Post-quantum encryption refers to cryptographic algorithms designed to resist attacks from both classical computers and quantum computers. Unlike today’s widely deployed standards such as RSA and elliptic-curve cryptography, these algorithms are built on mathematical problems, such as lattice problems, that no known quantum algorithm can solve efficiently.
Why Current Encryption Will Eventually Fail
Today’s public-key cryptography relies on the computational difficulty of factoring large numbers or solving discrete logarithm problems. A sufficiently powerful quantum computer running Shor’s algorithm would render those problems trivial, making RSA-2048, ECC and Diffie-Hellman key exchange fundamentally insecure.
The critical word is “sufficiently powerful.” Quantum computers that can break production-grade encryption do not yet exist. But this is precisely why the window for action is now, not later.
Dustin Moody, the mathematician leading NIST’s Post-Quantum Cryptography Standardization project, has stated directly: “The transition to post-quantum cryptography is urgent. Adversaries are already collecting encrypted data today to decrypt once a sufficiently powerful quantum computer becomes available.”
What NIST Has Already Standardized
In August 2024, NIST finalized three post-quantum cryptography standards: FIPS 203, FIPS 204 and FIPS 205. These represent the first official replacements for classical public-key encryption and digital signatures.
| Standard | Algorithm | Purpose |
|---|---|---|
| FIPS 203 | ML-KEM | Key encapsulation (replaces RSA/ECDH for data encryption) |
| FIPS 204 | ML-DSA | Digital signatures (replaces ECDSA) |
| FIPS 205 | SLH-DSA | Digital signatures (hash-based, stateless alternative) |
ML-KEM, the algorithm defined in FIPS 203, is the primary standard for most enterprise use cases. It protects data in transit and at rest by replacing the key exchange step that RSA and Diffie-Hellman currently handle. Modern TLS implementations and several major VPN platforms have already added ML-KEM support.
The European Union Agency for Cybersecurity (ENISA) has similarly warned that “quantum computing poses a serious threat to existing cryptographic algorithms, and organizations that delay migration risk exposing sensitive data retroactively.”
The Regulatory Landscape Is Accelerating
Regulation has not yet mandated specific algorithms, but the direction is clear. In May 2022, the White House issued National Security Memorandum 10, directing US federal agencies to inventory their cryptographic systems and begin migration planning, with an initial deadline tied to 2025. While this applies to US government entities, it sets a benchmark that enterprise procurement and compliance teams in Europe are watching closely.
Under GDPR Article 32 and the NIS2 Directive (EU 2022/2555), organizations must implement “state-of-the-art” technical security measures. As NIST standards become the recognized benchmark, regulators and auditors will increasingly treat the absence of a post-quantum migration roadmap as a gap in that standard of care. DPOs in particular should note this trajectory.
A 2023 Deloitte survey found that more than half of organizations had not yet started assessing their exposure to quantum-related cryptographic risk, a figure that underscores the gap between awareness and action.
What Decision-Makers Should Do Now
The gap between “quantum computers don’t exist yet” and “we have time” is a dangerous one. Migration to post-quantum encryption is not a software update. It involves auditing every system that uses public-key cryptography, including VPNs, email gateways, document signing, authentication tokens and cloud storage APIs.
Concrete steps for IT managers and CISOs include:
- Conduct a cryptographic inventory: identify every system, protocol and certificate that relies on RSA, ECC or Diffie-Hellman.
- Classify data by longevity: data that must remain confidential beyond 2030 requires the most urgent attention.
- Prioritize TLS and key exchange layers first: ML-KEM is already available in OpenSSL 3.x and is supported in hybrid mode alongside classical algorithms, reducing migration risk.
- Demand post-quantum roadmaps from vendors: any cloud workspace, storage or collaboration platform procured today should have a documented post-quantum migration plan. Providers running managed Nextcloud Enterprise environments, such as Qsentinel, address this at the infrastructure level, removing the operational burden from the customer.
- Update your cryptographic policy documentation to reference FIPS 203 and ENISA guidance as your forward standard.
The hybrid approach, running ML-KEM alongside classical algorithms simultaneously, is the practical starting point for most organizations. It preserves compatibility with systems that have not yet migrated while introducing quantum resistance for data leaving the network today.
Frequently Asked Questions
What is the difference between post-quantum encryption and quantum encryption?
Post-quantum encryption uses classical computers to run mathematical algorithms that quantum computers cannot break efficiently. Quantum encryption (such as quantum key distribution) uses quantum physics itself to transmit keys. The two are often confused, but post-quantum encryption runs on standard hardware today, while quantum key distribution requires specialized physical infrastructure.
Which post-quantum algorithm should my organization prioritize?
NIST recommends ML-KEM (FIPS 203) for key encapsulation, meaning protecting data in transit and at rest. It is the primary standard for general-purpose encryption and is already supported in recent versions of major TLS and VPN implementations.
When will quantum computers actually be able to break RSA or ECC?
Current consensus places a cryptographically relevant quantum computer, one powerful enough to break 2048-bit RSA, no earlier than the early 2030s. Timelines are genuinely uncertain. The key risk is the harvest-now-decrypt-later attack vector: data encrypted today can be stored and decrypted later once that capability exists.
Does GDPR or NIS2 require post-quantum encryption?
Neither GDPR nor the NIS2 Directive mandates a specific algorithm by name. Both require state-of-the-art technical measures, however. As NIST standards are finalized and ENISA updates its guidance, regulators are increasingly likely to treat the absence of a migration roadmap as a failure to meet that standard of care.
Can a managed Nextcloud environment support post-quantum encryption today?
Yes. Nextcloud Enterprise can be configured with post-quantum-ready TLS stacks using ML-KEM in hybrid mode. Managed providers who control the full infrastructure stack can apply these updates without requiring the customer to manage cryptographic configuration directly.
Hoe Qsentinel dit oplost
Qsentinel is the managed Nextcloud Enterprise workspace, enhanced by Qsentinel with post-quantum encryption and sovereign private AI, hosted in Switzerland or on-premise, out of reach of the CLOUD Act.