By late October 2025, more than half of the human-generated web traffic reaching Cloudflare was already protected by post-quantum key agreement, according to the company’s State of the post-quantum Internet in 2025 report. Most of the people generating that traffic had no idea. Their browser negotiated it silently, using a hybrid scheme that pairs an old elliptic-curve exchange with a new lattice-based one.
That is the strange shape of the post-quantum transition so far. One half of the problem, protecting data in transit against future decryption, has quietly gone mainstream. The other half, the digital signatures and certificates that prove a server is who it claims to be, has barely started. And the deadline governments have set for finishing both is 2035.
No quantum computer today can break anything. The reason the migration is urgent anyway comes down to a single, uncomfortable observation about how long encrypted data stays interesting.
What Shor’s algorithm actually breaks
Almost all public-key cryptography in use rests on two problems that classical computers find hard: factoring very large numbers, which underpins RSA, and computing discrete logarithms, which underpins Diffie-Hellman key exchange and elliptic curve cryptography including ECDSA and X25519.
In 1994 the mathematician Peter Shor showed that a sufficiently large, sufficiently reliable quantum computer could solve both of those problems efficiently. Not faster in the way a better laptop is faster, but in a fundamentally cheaper complexity class. A machine running Shor’s algorithm against RSA-2048 does not brute-force it. It factors the modulus directly.
Symmetric cryptography is in far better shape. Grover’s algorithm offers a quadratic speedup against brute-force search, which effectively halves the security level of a symmetric key, but doubling the key length restores the margin. NIST’s transition guidance reflects this: in NIST IR 8547, AES and the SHA-2 and SHA-3 hash families require no transition and are treated as meeting post-quantum security categories. The crisis is specifically a public-key crisis.
Harvest now, decrypt later
Here is the part that makes 2035 a real deadline rather than a distant one. An adversary does not need a quantum computer today to benefit from one tomorrow. They need storage.
Capture encrypted traffic now, archive it, and decrypt it whenever the hardware arrives. Anything with a long confidentiality lifetime is exposed: medical records, government communications, source code, trade secrets, sealed legal material, genomic data. A Federal Reserve working paper on post-quantum risk to distributed ledger networks makes the point sharply for blockchains, where the ledger is public by design: upgrading the network protects future transactions but does nothing for the historical record already copied and stored.
The standard way to reason about this is Mosca’s theorem. Take X, the number of years your data must stay confidential. Add Y, the number of years your migration will take. If X plus Y is greater than Z, the years until a capable quantum computer exists, you already have a problem. Most large organizations estimate Y at five to ten years, which is why the planning cannot wait for certainty about Z.
How close is the hardware, honestly
Nobody knows, and anyone giving you a confident date is guessing. What has changed is the resource estimate.
In 2019, Google researcher Craig Gidney and a co-author estimated that factoring RSA-2048 would need roughly 20 million noisy qubits. In a 2025 paper, Gidney revised that down to fewer than a million noisy qubits running for under a week, roughly an order of magnitude improvement. That is not evidence a machine is imminent. It is evidence that the target keeps getting closer through better algorithms rather than better hardware alone.
The caveats are substantial and worth stating. The 2025 estimate assumes error rates and surface-code cycle times beyond current engineering, and the paper is a preprint. Existing quantum computers are nowhere near a million usable qubits. The honest reading is that the threat is credible, not scheduled. The 2024 Quantum Threat Timeline expert survey, cited in that Federal Reserve paper, found roughly one in three experts expecting a cryptographically relevant machine before 2032, which tells you as much about disagreement in the field as about timing.
The finalized NIST standards and their exact names
NIST ran an open competition from 2016 and published the first three finished standards on 13 August 2024. The algorithms were renamed on standardization, which causes endless confusion, so here are both names side by side.
