Post-Quantum Cryptography (PQC)

Post-quantum cryptography (PQC) means new methods of locking digital data that even a powerful future quantum computer cannot break. Unlike QKD, PQC does not need any special physics hardware. It is just new mathematics, written as software, that runs on today's ordinary phones, computers and servers. Its job is to replace the older locks that quantum computers are expected to crack.

Why does it exist?

Almost everything you do online is protected by encryption: UPI payments, net banking, WhatsApp chats, Aadhaar authentication and government emails. Most of this uses public-key cryptography such as RSA and elliptic-curve cryptography (ECC). These are safe today only because some maths problems take ordinary computers thousands of years to solve. For RSA, the hard problem is finding the two prime numbers that were multiplied to make a very large number.

A large enough quantum computer could solve these problems in hours or days. If that happens, the locks on the internet would fail. PQC is the replacement lock, built before that day arrives.

What exactly is the quantum threat?

Two quantum methods (algorithms) matter for exams:

• Shor's algorithm (1994): created by mathematician Peter Shor. It can factor large numbers and solve related problems very quickly on a quantum computer. This breaks RSA, ECC and Diffie-Hellman key exchange completely. It gives an exponential speedup, which turns an "impossible" task into an easy one.
• Grover's algorithm (1996): created by Lov Grover. It speeds up searching through all possible keys. It gives only a quadratic speedup, which roughly halves the strength of a symmetric key. So AES-256 behaves like AES-128 against a quantum attacker, which is still safe. The fix here is simply to use longer keys.

So the real danger is to public-key systems (RSA, ECC), not to symmetric ciphers like AES with long keys. The day when a quantum computer can break today's public-key encryption is often called "Q-Day". Nobody knows exactly when it will come.

Why act now if Q-Day is years away?

Because of a tactic called "harvest now, decrypt later". A spy agency can copy and store encrypted data today, such as defence plans, diplomatic cables or health records. It cannot read the data yet. But once a strong quantum computer exists, it can unlock everything it stored. Data that must stay secret for 10 or 20 years is therefore already at risk. Changing the encryption of a whole country also takes many years, because it sits inside millions of devices, apps and cards.

Where did PQC come from?

The global standard-setting effort was led by the National Institute of Standards and Technology (NIST) of the United States.

1. In 2016, NIST invited cryptographers worldwide to submit quantum-resistant algorithms.
2. By the end of 2017, NIST had accepted 69 complete submissions for Round 1.
3. Round 2 narrowed the field in 2019, and Round 3 (finalists) ran from 2020 to 2022.
4. In July 2022, NIST picked four algorithms: CRYSTALS-Kyber (for sharing keys) and CRYSTALS-Dilithium, FALCON and SPHINCS+ (for digital signatures).
5. On 13 August 2024, NIST published the first three final standards (see below).
6. In March 2025, NIST chose HQC, a code-based method, as a backup key-sharing algorithm, in case a weakness is ever found in the lattice-based one.

The standards UPSC can ask about

NIST gave the algorithms new formal names. Learn the pairs:

• FIPS 203: ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism), earlier called CRYSTALS-Kyber. Used to agree on a shared secret key, for example when your browser connects to a bank's website.
• FIPS 204: ML-DSA (Module-Lattice-Based Digital Signature Algorithm), earlier CRYSTALS-Dilithium. The main general-purpose digital signature.
• FIPS 205: SLH-DSA (Stateless Hash-Based Digital Signature Algorithm), earlier SPHINCS+. A backup signature method based on hash functions instead of lattices.
• FIPS 206: FN-DSA, based on FALCON. Its signatures are much smaller. As of October 2026 it is still a draft standard [its final release was expected in late 2026 or early 2027].

FIPS stands for Federal Information Processing Standards, the official US government technology standards that much of the world follows.

How does PQC stay safe?

It uses maths problems that neither normal nor quantum computers are known to solve quickly. The main families are:

• Lattice-based: finding a hidden point in a huge, many-dimensional grid of points with small "noise" added. Kyber, Dilithium and FALCON use this.
• Hash-based: built only on hash functions, which are one-way scramblers of data. SPHINCS+ uses this. It is well understood but makes larger signatures.
• Code-based: based on decoding messages full of deliberate errors. HQC uses this.

A simple way to picture it: RSA is a lock whose secret is two hidden prime numbers, and a quantum computer is a key-maker built exactly for that kind of lock. PQC changes the lock to a completely different design that this key-maker cannot open.

How does the world plan to switch?

In November 2024, NIST released a draft timeline (NIST IR 8547). It proposes that quantum-vulnerable algorithms such as RSA and ECC at today's common strength be deprecated after 2030 (discouraged, allowed only with limits) and disallowed after 2035 (no longer approved at all). Many organisations are using a hybrid approach during the change: they combine an old algorithm and a new PQC algorithm together, so the data stays safe even if one of them later turns out to be weak.

