Introduction

Cryptography begins with a simple problem: two or more parties want to use information in the presence of someone who may observe, modify, impersonate, or replay messages. If Alice sends a message to Bob across a network, the network is not just a cable or a radio signal. It is also a place where an adversary may listen, delay packets, inject packets, or pretend to be one of the endpoints. Cryptography gives us carefully designed mathematical tools for surviving that environment.

A key is a secret value that controls a cryptographic operation. With the right key, a message can be encrypted or authenticated. Without the right key, the adversary should learn nothing useful or should be unable to forge a valid message, except with a probability so small that it is practically irrelevant. This “should” is important: modern cryptography is not based on hope. It is based on explicit security goals, precise adversary models, and hard mathematical problems.

For several decades, much of secure digital life has depended on public-key cryptography based on three mathematical problem families:

• integer factorization, used in RSA;
• discrete logarithms in finite fields, used in finite-field Diffie–Hellman and related systems;
• discrete logarithms on elliptic curves, used in elliptic-curve Diffie–Hellman and elliptic-curve digital signatures.

These systems are not known to be efficiently breakable by ordinary classical computers when parameters are chosen correctly. A classical computer, in this context, means the kind of computer we normally use today: laptops, phones, servers, microcontrollers, and cloud machines built from classical bits.

The motivation for post-quantum cryptography is that this long-standing security picture changes if an adversary obtains a large, reliable quantum computer.

A quantum computer is a computer that processes information using quantum states rather than only classical bits. The details belong to physics and quantum information theory, but the cryptographic consequence can be stated clearly: some mathematical problems that appear hard for classical computers become efficiently solvable on a sufficiently powerful quantum computer. In 1994, Peter Shor described quantum algorithms for integer factorization and discrete logarithms, directly threatening RSA, finite-field Diffie–Hellman, and elliptic-curve cryptography if large fault-tolerant quantum computers become available (Shor, 1994). In 1996, Lov Grover described a quantum search algorithm that gives a quadratic speedup for unstructured search, affecting the security margins of symmetric cryptography rather than destroying it in the same way (Grover, 1996).

That contrast is the first orientation point of this book:

Quantum computing does not break all cryptography equally. It severely threatens today’s dominant public-key systems, while symmetric cryptography mostly survives with larger security margins.

For example, a 2048-bit RSA public key may look strong against known classical attacks, but RSA depends on the difficulty of factoring a large composite integer. Shor’s algorithm changes the asymptotic picture for that problem on a sufficiently capable quantum computer. By contrast, AES-256 does not depend on factoring or discrete logarithms. Grover’s algorithm can reduce the effective security margin of brute-force key search, but it does not make AES vanish as a useful primitive. This is why post-quantum migration is not simply “replace every algorithm.” It is a careful redesign of the public-key parts of systems, plus a review of symmetric key sizes, protocol assumptions, implementation safety, and operational risk.

What “post-quantum” means

Post-quantum cryptography means cryptographic algorithms designed to run on classical computers while resisting both classical and quantum attacks. The phrase does not mean that the algorithms require quantum hardware. A post-quantum key encapsulation mechanism or signature scheme runs on ordinary devices: servers, browsers, phones, hardware security modules, embedded systems, and network appliances.

This distinction matters because post-quantum cryptography is different from quantum cryptography. Quantum cryptography usually refers to systems that use quantum physical processes directly, such as quantum key distribution. This book is about post-quantum cryptography: classical software and hardware algorithms intended for a world where adversaries may eventually have quantum computers.

A practical example makes the definition more concrete. Suppose a web browser connects to a bank using TLS. Modern TLS uses public-key cryptography during the handshake to authenticate the server and establish shared symmetric keys; then it uses fast symmetric encryption to protect the data stream. In a post-quantum version of this story, the browser and server may use a post-quantum key encapsulation mechanism to establish the shared secret and a post-quantum digital signature to authenticate certificates, while still using symmetric encryption such as AES or a modern authenticated-encryption mode for the bulk data. TLS 1.3 itself separates these roles clearly: key establishment, authentication, and record protection are related but distinct parts of the protocol (Rescorla, 2018).

Why migration matters before quantum computers arrive

It is tempting to postpone the problem until a large quantum computer exists. That is usually the wrong risk model.

Some encrypted data has a long useful lifetime. Medical records, diplomatic cables, trade secrets, source code, intelligence data, genetic data, and long-term identity records may remain sensitive for years or decades. An adversary can copy encrypted traffic today and store it. If the adversary later gains the ability to break the public-key mechanism that protected the session keys, old encrypted sessions may become readable. This pattern is often called harvest now, decrypt later: collect ciphertexts now, decrypt them when technology improves. NIST’s early post-quantum planning documents explicitly discuss the need to prepare for quantum threats before the arrival of cryptographically relevant quantum computers, because migration takes time and some information must remain confidential for long periods (Chen et al., 2016).

