Quantum-Safe Cryptography

Relies on the computational hardness of lattice problems like Learning With Errors (LWE) and Ring-LWE. These schemes construct trapdoor functions over high-dimensional algebraic lattices where finding the shortest vector or closest vector is intractable even for Shor's algorithm. CRYSTALS-Kyber (NIST-standardized for KEM) and CRYSTALS-Dilithium (for signatures) are prime examples, offering small key sizes and fast operations compared to other post-quantum families.

Construct digital signatures solely from the security of cryptographic hash functions, making them well-understood and conservative choices. Stateful schemes like LMS and XMSS require tracking a one-time signature index to prevent key reuse, while stateless schemes like SPHINCS+ eliminate state management at the cost of larger signatures. NIST standardized both XMSS and LMS for firmware signing, and SPHINCS+ for general use.

Builds on the difficulty of decoding a general linear code, a problem proven NP-complete. The McEliece cryptosystem uses a scrambled, permuted Goppa code as a public key, with the secret trapdoor enabling efficient decoding. Its primary advantage is long-standing confidence—unbroken since 1978—but its public keys are typically hundreds of kilobytes, limiting use to applications where key size is not a primary constraint.

Based on the hardness of solving systems of multivariate quadratic equations over finite fields, an NP-hard problem. Signatures like Rainbow (a NIST finalist, later broken) and GeMSS use a hidden structure that allows the signer to invert a polynomial map efficiently. While fast and compact, many multivariate schemes have been cryptanalyzed, making parameter selection and conservative design critical for long-term security.

Uses the mathematical structure of elliptic curve isogenies—rational maps between elliptic curves. SIKE (Supersingular Isogeny Key Encapsulation) was a NIST finalist until a devastating key-recovery attack in 2022. The approach offers the smallest key sizes of any post-quantum family, but active research continues to establish confidence in the underlying hardness assumptions and defend against structural attacks.

Combine a classical algorithm (e.g., ECDH with Curve25519) and a post-quantum algorithm (e.g., Kyber-768) into a single key exchange or signature. The output is secure as long as at least one scheme remains unbroken. This provides a pragmatic migration path: organizations gain quantum resistance immediately while retaining classical fallback security, avoiding a hard cutover that could introduce implementation risk.

A class of post-quantum algorithms whose security relies on the hardness of lattice problems like Learning With Errors (LWE). These problems remain computationally infeasible even for cryptographically relevant quantum computers running Shor's algorithm.

• CRYSTALS-Kyber: NIST-standardized for key encapsulation
• CRYSTALS-Dilithium: NIST-standardized for digital signatures
• Resists both classical and quantum attacks simultaneously

A quantum-resistant digital signature scheme built solely on the security of cryptographic hash functions rather than number-theoretic assumptions. The Merkle Signature Scheme (MSS) and its stateful variants provide strong non-repudiation for audit log entries.

• SPHINCS+: NIST-standardized stateless hash-based signature
• LMS/HSS: Stateful schemes approved for firmware signing
• Security reduces directly to hash function collision resistance

Post-quantum cryptographic systems based on the difficulty of decoding random linear codes, a problem known to be NP-hard. The McEliece cryptosystem, proposed in 1978, remains unbroken against both classical and quantum adversaries.

• Classic McEliece: NIST round 4 finalist for KEM
• Uses Goppa codes with extremely large public keys
• Provides conservative long-term security margin

Schemes based on the difficulty of solving systems of multivariate quadratic equations over finite fields, a problem proven NP-hard. Primarily used for signature schemes requiring very short signatures.

• Rainbow: Fast signing and verification with compact signatures
• Vulnerable to recent structural attacks; caution warranted
• Suitable for low-latency audit log signing in constrained environments

A transitional security strategy combining classical and post-quantum algorithms in parallel during key exchange or signing. If either scheme remains secure, the overall system maintains confidentiality and integrity.

• X.509 hybrid certificates: Contain both ECC and lattice keys
• TLS 1.3 hybrid key exchange: ECDHE + Kyber simultaneously
• Ensures backward compatibility while preparing for quantum threats

A key exchange protocol based on navigating isogeny graphs between supersingular elliptic curves. While offering very small key sizes, SIKE was broken in 2022 using a classical attack on smooth-degree isogenies.

• Demonstrates the evolving cryptanalysis landscape
• Emphasizes need for conservative parameter selection
• Active research continues on isogeny-based constructions