What is post-quantum cryptography, and why migrate now?

Post-quantum cryptography refers to algorithms designed to resist attacks from both classical and quantum computers. Traditional cryptography relies on mathematical problems that current computers cannot solve quickly, but a sufficiently powerful quantum computer could potentially break certain encryption methods. This poses a threat even today, as an attacker could capture encrypted data now and decrypt it later once quantum technology advances.

Data that must remain secret for an extended period, such as medical records or trade secrets, is particularly at risk.

In 2024, the US National Institute of Standards and Technology (NIST) finalized the first set of post-quantum algorithms after extensive public analysis. The two most notable are ML-KEM for key exchange and ML-DSA for digital signatures. While these new algorithms are no longer just theoretical, they are still less battle-tested compared to classical encryption methods, which have been extensively used and analyzed over decades.

To mitigate this risk, a prudent approach involves using hybrid encryption, which combines a well-established classical algorithm with a post-quantum one. This way, only both encryption methods failing simultaneously would compromise the data. However, it is recommended to start by identifying where cryptography is used in your systems and which data requires long-term protection.

Prioritize encrypting long-lived data at rest, as it is most vulnerable to a "harvest now, decrypt later" attack where an adversary stores encrypted data now for future decryption once quantum computers become available.

It is advisable to adopt hybrid encryption rather than replacing classical algorithms entirely. Utilize libraries that compose verified cryptographic primitives rather than developing your own encryption methods, as the latter increases the risk of mistakes. A good example of such a library is Quipu, a free hybrid post-quantum encryption library for data at rest.

The library's source code is available at github.com/isazajuancarlos/quipu and is licensed under AGPL-3.0. However, note that while the composition of verified primitives has been established, an independent cryptographic audit of the specific implementation has not yet been completed.