Most of the cryptography securing the internet today, the RSA and elliptic-curve algorithms behind TLS, SSH, and VPNs, relies on math problems that are extremely hard for classical computers to solve. Factoring large numbers or computing discrete logarithms on an elliptic curve takes longer than the age of the universe with any computer we know how to build. That assumption is the foundation of digital trust online.

A sufficiently powerful quantum computer would break that assumption. Shor’s algorithm, a quantum algorithm published in the 1990s, can factor large numbers and solve discrete logarithm problems in polynomial time. No quantum computer today has anywhere near the stable, error-corrected qubits needed to run it against real-world key sizes. But the migration away from vulnerable cryptography is already happening, and the reason comes down to a problem cryptographers call “harvest now, decrypt later.”

The Harvest Now, Decrypt Later Problem

Encrypted traffic is often captured and stored, not just intercepted in the moment. Intelligence agencies, and plenty of less scrupulous actors, can record encrypted data today and simply hold onto it. If a quantum computer capable of breaking that encryption arrives in ten or fifteen years, all of that archived traffic becomes retroactively readable.

This matters most for data with long-lived sensitivity: state secrets, medical records, trade secrets, personal communications people expect to stay private for decades. If you’re encrypting something today that needs to remain confidential in 2040, the cryptography protecting it needs to be quantum-resistant now, not whenever quantum computers actually materialize. That timeline pressure is why standards bodies and large tech companies started moving years before anyone expects a cryptographically relevant quantum computer to exist.

What Post-Quantum Cryptography Actually Is

Post-quantum cryptography (PQC) doesn’t mean cryptography that runs on quantum computers. It means classical algorithms, running on the hardware we have today, designed around math problems that quantum algorithms don’t have a known shortcut for. Instead of factoring or discrete logs, most PQC candidates rely on problems like finding short vectors in high-dimensional lattices, or decoding structured error-correcting codes.

NIST ran a multi-year public competition to evaluate candidate algorithms, similar to the process that produced AES. That process selected a handful of algorithms for standardization, including lattice-based schemes for key encapsulation and digital signatures. These are now working their way into TLS libraries, browsers, and operating systems, often deployed as hybrid schemes that combine a classical algorithm with a post-quantum one, so that breaking either one alone isn’t enough to compromise the connection.

Why This Is Harder Than Swapping a Library

Cryptographic migrations are notoriously slow because cryptography is woven into protocols, hardware, and assumptions that are hard to change independently. A few things make this one particularly tricky:

• Post-quantum public keys and signatures are often significantly larger than their classical counterparts, which affects bandwidth, storage, and protocols that assumed small fixed-size keys.
• Embedded devices, smart cards, and hardware security modules with fixed firmware can’t always be updated in place.
• Algorithm agility, the ability to swap cryptographic primitives without rearchitecting a system, was often an afterthought in protocols and codebases designed decades ago.
• Confidence in newer algorithms builds slowly. Cryptographic schemes need years of public scrutiny before the security community trusts them the way it trusts AES or RSA, and PQC is still relatively young by that standard.

What This Means in Practice

For most developers, the migration is happening one layer down: TLS libraries, cloud provider SDKs, and operating systems are adding post-quantum key exchange support, often transparently through hybrid handshakes. The practical work for most teams is inventory, not implementation, figuring out where cryptography is hardcoded, where key sizes are assumed to be small, and where vendors or dependencies need to support algorithm agility going forward.

The quantum computer that breaks RSA-2048 may be a decade or more away, if it arrives at all on any predictable timeline. But the data that needs protecting for the next decade is being encrypted right now. That mismatch in timelines, not an imminent quantum breakthrough, is what’s actually driving the shift to post-quantum cryptography today.