Post-Quantum Cryptography

Merkle devised digital signatures built from hash functions rather than number-theoretic problems such as those underlying RSA and DSA. Because hash functions are considered relatively resistant to quantum attack, these constructions became one of the earliest and most durable families of post-quantum signature schemes.

The scheme has resisted both classical and quantum cryptanalysis for nearly five decades despite large key sizes limiting its adoption, making it the ancestor of the code-based candidates NIST evaluated during standardisation.

Building on Leslie Lamport's one-time signature idea, Merkle's tree construction produced signatures secure against any adversary, quantum or otherwise, provided the underlying hash function held, an approach revived decades later as SPHINCS+.

Naor and Yung introduced universal one-way hash functions and designed a signature scheme based on hashing that could be used for unlimited time. It was the first such signature not requiring trapdoor properties, broadening the hash-based route to quantum-resistant signatures.

Shor's algorithm showed that a sufficiently large quantum computer could factor integers and solve discrete logarithms in polynomial time, undermining the assumptions behind nearly all public-key cryptography then in use and creating the field this capability now covers.

Miklós Ajtai showed that certain lattice problems were as hard on average as in the worst case, giving cryptographers confidence to build systems on foundations that later underpinned NIST's leading candidates.

The Israeli computer scientist's work gave lattice-based cryptography a hardness assumption tied to worst-case problems believed to resist quantum attack, becoming the mathematical basis for the algorithms later standardised as ML-KEM and ML-DSA.

Garcia showed that the security of Merkle hash tree signatures reduces to the security of the underlying hash function. This gave hash-based post-quantum signatures a firm theoretical grounding rather than mere heuristic confidence.

The PQCrypto series gave post-quantum cryptography a standing venue, drawing attention from both academics and industry. Alongside later ETSI Quantum Safe Cryptography workshops and the Institute for Quantum Computing, it institutionalised the field.

Ding filed the fundamental idea of using learning-with-errors and ring-LWE problems for key exchange, including a rounding signal bit. The construction became the basis of the lattice-based key exchange family that later dominated post-quantum standardisation.

The paper describing the LWE and Ring-LWE key exchange appeared in 2012, following a provisional patent application filed the same year. Publication made the approach available for subsequent extensions by other researchers.

The GLP signature provided a practical lattice-based signature construction. Later research results were folded into the GLYPH variant, which revised GLP in light of post-publication analysis.

Edward Snowden's disclosures about the NSA both exposed efforts to weaken cryptographic standards from within — the Dual_EC_DRBG backdoor and the Bullrun programme — and confirmed that even the largest classical supercomputers of the time could not break correctly implemented public-key cryptosystems. The first damaged confidence in closed standard-setting and pushed NIST toward the transparent, competitively judged process later used to select post-quantum algorithms; the second framed the quantum computer, rather than classical computing power, as the decisive future threat to public-key cryptography.

Peikert's construction followed the same basic idea as Ding's, reusing the additional rounding signal bit. It became one of the reference lattice key-encapsulation designs, with parameter sets giving roughly 6956-bit public keys at above 128-bit security.

The scheme extended the HMQV construction of Crypto 2005 to the lattice setting, following Ding's basic idea. The paper supplied parameters and key sizes for security levels from 80 to 350 bits, aiding practical deployment analysis.

The call for proposals followed warnings that a sufficiently capable quantum computer could break the RSA and elliptic-curve cryptography underlying most internet security, setting in motion the process that produced the eventual standards.

Wang's RLCE scheme built on McEliece-style code-based encryption. It added to the code-based family that provided an alternative to lattice assumptions in post-quantum encryption.

The OQS project set out to develop and prototype implementations of post-quantum algorithms, including key exchange schemes. It became a common open-source substrate for experimentation and integration ahead of formal standards.

Google used hybrid schemes combining a post-quantum algorithm with conventional elliptic-curve cryptography in TLS tests in 2016 and again in 2019. The hybrid design meant that a break of the experimental algorithm would not expose the protected data.

Following Chrome's move to enable hybrid post-quantum key exchange by default from 2024, the share of encrypted web traffic using quantum-safe key establishment continued to grow through early 2026, according to content delivery networks that measure protocol adoption.

