Post-quantum cryptography algorithms: how PQC works, the standards, and a diagram of a hybrid key exchange

Post-quantum cryptography, PQC, is public-key cryptography built on mathematical problems that neither classical nor quantum computers are known to solve efficiently, so that it survives the quantum computers that would break RSA, Diffie-Hellman and elliptic curves. The finalised standards are ML-KEM, a lattice-based key encapsulation mechanism for key exchange, and the signature schemes ML-DSA, lattice-based, and SLH-DSA, hash-based, with the code-based HQC selected as a backup. They run on ordinary hardware and are deployed today in hybrid form, combined with a classical algorithm so that both must be broken to compromise the connection.

The quantum computers guide on this site explains why public-key cryptography needs replacing. This guide explains the replacements: what post-quantum encryption is, the standardised algorithms and the mathematical families they come from, how a lattice-based key exchange works at an intuitive level, how hash-based signatures work, how hybrid key exchange fits into TLS with a diagram in words, and the trade-offs in key size and performance.

What post-quantum encryption is and is not

Post-quantum cryptography is classical cryptography: software running on ordinary processors, using ordinary mathematics. It is not quantum encryption in the physics sense, which the quantum encryption guide on this site distinguishes. The word post-quantum means designed for the era after a quantum computer exists.

It replaces only the public-key parts of the cryptographic stack: key exchange, where two parties agree on a shared secret over an open channel, and digital signatures, where one party proves authorship. Symmetric encryption with AES-256 and hashing with SHA-256 are already considered quantum-resistant and stay as they are. A post-quantum TLS connection therefore still encrypts data with AES or ChaCha20; only the handshake that agrees the key changes.

The standardised algorithms

After a multi-year public competition, the following algorithms have been standardised or selected.

ML-KEM is the workhorse for key exchange and the algorithm you will encounter in TLS. ML-DSA is the general-purpose signature scheme. SLH-DSA is slower with larger signatures but rests on the most conservative assumption, hash function security, and serves where confidence matters more than size. HQC provides a key encapsulation option from a different mathematical family in case lattice problems turn out weaker than believed. Classic McEliece, another code-based scheme with very large public keys, is standardised elsewhere and used in some specialised settings. Each comes in several parameter sets at different security levels.

How lattice-based key exchange works

A lattice is a regular grid of points in a high-dimensional space, generated by adding integer multiples of a set of basis vectors. Certain problems on lattices are hard: given a random point near the lattice, find the closest lattice point; or given a set of linear equations with small random errors added, recover the secret that generated them. The second is the Learning With Errors problem, and it is the foundation of ML-KEM and ML-DSA. No efficient classical or quantum algorithm for it is known, and it has been studied intensively.

ML-KEM, in outline:

1. The receiver picks a random secret vector of small numbers, plus a random public matrix, and computes the matrix times the secret plus a small random error vector. The matrix and the noisy result form the public key; the secret vector is the private key.
2. The sender, wanting to share a session key, picks their own small random values, uses the receiver's public key to compute a ciphertext that encodes a random shared secret, masked by the receiver's noisy public data.
3. The receiver uses the private secret vector to strip away the mask and recover the shared secret; the small errors are designed to be corrected in the process.
4. Both now hold the same shared secret, which is hashed into a session key for AES.

An observer sees the public key and the ciphertext, and recovering the shared secret from them requires solving Learning With Errors. The structure of the lattice, using polynomial rings, keeps keys and ciphertexts around a kilobyte and the arithmetic fast.

How hash-based signatures work

Hash-based signatures use nothing but a hash function. The simplest form, a one-time signature, commits to random values by publishing their hashes and reveals a subset determined by the message to sign it; the verifier hashes the revealed values and checks them against the public commitments. Because revealed values cannot be reused safely, a one-time signature signs one message. SLH-DSA builds a large tree of one-time keys, using hash trees to compress many public keys into one root, and selects keys in a way that makes accidental reuse negligible, giving a scheme that signs many messages. Its security reduces to the hash function alone, which is why it is considered the most conservative option, at the cost of signatures of several kilobytes and slower signing. It suits firmware and software signing, where signatures are verified often and created rarely.

