The Evolution from Classical to Post-Quantum Cryptography

The internet has been through this before: a protocol that worked well enough until it didn't, followed by a painful migration to something built for a world that had moved on.

An upgrade the web already made

In the early days of the internet, HTTP did the job. Browsers asked, servers answered, and data moved across the wire without ceremony. The problem was that anyone watching the wire could read everything on it. As the internet grew and the value of what it carried grew with it, that openness became a liability. HTTPS didn't replace HTTP out of a theoretical concern about what attackers might someday do. It replaced HTTP because attackers were already exploiting the gap, and the consequences were real.

The shift was not painless. It required new standards, new tooling, and a long period in which both protocols coexisted. Eventually enough pressure, social and regulatory, made HTTPS the expectation rather than the exception. We went through the transition period, and the web is materially more secure for it.

Cryptography is in an earlier version of the same story right now.

Classical cryptography and the quantum problem

The algorithms that protect most of what we do online today, RSA and elliptic curve cryptography chief among them, are built on mathematical problems that classical computers find practically intractable. Factoring the product of two large primes, or solving the discrete logarithm problem, requires computation at a scale that makes brute-force attacks economically and practically impossible with current hardware. The security holds not because the problems are theoretically unsolvable, but because solving them costs more than it is worth.

Quantum computers change that calculation. The architecture of a sufficiently powerful quantum machine allows it to approach certain problem classes in fundamentally different ways, and the mathematical problems underpinning RSA and ECC happen to fall squarely within the class that quantum algorithms can collapse. A capable quantum computer running Shor's algorithm could break encryption that would take classical hardware millions of years to crack. The protection that classical cryptography provides does not degrade gradually in a quantum world; it disappears.

That is not a near-term emergency. Quantum computers capable of breaking production cryptography at meaningful key sizes do not exist yet, and the engineering challenges between here and there remain substantial. But "not yet" is the operative phrase, and the preparation required for a cryptographic migration takes years, not months.

Post-quantum cryptography as the answer

Post-quantum cryptography, commonly shortened to PQC, is the field of developing cryptographic algorithms that remain secure against both classical and quantum attackers. The problems these algorithms are built on, lattice-based structures, hash functions, code-based mathematics, are ones where quantum computers do not appear to have a decisive advantage over classical machines. The goal is not to wait for quantum computers to arrive and then respond; it is to be ready before that becomes necessary.

The analogy to HTTPS holds here too. HTTPS did not eliminate HTTP overnight. The two protocols coexisted for years, with HTTPS taking over incrementally as the urgency became clearer and the tooling matured. Classical cryptography will follow the same trajectory: still present and operational in many contexts, but supplemented and eventually replaced by PQC algorithms where the stakes are highest and the data lifetimes longest.

That last point matters more than it might seem. Encrypted data captured today can be decrypted later once a capable quantum machine exists. Organizations protecting data with long-term sensitivity, government records, financial instruments, health data, intellectual property with multi-decade value, face a threat that is not contingent on quantum computers being available right now. The migration window for those use cases is already shorter than it looks.

What the transition involves

Standardization is the first requirement, and that work is underway. NIST has been driving a multi-year process to evaluate and standardize PQC algorithms, selecting candidates across multiple mathematical approaches to avoid concentration risk in any single one. The standards provide the foundation on which tooling, libraries, and ultimately widespread adoption can be built.

From there the pattern echoes the HTTP-to-HTTPS shift: a transition period in which both classical and quantum-resistant systems coexist, incremental adoption starting with the highest-sensitivity applications, and eventually a new baseline. The transition will require coordination across vendors, standards bodies, and organizations at every scale, which is part of why starting early matters even when the threat is not yet immediate.

The underlying argument is the same one that drove HTTPS: do not wait until the attack is common before building the defense. The web learned that lesson. The broader cryptographic ecosystem is learning it now. For more on the broader quantum security horizon, see Navigating the Quantum Shift and Emerging Cybersecurity Trends in 2024.