Definition
Post-quantum cryptography (PQC) is a class of cryptographic algorithms designed to remain secure even against an attacker equipped with a sufficiently large quantum computer. The concern is that today's standard asymmetric algorithms — RSA, classical Diffie-Hellman, and elliptic-curve cryptography — would all be broken in polynomial time by Shor's algorithm running on such a machine. Symmetric ciphers like AES are weakened but not broken (Grover's algorithm halves their effective security, manageable by doubling key sizes).
Standardized Algorithms
The U.S. National Institute of Standards and Technology (NIST) ran a multi-year competition that concluded in 2024 with the standardization of several PQC algorithms. ML-KEM (formerly Kyber) is the standard key-encapsulation mechanism. ML-DSA (formerly Dilithium) and SLH-DSA (formerly SPHINCS+) are signature schemes. Falcon was also selected for signatures. These are based on lattice problems and hash functions rather than the integer factorization or discrete logarithm problems vulnerable to quantum attack.
Deployment in VPNs and TLS
The 'harvest now, decrypt later' threat — recording encrypted traffic today to decrypt it once quantum computers arrive — has motivated proactive deployment. TLS 1.3 supports hybrid key exchange combining X25519 and Kyber, giving security against both classical and quantum attacks. Cloudflare, Google, and others have deployed it at scale. Several VPN providers, including Mullvad, ExpressVPN and NordVPN, have announced post-quantum key exchange for some or all of their apps. NIST published the first three PQC standards (FIPS 203, 204 and 205) in August 2024. Adoption will continue through the late 2020s as the algorithms mature.