Encryption & Keys
What Is Post-Quantum Cryptography (PQC)?
Post-quantum cryptography (PQC) is the family of algorithms designed to resist attacks by future quantum computers. A sufficiently large quantum computer running Shor’s algorithm would break RSA and elliptic-curve cryptography — the mathematics behind every TLS certificate in use today — so NIST has standardized quantum-resistant replacements: ML-KEM (Kyber) for key exchange, and ML-DSA (Dilithium) and SLH-DSA (SPHINCS+) for signatures.
Why act before quantum computers exist
The urgency comes from "harvest now, decrypt later": adversaries can record encrypted traffic today and decrypt it once quantum hardware arrives. Data with a long confidentiality life — health records, state secrets, intellectual property — is already exposed to that timeline. Signatures are less urgent (a forged signature only matters in the future), but CA hierarchies and firmware signing keys live for decades, so migration planning starts now.
What is already happening
NIST published FIPS 203 (ML-KEM), 204 (ML-DSA) and 205 (SLH-DSA) in 2024. TLS is deploying hybrid key exchange — X25519 combined with ML-KEM — which Chrome, Firefox and major CDNs already support, protecting the session even if one algorithm falls. Certificates are next: CA/Browser Forum work on PQC certificate profiles is under way, and larger keys and signatures (ML-DSA signatures are kilobytes, not bytes) will stress protocols and devices that assumed small certificates.
What a PKI owner should do now
Build a cryptographic inventory: which systems use RSA/ECC, where do certificates come from, what hardware and software can be upgraded, and what (HSMs, embedded devices) cannot. Demand PQC roadmaps from CA and HSM vendors, favor short certificate lifetimes and automation — the organizations that can rotate everything quickly are the ones for which the PQC migration will be an update, not a crisis.
Try it yourself — free tools
- Certificate Checker — inventory the algorithms and key sizes your current certificates use
- CSR Decoder & Analyzer — check the algorithm and key strength of new certificate requests
How MI Support IT can help
PKI Tools is built by MI Support IT, a Danish IT company with deep specialization in enterprise PKI: ADCS design and health checks, Venafi certificate automation, key ceremonies and CP/CPS documentation. Read about our PKI services or get in touch.
PKI Glossary
- Asymmetric Encryption (Public-Key Cryptography)The public/private key-pair mathematics behind every certificate, signature and TLS handshake.
- Ed25519 (EdDSA)The modern elliptic-curve signature algorithm — small, fast, misuse-resistant, and where it can (and cannot) be used.
- Certificate Lifecycle Management (CLM)The discipline — and tooling — that keeps hundreds of certificates issued, deployed, renewed and revoked without outages.
- Browse all terms →