Consider a company negotiating a merger in 2026. If its communications are encrypted using a protocol whose key exchange is later broken by a quantum computer in 2036, the adversary may learn details that are still commercially or legally damaging. The attack does not need to happen in real time. The adversary only needs a stored transcript and a future capability.

This gives us a useful risk equation:

Risk increases when data lifetime is long, migration time is long, and the arrival time of quantum capability is uncertain.

The arrival date of a cryptographically relevant quantum computer is not known. Responsible planning therefore does not require prophecy. It requires asking practical questions:

• How long must this data remain confidential?
• How long will it take to replace vulnerable cryptography across systems?
• Which systems are exposed to recorded network traffic?
• Which signatures must remain verifiable far into the future?
• Which vendors, protocols, devices, and certificates create dependencies?

This book will return to these questions in the migration and deployment chapters. For now, the key point is simple: post-quantum cryptography is not only a research topic. It is becoming an engineering and governance task.

The two central public-key tasks

Most of this book revolves around two public-key functions: establishing secrets and proving authenticity.

The first task is key establishment. Two parties who have never shared a secret need to agree on a fresh secret key across an insecure network. Traditional Diffie–Hellman and elliptic-curve Diffie–Hellman do this through public mathematical values that allow honest parties to compute the same shared secret. In many modern post-quantum designs, the corresponding tool is a key encapsulation mechanism, or KEM.

A KEM has three basic operations:

1. generate a public key and a private key;
2. use the public key to encapsulate a fresh shared secret into a ciphertext;
3. use the private key to decapsulate the ciphertext and recover the same shared secret.

For example, a server may publish a KEM public key. A client uses that public key to create a ciphertext and a shared secret. The server uses its private key to decapsulate the ciphertext and obtains the same shared secret. That shared secret can then feed a key schedule that produces symmetric encryption keys.

The second task is digital signing. A digital signature lets a private key holder sign a message, while anyone with the corresponding public key can verify that the signature is valid. Signatures support software updates, certificate chains, document approval, secure boot, package repositories, identity systems, and many protocol handshakes.

For example, when an operating system downloads an update, it should not merely check that the file arrived over an encrypted connection. It should verify a digital signature from the software publisher. If an attacker compromises a mirror server or network path, signature verification can still prevent installation of unauthorized code, provided the signing key and verification process remain secure.

Post-quantum cryptography must replace or supplement both of these public-key tasks.

Standardization and the current center of gravity

Post-quantum cryptography has many mathematical families: lattice-based, code-based, hash-based, multivariate, and isogeny-based approaches, among others. Some have decades of study. Some have produced efficient candidates. Some have suffered serious breaks. This is normal in cryptography: proposals are made, attacked, revised, compared, and sometimes abandoned.

A major organizing force in the field has been the U.S. National Institute of Standards and Technology, commonly called NIST. NIST began a public process to evaluate and standardize post-quantum public-key algorithms, and its 2016 report summarized the motivation, threat model, and broad candidate families for post-quantum cryptography (Chen et al., 2016). In 2024, NIST published Federal Information Processing Standards for ML-KEM, ML-DSA, and SLH-DSA: a module-lattice-based key encapsulation mechanism, a module-lattice-based digital signature scheme, and a stateless hash-based digital signature scheme, respectively (NIST, 2024a; NIST, 2024b; NIST, 2024c).

These names will become familiar:

• ML-KEM is the standardized form of the scheme previously known as CRYSTALS-Kyber.
• ML-DSA is the standardized form of the scheme previously known as CRYSTALS-Dilithium.
• SLH-DSA is the standardized stateless hash-based signature scheme derived from SPHINCS+.

You do not need to understand their internals yet. At this stage, treat them as examples of the kinds of tools the post-quantum transition will use: KEMs for establishing shared secrets and signatures for authentication and integrity.

The standardization process also teaches an important habit: cryptographic confidence is collective and gradual. An algorithm is not trusted merely because its designers are skilled. It becomes more trustworthy when independent cryptanalysts study it, when implementations are tested, when side-channel behavior is examined, when parameter choices are debated, and when real systems expose engineering constraints.

Security is not only an algorithm choice

A common beginner mistake is to ask, “Which post-quantum algorithm should I use?” as though the answer alone creates security. Algorithm choice matters, but it is only one layer.