| Standard | Designation | Original submission | Purpose | Status |
|---|---|---|---|---|
| FIPS 203 | ML-KEM | CRYSTALS-Kyber | Key encapsulation (general encryption) | Final, August 2024 |
| FIPS 204 | ML-DSA | CRYSTALS-Dilithium | Digital signatures (primary) | Final, August 2024 |
| FIPS 205 | SLH-DSA | SPHINCS+ | Hash-based signatures (backup) | Final, August 2024 |
| FIPS 206 | FN-DSA | FALCON | Compact lattice signatures | In development as of 2026 |
| Not yet numbered | HQC | HQC | Backup key encapsulation, code-based | Selected March 2025; draft expected 2026 |
ML-KEM stands for Module-Lattice-Based Key-Encapsulation Mechanism, ML-DSA for Module-Lattice-Based Digital Signature Algorithm, and SLH-DSA for Stateless Hash-Based Digital Signature Algorithm. Each comes in parameter sets tied to a security level: ML-KEM-512, ML-KEM-768 and ML-KEM-1024, and ML-DSA-44, ML-DSA-65 and ML-DSA-87.
NIST selected HQC as a fifth algorithm on 11 March 2025, documented in NIST IR 8545. The reasoning is diversification. ML-KEM rests on lattice problems, and if a structural weakness in lattices were ever found, an entirely different mathematical foundation would be needed as a fallback. HQC is code-based and provides that independence, at the cost of larger keys and slower operation.
The deadlines that actually bind
Three sets of dates matter for North American and UK organizations.
NIST IR 8547, issued as an initial public draft in November 2024, sets the technical retirement schedule. RSA and elliptic-curve algorithms at the 112-bit security level are deprecated after 2030. All classical public-key algorithms for signatures and key establishment, including RSA, ECDSA, EdDSA and Diffie-Hellman at every security level, are disallowed after 2035.
NSM-10, the US National Security Memorandum on quantum, sets 2035 as the target for migrating federal systems, and NIST IR 8547 aligns to it.
NSA’s CNSA 2.0 suite applies to National Security Systems and is more aggressive in places. Its published timeline requires software and firmware signing to use approved quantum-resistant algorithms exclusively by 2030, networking equipment such as VPNs and routers by 2030, and web browsers, servers, cloud services and operating systems by 2033, with everything complete by 2035. CNSA 2.0 specifies ML-KEM and ML-DSA at their highest parameter sets, plus AES-256, SHA-384 or SHA-512, and the stateful hash-based schemes LMS and XMSS for firmware signing.
In the UK, the NCSC published PQC migration timelines on 20 March 2025 with three checkpoints: by 2028, complete a discovery exercise and build a migration plan; by 2031, finish the highest-priority migrations protecting critical assets; by 2035, complete migration across all systems, services and products.
Hybrid key exchange is already deployed
The practical mechanism carrying the transition is hybrid key agreement. Rather than replacing the classical algorithm, browsers and servers run both and combine the results, so the session stays secure as long as at least one of them holds. If the new lattice scheme turns out to have a flaw, the elliptic-curve half still protects you; if a quantum computer arrives, the lattice half does.
The dominant construction is X25519MLKEM768, which pairs X25519 with ML-KEM-768. Chrome moved from an experimental Kyber-based pairing to standardized ML-KEM in Chrome 131, and Cloudflare reports the hybrid is now enabled by default across major browsers and operating systems and supported in OpenSSL and Go.
Messaging moved early too. Signal added PQXDH to protect session establishment, then on 2 October 2025 announced the Sparse Post-Quantum Ratchet, which extends quantum resistance across the whole life of a conversation rather than just its opening handshake. SPQR uses ML-KEM-768 and splits the unusually large key material into chunks spread across messages, so the protocol does not balloon in size.
Signatures and certificates are the hard part
Key agreement was easy to deploy because it is negotiated fresh on every connection and involves only two parties. Certificates are not. They involve certificate authorities, root programs, hardware security modules, audit regimes and a decade of embedded devices with hardcoded trust stores.
Cloudflare’s 2025 assessment was blunt about the gap: substantial post-quantum key agreement adoption exists with no publicly trusted post-quantum certificates deployed at all. CA/Browser Forum approval was still pending as of late 2025, HSM support and audits remain bottlenecks, and while the first post-quantum certificates were expected in 2026, broad browser trust before 2027 looked unlikely.
There is a size problem too. ML-DSA signatures and public keys are considerably larger than ECDSA equivalents, and TLS handshakes carry several signatures and certificates. That inflation is why FN-DSA, the more compact FALCON-based scheme headed for FIPS 206, is still wanted despite ML-DSA already being standardized.