The Abu Dhabi-based institute broadened work on post-quantum implementation and side-channel resistance, part of a wider Gulf effort to build sovereign expertise in quantum-safe security rather than rely solely on standards imported from the United States or Europe.

The code-based scheme was chosen to complement the lattice-based ML-KEM standardised in 2024, giving encryption a second mathematical foundation in case future cryptanalysis weakens lattice-based assumptions.

The plan set common milestones for member states to inventory cryptographic systems and begin migrating critical infrastructure to post-quantum algorithms, aiming for substantial completion around 2030 across the bloc's public administrations and regulated sectors.

Research hubs funded under India's National Quantum Mission continued work on quantum-safe cryptography, while Indian financial regulators and payment bodies began assessing timelines for migrating banking systems away from algorithms vulnerable to quantum attack.

Japan's cipher evaluation body reviewed ML-KEM, ML-DSA and related algorithms for possible inclusion in the government's recommended cipher list, continuing a multi-year assessment of which cryptographic standards Japanese public systems are permitted to use.

NIST published the final versions of its first three post-quantum cryptography standards, FIPS 203, 204 and 205, setting out algorithms for general encryption and digital signatures based on the schemes previously known as Kyber, Dilithium and SPHINCS+, with a fourth standard expected near the end of the year. Standardisation gave industry and governments a formal basis for migration away from RSA and elliptic-curve cryptography, converting a research field into the foundation for compulsory and commercial transition worldwide.

Apple said it would upgrade iMessage to a post-quantum protocol using ongoing keying, aiming to replace the existing protocol in all supported conversations by the end of 2024. It marked post-quantum cryptography's arrival in a default consumer messaging platform at scale.

Guidance directed operators of power, water, telecommunications and financial infrastructure to inventory cryptographic dependencies and prepare migration plans, positioning Singapore among the earlier movers in Southeast Asia on quantum-safe transition.

Updated guidance in the Information Security Manual directed government systems to phase out RSA and elliptic-curve cryptography in favour of post-quantum alternatives, one of the more aggressive national transition timelines set anywhere to date.

The National Security Research Institute's multi-year effort to develop domestically designed lattice- and code-based algorithms advanced toward selection, giving South Korea an alternative to relying solely on NIST's US-led standards.

Developed in partnership with ETH Zürich, the implementation combined elliptic-curve and lattice-based Dilithium signatures in a hardware authenticator. It demonstrated post-quantum signatures in constrained consumer security devices.

The Signal Protocol began using Post-Quantum Extended Diffie–Hellman, bringing quantum-resistant key agreement into mass-market secure messaging. It was among the first large-scale production deployments of post-quantum key exchange.

Wouter Castryck and Thomas Decru showed that SIKE, the supersingular isogeny encryption scheme still under NIST review, could be broken within days on an ordinary computer, removing an entire mathematical family from contention. Because Google's 2019 TLS experiment had used SIKE in a hybrid with X25519, the non-post-quantum layer still protected the data in that deployment.

CRYSTALS-Kyber was chosen for general encryption and CRYSTALS-Dilithium, Falcon and SPHINCS+ for digital signatures, the outcome of a six-year public evaluation that eliminated dozens of competing designs through open cryptanalysis.

The NIST submission fixed n = 509 and q = 2048 for 128-bit security, yielding a 699-byte public key and 935-byte private key. Compact keys made NTRU one of the more deployable lattice candidates.

A team using the IBM Q machine managed to factor only very small integers, failing at 35. The result illustrated how far practical quantum hardware remained from breaking realistic key sizes such as RSA-2048.

Round one of the standardisation process drew submissions from research teams across North America, Europe and Asia, beginning years of public cryptanalysis that eliminated most candidates before a shortlist emerged.

Their paper showed how to cut the number of bits transmitted in the supersingular isogeny Diffie–Hellman protocol by half. Further work by Costello, Jao, Longa, Naehrig, Renes and Urbanik reduced compressed SIDH public keys to 2640 bits, making isogeny schemes competitive on bandwidth.