What is post-quantum cryptography? A practical guide to surviving Q-day

Why organizations need to identify vulnerable cryptography and begin planning their PQC migration now

– Getty Images

Q-day is shorthand for the point when a cryptographically relevant quantum computer can break widely used public-key cryptography.

Preparations for Q-day have drawn comparisons with Y2K, but the analogy is useful only up to a point. Before the calendar rolled over to 2000, organizations had to find, update, and test systems that might mishandle the new date. PQC migration requires a similarly extensive technology overhaul, but without Y2K’s fixed deadline.

What is post-quantum cryptography?

Post-quantum cryptography (PQC) uses mathematical algorithms designed to resist attacks by conventional and quantum computers. Unlike quantum key distribution (QKD), which requires specialized quantum communications hardware to distribute keys, PQC can run on existing computing and network infrastructure.

Current RSA and elliptic-curve cryptography secure online connections, digital identities, and software signatures with public keys that mathematical problems and conventional computers find extremely difficult to handle. A sufficiently powerful quantum computer could solve those problems efficiently. Symmetric encryption, where one shared key both encrypts and decrypts data, faces a less severe threat, and sufficiently large keys can generally preserve security.