A secure deployment also requires:

• correct protocol integration;
• safe randomness generation;
• protection against timing and power-analysis leakage;
• key management and key erasure;
• downgrade resistance;
• reliable authentication;
• careful certificate and identity design;
• monitoring, updates, and incident response.

For example, suppose an organization adopts a strong post-quantum KEM but places it inside a protocol that silently falls back to elliptic-curve Diffie–Hellman when a network attacker modifies the handshake. The mathematical strength of the KEM does not save the system if the protocol permits a downgrade attack. Similarly, a signature scheme with strong theoretical security can still fail if an implementation leaks the private key through timing behavior or faulty randomness.

This is why the subtitle of the book includes both foundations and deployment. We will study the mathematics and definitions, but we will also study the engineering discipline needed to use them safely.

How this book is organized

The first part of the book builds the threat model and vocabulary. Chapter 1 explains what quantum algorithms imply and what they do not imply. Chapter 2 introduces the basic language of cryptography: confidentiality, integrity, authentication, public-key encryption, signatures, adversary models, and hardness assumptions. Chapter 3 explains why symmetric cryptography is affected differently from public-key cryptography.

The second part builds the mathematical and proof foundations. Chapters 4 and 5 introduce the tools needed to read post-quantum designs without treating them as magic: modular arithmetic, probability, linear algebra, polynomial rings, lattices, error distributions, security games, reductions, and standard adversary notions.

The third part studies primitives and families. Chapters 6 and 7 explain KEMs and digital signatures as cryptographic objects. Chapters 8 through 15 then examine major post-quantum families: lattice-based cryptography, ML-KEM, ML-DSA, Falcon and NTRU-style signatures, hash-based signatures, code-based cryptography, multivariate cryptography, and isogeny-based cryptography.

The fourth part turns toward deployment. Chapters 16 through 22 cover standardization, implementation safety, protocol integration, organizational migration, benchmarking, advanced cryptanalysis, and system auditing.

The goal is not to memorize every parameter or every algorithmic detail. The goal is to develop judgment. By the end, you should be able to read a post-quantum proposal or deployment plan and ask useful questions:

• What security problem is this primitive supposed to solve?
• What mathematical assumption does it rely on?
• What is the adversary allowed to do?
• What happens if the random number generator fails?
• How large are the keys, ciphertexts, and signatures?
• Is the implementation constant-time?
• Can the protocol be downgraded?
• How will the system be updated ten years from now?

These are the questions that turn cryptographic knowledge into practical security.

A calm mindset for a difficult transition

Post-quantum cryptography can feel intimidating because it combines abstract mathematics, fast-moving standards, implementation hazards, and long-term organizational planning. A calm approach works better than panic.

The quantum threat is serious, but it is not a reason to abandon disciplined engineering. Post-quantum algorithms are powerful, but they are not magic. Standards are essential, but they do not remove the need for review. Hybrid deployments can reduce transition risk, but they must be designed carefully. Mathematical proofs are valuable, but they do not automatically cover every implementation and protocol detail.

The productive mindset is this:

Understand the threat precisely, choose primitives conservatively, integrate them carefully, measure real-world costs, and preserve the ability to migrate again.

Cryptography has always evolved. DES gave way to AES. MD5 and SHA-1 were retired from many security uses after cryptanalytic progress. RSA key sizes increased, and elliptic-curve cryptography became widely deployed. The post-quantum transition is larger than many previous migrations, but it follows the same broad lesson: secure systems must be designed for change.

This book starts from first principles so that the later technical chapters have a stable foundation. We will move step by step: from the quantum threat, to cryptographic definitions, to mathematical tools, to concrete algorithms, to deployment practice. The subject is deep, but it is learnable.

References

Chen, L., Jordan, S., Liu, Y.-K., Moody, D., Peralta, R., Perlner, R., & Smith-Tone, D. (2016). Report on Post-Quantum Cryptography (NISTIR 8105). National Institute of Standards and Technology.

Grover, L. K. (1996). A fast quantum mechanical algorithm for database search. In Proceedings of the Twenty-Eighth Annual ACM Symposium on Theory of Computing.

NIST. (2024a). FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard. National Institute of Standards and Technology.

NIST. (2024b). FIPS 204: Module-Lattice-Based Digital Signature Standard. National Institute of Standards and Technology.

NIST. (2024c). FIPS 205: Stateless Hash-Based Digital Signature Standard. National Institute of Standards and Technology.

Rescorla, E. (2018). The Transport Layer Security (TLS) Protocol Version 1.3 (RFC 8446). Internet Engineering Task Force.

Shor, P. W. (1994). Algorithms for quantum computation: Discrete logarithms and factoring. In Proceedings of the 35th Annual Symposium on Foundations of Computer Science.