Quantum-safe encryption (also called post-quantum or quantum-resistant encryption) protects data confidentiality against attacks by both today's computers and future quantum computers. As organizations face the reality of "Harvest Now, Decrypt Later" (HNDL) attacks, implementing quantum-safe encryption has become an urgent priority.
This guide explains the quantum threat to encryption, walks through implementation strategies using NIST-approved algorithms, and provides practical steps for protecting your organization's most sensitive data.
The HNDL Threat is Real
Nation-state adversaries are actively capturing encrypted data today with the intention of decrypting it once quantum computers become available. Data with long confidentiality requirements (10+ years) is at immediate risk.
Understanding the Quantum Encryption Threat
To understand quantum-safe encryption, we must first understand what quantum computers threaten and what remains secure.
What Quantum Computers Can Break
Shor's algorithm, running on a cryptographically-relevant quantum computer (CRQC), will break:
- RSA (all key sizes) - Used for key exchange and signatures
- ECDH/ECDSA (all curves) - Used for key exchange and signatures
- Diffie-Hellman - Used for key exchange
- DSA - Used for digital signatures
What Remains Secure
Symmetric encryption algorithms resist quantum attacks (with doubled key sizes for equivalent security):
- AES-256 - Provides ~128-bit post-quantum security
- ChaCha20-Poly1305 - Remains secure with 256-bit keys
- SHA-256/SHA-3 - Hash functions remain quantum-resistant
Encryption Vulnerability Summary
RSA Key Exchange
Completely broken by Shor's algorithm regardless of key size.
AES-256 Alone
Symmetric encryption is safe, but key exchange typically uses vulnerable algorithms.
ML-KEM + AES-256
Post-quantum key exchange combined with symmetric encryption provides full protection.
Quantum-Safe Encryption Architecture
A complete quantum-safe encryption system combines post-quantum key encapsulation with symmetric encryption:
Hybrid Encryption Flow
Why Hybrid Encryption?
During the transition period, NIST and security agencies recommend hybrid encryption that combines classical and post-quantum algorithms:
- Defense in depth: If either algorithm is broken, the other maintains security
- Regulatory compliance: Many frameworks still require proven classical algorithms
- Gradual transition: Allows incremental adoption without full replacement
Implementation Approaches
Data in Transit (TLS)
For network communications, enable hybrid key exchange in TLS 1.3:
# Enable hybrid post-quantum key exchange in TLS
ssl_protocols TLSv1.3;
ssl_ecdh_curve X25519Kyber768Draft00:X25519:P-256;
# Prefer PQC-enabled cipher suites
ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;Major browsers and servers are adopting hybrid PQC:
- Chrome/Edge: X25519Kyber768 enabled by default since 2024
- Firefox: Hybrid PQC support in progress
- Cloudflare/AWS: Hybrid PQC available for TLS termination
Data at Rest
For stored data, use ML-KEM to wrap encryption keys:
import oqs
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.hkdf import HKDF
import os
def quantum_safe_encrypt(plaintext, recipient_public_key):
# Encapsulate a shared secret using ML-KEM-768
kem = oqs.KeyEncapsulation("ML-KEM-768")
ciphertext_kem, shared_secret = kem.encap_secret(recipient_public_key)
# Derive AES key from shared secret
hkdf = HKDF(algorithm=hashes.SHA256(), length=32,
salt=None, info=b"quantum-safe-encryption")
aes_key = hkdf.derive(shared_secret)
# Encrypt data with AES-256-GCM
nonce = os.urandom(12)
aesgcm = AESGCM(aes_key)
ciphertext_data = aesgcm.encrypt(nonce, plaintext, None)
return ciphertext_kem + nonce + ciphertext_dataKey Management
Quantum-safe encryption requires updated key management practices:
| Component | Classical Approach | Quantum-Safe Approach |
|---|---|---|
| Key Encapsulation | RSA-2048, ECDH P-256 | ML-KEM-768 (hybrid with X25519) |
| Symmetric Encryption | AES-128-GCM | AES-256-GCM (doubled for PQ security) |
| Key Derivation | HKDF-SHA256 | HKDF-SHA256 (remains secure) |
| Digital Signatures | RSA-2048, ECDSA P-256 | ML-DSA-65 (hybrid with Ed25519) |
What to Encrypt First
Not all data requires immediate quantum-safe protection. Prioritize based on:
High Priority: Immediate Action Required
Medium Priority: Plan for Migration
Vendor and Platform Support
Major technology vendors are actively deploying quantum-safe encryption:
| Vendor/Platform | Status | Algorithms |
|---|---|---|
| Google Chrome | Production (default) | X25519Kyber768 in TLS |
| Cloudflare | Production | Hybrid PQC for all customers |
| AWS | Preview/Production | s2n-tls with hybrid PQC |
| Signal | Production | PQXDH protocol |
| Apple iMessage | Production | PQ3 protocol |
| OpenSSL 3.x | Available (oqs-provider) | All NIST standards |
Frequently Asked Questions
Next Steps
Begin your quantum-safe encryption journey with these actions:
- Assess your encryption landscape - Use our Cryptographic Inventory Guide to document current encryption usage
- Identify high-priority data - Apply the prioritization framework above to classify data by quantum risk
- Enable hybrid TLS - Update web servers and load balancers to support post-quantum key exchange
- Update key management - Prepare HSMs and key management systems for post-quantum algorithms
- Test thoroughly - Validate compatibility with clients, partners, and legacy systems
The QRAMM framework provides comprehensive guidance for each stage of your quantum-safe migration.