A future attack can start with a recording today
The internet is adopting post-quantum cryptography because some information must remain private longer than today’s encryption may remain safe. An attacker can record an encrypted connection now and save it for a future attempt to recover its secrets. Replacing vulnerable cryptography later cannot retrieve that recording.
That is the logic of “harvest now, decrypt later.” It is a threat model, not proof that every conversation is being collected or that a cryptographically capable quantum computer already exists. It combines three clocks: how long information needs protection, how long migration takes, and when a capable attacker might arrive.
A restaurant booking may lose its sensitivity tomorrow. A medical history, industrial design, or confidential source’s identity can matter for decades. An organization protecting those secrets cannot reasonably wait until an attack is demonstrated before starting a migration that takes years.
A secure connection has more than one job
When a browser connects to a website, it needs to establish shared secrets and authenticate the party on the other end. After setup, fast symmetric encryption protects the traffic. These are related jobs, but upgrading one does not automatically upgrade the others.
Traditional public-key systems such as RSA and elliptic-curve cryptography depend on mathematical problems that conventional computers cannot practically solve at the required scale. Shor’s algorithm changes the prospects for those particular problems on a sufficiently capable quantum computer.
The qualification is substantial. A machine must carry out a large, reliable computation despite errors. A chip announcement or a raw qubit count does not establish that ability. Hardware, error correction, and the attack itself all matter.
Nor does this mean every form of encryption collapses together. The central migration problem concerns specific public-key mechanisms, including key establishment and digital signatures. “Quantum computers break encryption” is too broad to guide an actual upgrade.
What the replacement math does
In August 2024, NIST finalized its first three post-quantum standards. ML-KEM establishes a shared secret. ML-DSA and SLH-DSA provide digital signatures. Remembering their different jobs is more useful than remembering the acronyms.
Under the ML-KEM standard, one participant creates a public key and retains a private key. Another uses the public key to produce both a shared secret and a ciphertext. The ciphertext travels over the network; the private-key holder processes it to recover the same secret.
The resulting secret helps derive keys for symmetric encryption. ML-KEM is therefore not encrypting every byte of a video stream. It participates in establishing the keys used by other algorithms.
Its security relies on structured lattice problems involving carefully controlled errors in mathematical relationships. The errors are deliberate parts of the construction, not packet loss or a faulty internet connection. Recovering hidden information from those relationships is believed difficult even for quantum computers.
Post-quantum algorithms run on ordinary computers. They do not require a quantum laptop. They also differ from quantum key distribution, which relies on specialized quantum communication equipment.
Why deployments combine old and new methods
Google’s browser deployment paired a conventional elliptic-curve method with ML-KEM. In a properly designed hybrid exchange, both contributions help determine the final keys.
If a future quantum attack defeats the conventional component, the newer component is intended to preserve secrecy. If a weakness is found in the newer algorithm, the conventional contribution still offers its existing protection. The security goal is for an attacker to need both contributions, rather than gain entry by breaking either one alone.
Hybrid design does not eliminate implementation risk. Code can mishandle secrets, negotiate the wrong method, or introduce a weakness that the mathematical specification does not contain. Public analysis, careful integration, and continued scrutiny remain necessary.
There is another boundary: hybrid key exchange can protect recorded traffic while the server still authenticates itself with traditional signatures. Future resistance to decryption and future resistance to impersonation need separate answers.
Cloudflare’s April 2026 roadmap targets full post-quantum security, including authentication, by 2029. That is an operator’s migration target, not a prediction that attacks begin in that year.
The public website is only one connection
A company can upgrade its customer-facing website while leaving other dependencies untouched. Connections to databases, remote access for staff, device certificates, and software-update signatures may use different systems and replacement cycles.
NIST’s migration guidance emphasizes finding those dependencies. An inventory needs to establish what cryptography protects, who maintains it, and how it can be replaced. Long-lived secrets and equipment expected to remain in service for years deserve particular attention.
Compatibility testing is practical security work. New keys and signatures can be larger. That can affect handshake size, memory use, and older equipment. A sound algorithm does not help if the deployment fails and operators quietly restore a vulnerable alternative.
The important question is therefore not simply whether a product supports post-quantum cryptography. It is where the new method is actually used, which connections fall back, and when vulnerable alternatives can be retired.
A blockchain signature is a different layer
Bitcoin transactions are already public. Its quantum concern is not principally someone decrypting a hidden transaction history. It is whether an attacker could derive signing authority from an exposed public key and forge a transaction.
Exposure varies with output type and use. A quantum-resistant browser connection to an exchange does not change the signature rules enforced by the underlying blockchain.
BIP 360 proposes Pay-to-Merkle-Root to reduce certain forms of prolonged public-key exposure. It is a draft proposal, not an activated rule or a complete migration to post-quantum signatures. A broader transition also needs wallet support, shared consensus rules, and decisions about owners who never migrate.
What a security claim should tell you
For a security claim, name the boundary it covers: key establishment, authentication, stored information, or a particular connection. Then check where that method is actually deployed and which fallbacks remain. The Bitcoin public-key problem illustrates why improving one connection does not automatically upgrade every signature beneath it.
Post-quantum cryptography does not prevent phishing, repair an infected device, or stop an authorized service mishandling information. It addresses particular mathematical assumptions before their failure becomes practical. The long lead time is the reason to start now, even while the date of a capable attack remains uncertain.
