital post-cuántica: por qué la seguridad de la información debe cambiar
¿Seguirá siendo válida tu firma digital en la era cuántica? Descubre cómo la criptografía post-cuántica protege la seguridad de la información y el no-repudio.
¿Por qué CI/CD pipeline dificulta la migración hacia la criptografía post-cuántica?
La deuda técnica en CI/CD pipeline puede impedir la migración hacia la criptografía post-cuántica. Descubra cómo preparar su software para la era Quantum Safe.
Un radar para el Q-Day: Seguridad de la información
¿Está preparada tu organización para el Q-Day? Descubre cómo la computación cuántica transformará la protección de datos y por qué la criptografía post-cuántica y seguridad de la información ya no puede esperar.
La paciencia del espía "protección de datos"
¿Tu protección de datos resistirá la computación cuántica? Descubre cómo el Proyecto Venona anticipa la necesidad de adoptar criptografía post-cuántica.
Ciberataques: América Latina y el Plan QuantumSafe Global - Cyte Blog
En marzo de 2026, Google publicó algo que la industria de seguridad venía temiendo (ciberataques) pero esperaba tener más tiempo para procesar: según sus estimaciones, Q-Day, el momento en que una computadora cuántica pueda romper el cifrad
The three pillars of post-quantum security
Nobody migrates what they do not know they have
the CBOM is to cryptography what the SBOM is to software. It answers in minutes the question no bank wants to ask itself during an incident: if this algorithm falls, where am I using it?
Read the guide → Crypto-agility · cryptographic agilityChanging an algorithm should not be a project
an organization is crypto-agile when the algorithm is a configuration parameter and not a line of code, when it knows where every key and certificate is, and when rotating them is an operational routine with a date on the calendar, not a project with a steering committee.
Read the guide →Your first CBOM in an initial scan
Find out which vulnerable algorithms you have today and in what order to migrate them.