India's position

In February 2026, the Department of Science and Technology released Implementation of Quantum Safe Ecosystem in India, the report of a task force set up under the National Quantum Mission. The task force was chaired by Dr. Rajkumar Upadhyay, CEO of C-DOT (Centre for Development of Telematics). Its roadmap has three milestones, with tighter deadlines for Critical Information Infrastructure (CII) such as defence, telecom and power:

1. Milestone 1, build foundations (set up leadership, list every encryption method in use, assess quantum risk): by 2027 for CII and 2028 for other enterprises.
2. Milestone 2, move high-priority systems to PQC: by 2028 for CII and 2030 for others.
3. Milestone 3, full adoption of PQC: by 2029 for CII and 2033 for others.

The report also asks for a three-tier national network of testing laboratories, a Cryptographic Bill of Materials (CBOM) from vendors (a list of every encryption method a product uses), and crypto-agility. It names bodies such as the Telecommunication Engineering Centre (TEC), the Bureau of Indian Standards (BIS) and MeitY for this work. Indian systems such as BISAG-N's Vedic Kavach platform already use PQC together with quantum random number generation.

Commonly confused concepts

• PQC vs QKD: PQC is software and mathematics. It works over existing internet links and devices. QKD is hardware and physics. It needs special light sources, detectors and a direct fibre or free-space channel, and it covers only limited distances without trusted relay points. PQC's safety rests on maths problems being hard; QKD's rests on the laws of physics. Many experts see them as complementary, which is exactly how the Gandhinagar trial used them.
• Post-quantum cryptography vs quantum cryptography: "Quantum cryptography" (like QKD) uses quantum physics itself. "Post-quantum" cryptography uses ordinary computers but is designed to resist quantum attackers. The word "post" means "after the arrival of quantum computers", not "made of quantum".
• Symmetric vs asymmetric (public-key) encryption: Symmetric encryption (like AES) uses one shared secret key for both locking and unlocking. Asymmetric encryption (like RSA) uses a public key to lock and a private key to unlock. Quantum computers badly hurt asymmetric systems (Shor) but only weaken symmetric ones (Grover).
• Shor vs Grover: Shor gives an exponential speedup and breaks RSA and ECC. Grover gives a quadratic speedup and only halves symmetric key strength.
• ML-KEM vs ML-DSA: KEM is for sharing a secret key. DSA is for digital signatures, which prove who sent something and that it was not changed.

Issues, criticism and the way forward

• No absolute proof of safety: PQC algorithms are safe because no fast attack is known. A new mathematical idea could break one. In July 2022, two researchers at KU Leuven in Belgium broke SIKE, a candidate still in NIST's fourth round, in about an hour on a single ordinary computer core. This shows the risk. This is why NIST keeps backups such as SLH-DSA and HQC, and why hybrid use is popular.
• Bigger keys and signatures: PQC keys and signatures are often larger than RSA or ECC ones. This can slow down small devices like smart cards, sensors and old routers, and use more bandwidth.
• The huge size of the switch: Encryption is hidden inside banking systems, power grids, telecom networks, smart meters and cars. Simply finding every place it is used is a major task, which is why India's roadmap starts with an inventory.
• Cost and skills: Smaller firms and many government departments may lack the money and trained people to migrate on time.
• Standards and sovereignty: Most standards come from the US NIST. Some experts want India to build its own testing, certification and trusted products through BIS and TEC so that it does not depend on foreign standards alone.
• Way forward: Experts suggest starting with the most sensitive, long-life data; using hybrid schemes during the transition; building crypto-agility so algorithms can be swapped quickly; requiring PQC readiness in government purchases; and training cyber-security staff.

Concepts to Know

• Encryption: Turning a readable message into scrambled code so only someone with the right key can read it. Decryption turns it back.
• Cryptographic key: A secret string of numbers that locks or unlocks data, like the key of a bank locker.
• Public-key cryptography: A system with two linked keys. Anyone can use your public key to lock a message for you, but only your private key can open it.
• RSA: A common public-key method, named after its inventors Rivest, Shamir and Adleman. Its safety depends on how hard it is to break a huge number into its two prime factors.
• Quantum computer: A computer that uses quantum bits (qubits), which can hold 0 and 1 at the same time. For some special problems, it can be vastly faster than a normal computer.
• Algorithm: A fixed set of steps for solving a problem, like a recipe.
• Digital signature: An electronic stamp that proves who created a message or file and shows it was not changed on the way.
• Hash function: A one-way process that turns any data into a fixed-length "fingerprint". You cannot get the original data back from the fingerprint.
• Crypto-agility: The ability of a system to switch quickly to a new encryption method without a big rebuild.
• Critical Information Infrastructure (CII): Computer systems whose failure would seriously harm national security, the economy or public safety, such as power grids, telecom and banking.