Chapter 19 — Quantum and post-quantum security: scope and theory
Lesson map
Lesson 19 published. Map, example, EX037.
flowchart TD
N0["Learning outcomes"]
N1["19.1 Scope"]
N2["19.2 PQC versus QKD"]
N3["19.3 Mosca's inequality"]
N4["19.4 Practical activity — Lab M"]
N5["19.5 Standards and transition status"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX037"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["19.1 Scope"]
N2["19.2 PQC versus QKD"]
N3["19.3 Mosca's inequality"]
N4["19.4 Practical activity — Lab M"]
N5["19.5 Standards and transition status"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX037"]
[Learning outcomes]
|
v
[19.1 Scope]
|
v
[19.2 PQC versus QKD]
|
v
[19.3 Mosca's inequality]
|
v
[19.4 Practical activity — Lab M]
|
v
[19.5 Standards and transition status]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX037]
Learning outcomes
You will (1) define the scope of quantum and post-quantum security; (2) state Mosca's inequality and apply it with swept assumptions; (3) distinguish post-quantum cryptography from quantum key distribution; and (4) summarise the status of NIST standards and transition guidance.
19.1 Scope
The field covers four questions. What can quantum computers do to cryptography? (Shor breaks RSA, Diffie–Hellman and elliptic curves; Grover weakens symmetric search quadratically.) What replaces vulnerable algorithms? (Post-quantum cryptography: classical algorithms believed to resist quantum attack.) How do organizations migrate? (Inventory, prioritisation, hybrid deployment, agility.) And what role, if any, for quantum communication technologies such as quantum key distribution (QKD)? This book concentrates on the first three, because PQC runs on today's computers and networks.
QKD is discussed briefly below.
19.2 PQC versus QKD
PQC algorithms such as ML-KEM are software and hardware implementations of mathematical schemes; they work over any network. QKD uses quantum states of light to establish keys and needs dedicated links and trusted nodes, and it still needs classical authentication. The NSA has stated that it does not support QKD for national security systems and recommends quantum-resistant algorithms instead. For an organization like HCU, PQC is the practical path.
HCU's links run over leased lines and the internet, where QKD would need new infrastructure.
19.3 Mosca's inequality
Mosca (2018) gave the field its planning rule. Let x be how long data must stay secure, y how long migration takes and z how long until a cryptographically relevant quantum computer (CRQC) exists. If x + y > z, you are already late for that data. Because z is unknown, sweep it: decisions that are correct across a plausible range of z are robust.
For HCU, the archive's thirty years make the left side large whatever value of the migration time is chosen. Even if a CRQC were forty years away, a migration taking more than ten years would leave some archive data exposed. The inequality turns an unanswerable question, when will the machine arrive, into a usable one: for which data does the answer not matter?
19.4 Practical activity — Lab M
# Lab M (ch 19): Mosca's inequality x + y > z for synthetic Harbourline Credit Union data, sweeping z.
assets = [ # (name, shelf-life x in years, migration time y in years) - synthetic
("mortgage archive", 30, 4), ("member records", 10, 3), ("card authorisation", 0.01, 5), ("branch VPN traffic", 7, 2)]
for z in (10, 15, 20): # years until a cryptographically relevant quantum computer: an assumption, not a forecast
late = [n for n, x, y in assets if x + y > z]
print(f"z={z:>2}: at risk now -> {', '.join(late) if late else 'none'}")
Expected output:
z=10: at risk now -> mortgage archive, member records
z=15: at risk now -> mortgage archive
z=20: at risk now -> mortgage archive
Card authorisation messages are short-lived, so they drop out; the mortgage archive is at risk under every assumption in the sweep. That is the robust conclusion.
The lab sweeps the unknown arrival time across three values and, for each, prints the HCU data classes whose confidentiality lifetime plus migration time exceeds it. Member records appear only under the shortest assumption, so their status depends on the uncertain date; the mortgage archive appears under all three. Classes that change status within the sweep are where the date really matters, and those need closer judgment and regular review as estimates change. Classes that never appear, such as card messages, can wait for routine upgrades.
19.5 Standards and transition status
FIPS 203, 204 and 205 are final (August 2024). SP 800-227 gives recommendations for using KEMs. NIST's draft IR 8547 proposes deprecating 112-bit-security quantum-vulnerable algorithms after 2030 and disallowing quantum-vulnerable public-key algorithms after 2035; as a draft, it signals direction rather than binding dates. FN-DSA (FIPS 206) and a standard based on HQC were in development on 12 October 2026. RFC 9794 defines terminology for post-quantum/traditional (PQ/T) hybrid schemes.
HCU tracks these documents with their status and the date checked.
19.6 Worked example
HCU's board asks for a one-slide answer. "Quantum computers capable of breaking our public-key cryptography do not exist today and their date is uncertain. Our mortgage archive must stay confidential for 30 years, so recorded transfers are at risk under any plausible timeline; we will protect those flows first with hybrid post-quantum key exchange, following NIST's 2024 standards. Signatures and devices follow a planned schedule aligned with NIST's draft transition guidance."
The slide avoids a predicted date, states the requirement that drives urgency and names the first action. Board members can challenge any part, and each part points to evidence in the plan. A follow-up slide lists what the board will hear about each quarter.
19.7 Common errors and limits
- Quoting a single CRQC date as fact.
- Presenting QKD as a drop-in replacement for PQC.
- Treating IR 8547's draft dates as final.
Published estimates of when a CRQC might exist vary widely and change as research advances, so a single date gives false confidence. QKD needs special hardware and dedicated links, solves only key distribution and still needs classical authentication. Draft guidance invites comment and may change before publication. Each mistake makes a plan look firmer than the evidence allows, and the plan breaks when the assumption does.
Exercises
- EX037 — Mosca. For member records with x = 10 and y = 3, for what values of z is HCU already late? Rubric: 3 = z < 13 with reasoning.
- EX038 — PQC or QKD. Give two reasons why HCU should prioritise PQC over QKD for branch links. Rubric: 3 = infrastructure and authentication/guidance reasons.
Synthesis
Quantum and post-quantum security asks what quantum computers break, what replaces it and how to migrate. Mosca's inequality, swept over uncertain timelines, ranks data; FIPS 203/204/205 provide the replacements.
Continue studying — chapter 19 of 40
← Chapter 18 (draft) · Course chapter index · Chapter 20 (draft) →