Client Portal
Access your security dashboard and reports
The advent of cryptographically relevant quantum computers (CRQCs) renders the mathematical assumptions underlying RSA, ECDSA, and ECDH computationally tractable. Shor's algorithm achieves polynomial-time factorization; Grover's algorithm halves symmetric key security. The transition to lattice-based and hash-based cryptography is not speculative—it is underway.
Nation-state adversaries are harvesting encrypted traffic today for future decryption once quantum capabilities mature. Data with long-term confidentiality requirements—state secrets, medical records, financial transactions, intellectual property—faces retrospective compromise.
Mosca's theorem quantifies the urgency: if x = time data must remain confidential, y = time to deploy PQC, and z = time until CRQC exists, then migration must begin when x + y > z. For most organizations, this inequality is already satisfied.
NIST's post-quantum standards derive security from the hardness of lattice problems—specifically, the Module Learning With Errors (M-LWE) problem for ML-KEM and ML-DSA. Unlike RSA's reliance on integer factorization or ECDSA's dependence on the discrete logarithm problem, lattice problems are not known to admit efficient quantum algorithms.
The M-LWE problem can be stated informally: given a matrix A sampled uniformly at random and a vector b = As + e where s is a secret vector and e is a "small" error vector, distinguish this from a uniformly random pair. The "module" variant operates over polynomial rings Rq = Zq[X]/(Xn + 1), enabling more compact representations.
The NSA's Commercial National Security Algorithm Suite 2.0 (updated May 2024) establishes mandatory timelines for post-quantum migration across National Security Systems. Unlike advisory guidance, CNSA 2.0 represents binding requirements for defense contractors and federal agencies handling classified information.
Hybrid schemes combine classical and post-quantum algorithms such that the resulting construction is secure if either component remains unbroken. This provides insurance against both quantum attacks (breaking classical) and potential cryptanalytic advances against lattice assumptions (breaking PQC).
The IETF draft draft-ietf-tls-hybrid-design defines hybrid key exchange for TLS 1.3,
where the final shared secret derives from concatenation: SS = KDF(SS_classical || SS_pqc).
Chrome ships X25519Kyber768Draft00 enabled by default; Firefox supports
mlkem768x25519 with manual enablement.
# Enable hybrid key exchange with ML-KEM + X25519 openssl s_server \ -cert server.crt \ -key server.key \ -groups x25519_mlkem768:x25519:secp384r1 \ -provider oqsprovider \ -provider default \ -accept 4433 # Verify hybrid negotiation openssl s_client \ -connect localhost:4433 \ -groups x25519_mlkem768 \ -provider oqsprovider \ -provider default
Enterprise PQC migration extends far beyond algorithm substitution. NIST IR 8547 (November 2024) projects the US federal government migration cost at $7.1 billion. Key challenges include:
Our cryptographic engineers conduct inventory analysis, identify quantum-vulnerable assets, and design migration roadmaps aligned with NIST and CNSA 2.0 timelines.
Tell us about your security requirements. We respond within 24 hours.
Access your security dashboard and reports