A hybrid key exchange in TLS: the diagram in words

Because post-quantum algorithms are new, deployment combines them with a classical algorithm so that an attacker must break both. In a hybrid TLS 1.3 handshake:

1. The client sends a ClientHello containing two key shares: an elliptic-curve Diffie-Hellman public value, X25519, and an ML-KEM public key, together in a single named group.
2. The server replies with its own X25519 public value and an ML-KEM ciphertext encapsulating a shared secret to the client's ML-KEM key.
3. The client computes the X25519 shared secret from the server's value, and decapsulates the ML-KEM ciphertext with its private key to get the second shared secret.
4. Both sides concatenate the two secrets and feed them into the TLS key schedule, deriving the session keys.
5. Traffic is encrypted with AES-256-GCM or ChaCha20-Poly1305 as usual.

If ML-KEM is later found weak, the X25519 secret still protects the session against classical attackers. If a quantum computer breaks X25519, the ML-KEM secret still protects it. The cost is a few extra kilobytes in the handshake. The TLS guide on this site describes the classical handshake this extends, and this hybrid is what major browsers now negotiate with servers that support it.

Signatures in TLS, the certificates that authenticate the server, remain classical for now, because a forged signature only matters at connection time and certificate infrastructure takes longer to change. Post-quantum certificates are in development.

Trade-offs: size, speed and confidence

Post-quantum algorithms are larger than their elliptic-curve predecessors. An X25519 public key is 32 bytes; an ML-KEM-768 public key is about 1,200 bytes and its ciphertext similar. ML-DSA signatures are around 2 to 4 kilobytes against 64 bytes for an elliptic-curve signature; SLH-DSA signatures range from 8 to nearly 50 kilobytes depending on parameters. This matters for constrained devices, for protocols with tight packet limits, and for certificate chains that carry several signatures. Speed is generally good; ML-KEM is comparable to or faster than elliptic-curve exchange on modern processors.

Confidence is the other dimension. Elliptic curves have decades of scrutiny; lattice schemes have had intense study for about fifteen years and survived the standardisation competition, while some other candidates were broken during it, which is why hybrid deployment and multiple families are considered prudent. Hash-based signatures carry the highest confidence and the largest size.

A six-point summary

1. PQC replaces key exchange and signatures; AES and SHA stay.
2. ML-KEM is the key exchange standard; ML-DSA and SLH-DSA are the signature standards; HQC is a backup.
3. Lattice schemes rest on Learning With Errors; hash-based schemes rest on hash functions alone.
4. Deployment is hybrid: classical plus post-quantum, both needed to break.
5. Keys and signatures are larger; speed is fine.
6. Key exchange is migrating now; signatures and certificates follow.

What standards bodies and cryptographers document

The description above follows the published standards and the research literature.

Standards bodies have published ML-KEM, ML-DSA and SLH-DSA as finalised standards, describing them as derived from the Kyber, Dilithium and SPHINCS+ submissions respectively, and have selected HQC as an additional code-based key encapsulation mechanism, with FN-DSA in progress.

The IETF and browser vendors document hybrid key exchange groups combining X25519 with ML-KEM for TLS 1.3, and report that a large share of connections from current browsers to supporting servers use them.

Cryptographers describe the Learning With Errors problem as the foundation of the lattice-based standards, note that some competition candidates based on other assumptions were broken during evaluation, and recommend hybrid deployment and algorithm diversity while confidence in the new schemes matures.

The maths has changed, the protocols have not

Post-quantum cryptography swaps the hard problem under public-key cryptography from factoring and discrete logarithms to lattices and hashes, keeps everything else, and is already carrying a large share of the web's handshakes in hybrid form. The quantum-safe encryption guide on this site covers how these algorithms are being deployed in practice, and the purpose guide explains why the migration is worth the effort.

Frequently asked questions

Last reviewed and updated on 2026-09-12. Plain text version: /encryption/post-quantum-cryptography.txt.