In computing, there are two major use cases for cryptography: encryption and authentication. Encryption protects data from prying eyes, and authentication prevents bad actors from pretending to be other people.

Most of the encryption architectures computers use today are asymmetric or public keys. These systems use a public key for encryption and a private key for decryption.

The public key is only useful for encrypting data or checking someone's authentication. You can't use the public key to decode a message or pretend to be someone else. Only the second private key can do that.

When you type in your password on most websites, you use a private key to authenticate yourself. The website does some math to check that the private and public keys match before letting you in, without actually making a copy of the private key itself. When you enter your passcode on your phone, you're doing something similar: entering the private key that unlocks your phone's data, which has been encrypted using the public key.

These codes, keys, encryption schemes and authentication schemes are just math problems specifically designed to be difficult for classical computers to solve. Public-key algorithms work well because all those mathematical problems are hard to solve using classical computers—but their solutions are easy to check.

Take the widely-used RSA encryption: the public key is a 2048-bit integer, a huge number. The private key is the prime factor of that number. It's trivial for even a pocket calculator to check the private key against the public key: multiply the factors together. But every star that has ever or will ever burn in this universe will run out of fuel and die before the most powerful classical supercomputers might crack the 2048-bit integer into its component factors and read the encoded message.

Standard methods used in secure key exchange—including RSA and Diffie-Hellman (DH)—have worked well for decades because humanity just hasn't had the tools to break these forms of encryption. That goes as well for elliptic curve cryptography (ECC), the public key encryption technique based on elliptic curve theory, which creates faster, smaller and more efficient key sizes than RSA and DH.  

But classical computers are limited. Only specific algorithms we know run well on their binary processors. Over time, we've come to engineer our society based on the assumption that if a problem can't be solved by using 1s and 0s, it can't be solved at all.

Quantum computers take advantage of quantum mechanics, the study of subatomic particles. These next-generation computing machines represent an entirely new paradigm of computation, setting aside binary bits for the complex computational spaces created by using qubits and solving problems that once seemed impossible.  

Most of the time, this is a good thing. IBM® is building quantum computers to solve the world's most critical problems. (Learn more about how they work on our Topics page “What is quantum computing?”)

However, one of those once-impossible problems is prime factorization. The mathematician Peter Shor showed in 1994 that a sufficiently powerful future quantum computer would be able to find the prime factors of integers much more easily than classical computers. Shor's algorithm was the first algorithm ever developed for quantum computers, and it will one day mean the end of every major public-key encryption system in use.

Symmetric encryption is less secure against classical attacks but is still used for certain purposes (like credit card transactions), and is also under threat. The Advanced Encryption Standard (AES) is the most widely used symmetric encryption algorithm and block cipher. It works on fixed-size data blocks using a symmetric key for encryption and decryption.

Grover's search algorithm (also known as the quantum search algorithm) isn't quite the skeleton key for symmetric cryptography that Shor's is for asymmetric. However, it might aid in brute force attacks and make symmetric cryptography much less secure.

The most important thing to understand about quantum-safe cryptography standards is that they substitute the math problems that are easy for quantum computers to solve with math problems that are difficult for both classical and quantum computers to solve.

In 2016, NIST put out a call for proposals as part of a standardization process. Their goal focused on finding the best quantum-safe algorithms and schemes to become the new cryptographic standards. Organizations all over the world created and submitted schemes—69 in total.⁴

Six years later, NIST officially published the world’s first three post-quantum cryptography standards. IBM researchers, in collaboration with several industry and academic partners, developed two of these post-quantum cryptographic algorithms: ML-KEM (originally  CRYSTALS-Kyber) and ML-DSA (originally CRYSTALS-Dilithium). The third published digital signature scheme, SLH-DSA (initially submitted as SPHINCS+) was co-developed by a researcher who has since joined IBM. Additionally, NIST selected a fourth IBM-developed digital signature algorithm, FN-DSA (originally FALCON), for future standardization. 

Where earlier forms of cryptography relied on factoring large numbers, these new standards rely on lattice problems. To understand a lattice problem, imagine a mathematician showed you a list of 1,000 large numbers. Now, let's say that mathematician showed you an even larger number and told you they made it by adding up 500 numbers from the list. If they asked you to figure out which 500 numbers they used, classical and quantum computers wouldn't be much use in finding the answer. But if the mathematician told you which 500 numbers they used, it would be easy to check whether they were telling the truth. That makes lattice-based problems good replacements for prime factorization problems in cryptography.

The good news is that quantum-safe cryptography already exists. We are so confident in these new standards that we have already built them into IBM z16™ cloud systems, and are working with clients to integrate them into their security infrastructure.

Historically, cybersecurity infrastructure has taken a long time to upgrade, and there is no time to waste.

Quantum computers are progressing quickly. We expect to see the first demonstrations of quantum advantage within the next five years. Most experts agreed in a poll that a quantum computer capable of breaking 2048-bit encryption is likely by the late 2030s.

Ten to 15 years is not a long time. Many critical pieces of cybersecurity infrastructure in government and industry have remained unchanged for decades. Many computers already or soon to be in use will need to work for the next several decades with minimal alterations. Consider the microchip in your car or the encryption schemes that protect passports. There have already been cases in which unknown bad actors stole large batches of encrypted data, possibly to be hoarded and decrypted later using future technology.

Data breaches can go undiscovered. Any data not encrypted using quantum-safe standards today should be considered already lost.

IBM has been a leader in cryptography for decades and is now the global leader in both quantum-safe cryptography and responsible quantum computing. We draw on our deep cryptographic and quantum expertise to position clients to capitalize on the quantum future and navigate it safely.

The individualized IBM Quantum Safe™ program supports clients as they map out their existing cybersecurity and begin to upgrade it for the era of quantum computing. That mapping alone is an important exercise. Most organizations do not have a complete view of what data they hold, where it is most vulnerable or how it is protected. Organizations that go through this process gain better control of their cybersecurity systems and see that their cybersecurity systems become more agile. This positions them to adapt more quickly to future events.