What this means for your organization
Migration is mostly an inventory and procurement problem, not a mathematics problem. The realistic sequence looks like this.
- Build a cryptographic inventory first. You cannot migrate what you cannot find. That means algorithms, key sizes and certificate expiry dates across applications, appliances, embedded devices, code-signing pipelines and third-party integrations. A cryptographic bill of materials is the artifact most programs are missing at the start.
- Rank by data shelf life, not by system importance. Apply Mosca’s theorem per data set. A system holding records that must stay confidential for 25 years is more urgent than a busier system whose data is worthless in six months.
- Turn on hybrid key agreement wherever it is free. Modern TLS terminators, CDNs and VPN products increasingly support X25519MLKEM768 with a configuration flag. This is the cheapest risk reduction available against harvest-now-decrypt-later.
- Put crypto-agility in procurement contracts. Ask vendors which FIPS-standardized algorithms they support, on what timeline, and whether algorithms can be swapped without replacing hardware. Long-lived hardware roots of trust are the items NCSC specifically flags as needing early attention.
- Do not roll your own. Use vetted library implementations. Side-channel resistance in lattice cryptography is subtle and actively researched.
- Plan certificate work separately and later. Signature migration depends on an ecosystem that does not yet exist. Prepare for it, but do not block key-agreement progress waiting for it.
Frequently asked questions
Does my personal data need protecting now?
For most individuals, the browser and messaging apps are already handling it. If you use an up-to-date browser and Signal or iMessage, hybrid post-quantum protection is likely on by default. There is no consumer action required beyond keeping software current.
Are the NIST standards trustworthy given they were partly designed with NSA input?
The candidates were public, the cryptanalysis was open, and several submissions were broken publicly during the process, including SIKE in 2022. That transparency is the strongest argument for the results. Reasonable cryptographers still disagree about parameter choices, and NIST’s decision to standardize a non-lattice backup in HQC reflects that lattice assumptions are not universally trusted.
Will quantum computers break Bitcoin?
The signature scheme Bitcoin uses is elliptic-curve based and would be vulnerable to a capable quantum computer. The network can change algorithms, but the Federal Reserve paper’s point stands: public keys already exposed on the historical ledger cannot be retroactively protected.
What if I just wait until 2033?
Two problems. Data you transmit today can be captured today, so waiting does not protect anything with a long confidentiality life. And discovery alone routinely takes large organizations more than a year, before a single system is changed.
A decade of plumbing, starting now
The post-quantum transition is not going to look like a moment. There will be no morning where RSA stops working. It looks like what already happened with TLS 1.2, or the IPv6 migration that is still running: a long grind of inventories, vendor pressure, firmware updates and configuration flags, punctuated by a few deadlines that force the laggards.
The encouraging part is that the first half is genuinely working. Hybrid key agreement went from a Cloudflare experiment to majority browser traffic in about three years, without users noticing. The discouraging part is that the second half, the certificate ecosystem, has more moving parts and less momentum, and 2035 is closer than it sounds when the work is measured in supplier contracts and hardware refresh cycles.
If your organization has not started a cryptographic inventory, that is the task for this quarter. Everything else in the migration depends on it.
Sources
- NIST — NIST Releases First 3 Finalized Post-Quantum Encryption Standards
- NIST CSRC — Post-Quantum Cryptography Standardization project
- NIST — IR 8547 (initial public draft), Transition to Post-Quantum Cryptography Standards
- NSA — Commercial National Security Algorithm Suite 2.0 (CNSA 2.0)
- UK NCSC — Timelines for migration to post-quantum cryptography
- Cloudflare — State of the post-quantum Internet in 2025
- Signal — Signal Protocol and Post-Quantum Ratchets
- Google Security Blog — A new path for Kyber on the web
- Federal Reserve — “Harvest Now Decrypt Later”: Examining Post-Quantum Risks (FEDS working paper)
- The Quantum Insider — Google Researcher Lowers Quantum Bar to Crack RSA Encryption
- Utimaco — NIST announces HQC as fifth algorithm to be standardized
Image credit: Photo: Anita Fors (Chalmers) — CC BY-SA 4.0 (via Wikimedia Commons)
