Chapter 1 — Security foundations for practitioners | Professional Quantum and post-quantum security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 01 published. Map, example, EX001.

flowchart TD
  N0["Learning outcomes"]
  N1["1.1 What changes and what does not"]
  N2["1.2 The replacements"]
  N3["1.3 Two risks with different clocks"]
  N4["1.4 Hybrid key exchange"]
  N5["1.6 Practice task"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX001"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["1.1 What changes and what does not"]
  N2["1.2 The replacements"]
  N3["1.3 Two risks with different clocks"]
  N4["1.4 Hybrid key exchange"]
  N5["1.6 Practice task"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX001"]

[Learning outcomes]
    |
    v
[1.1 What changes and what does not]
    |
    v
[1.2 The replacements]
    |
    v
[1.3 Two risks with different clocks]
    |
    v
[1.4 Hybrid key exchange]
    |
    v
[1.6 Practice task]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX001]

Learning outcomes

You will (1) explain what quantum computers threaten in cryptography and what they do not; (2) name the NIST post-quantum standards and their status; (3) distinguish harvest-now-decrypt-later from forge-later risk; (4) explain hybrid key exchange in plain terms; and (5) avoid common misstatements in reports.

1.1 What changes and what does not

Today's systems rely on two kinds of cryptography. Symmetric cryptography (such as AES) encrypts data with a shared key and hash functions (such as SHA-256) fingerprint data; these remain strong against known quantum attacks at current sizes. Public-key cryptography (RSA, elliptic curves) lets systems agree keys and sign data without a prior shared secret; a large error-corrected quantum computer running Shor's algorithm (Shor, 1997) would break it. No such computer exists today and nobody knows when one will; public estimates of the resources needed have fallen over time (for example Gidney, 2025), which is why organizations are planning now.

1.2 The replacements

In August 2024 NIST published three standards: FIPS 203 (ML-KEM) for agreeing keys, FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for signatures. SP 800-208 covers stateful hash-based signatures for specialised uses such as firmware. NIST's IR 8547 is an initial public draft proposing that quantum-vulnerable algorithms be deprecated after 2030 and disallowed after 2035 — proposed dates, not yet final rules. FN-DSA and a standard based on HQC were in development.

1.3 Two risks with different clocks

Harvest now, decrypt later: an adversary records encrypted traffic today and decrypts it once a quantum computer exists. This matters now for data that must stay confidential for many years — for MTI, life-policy records (40 years) and claims records (10 years). Forge later: once a quantum computer exists, an adversary could forge signatures, certificates and software updates. This matters most for things trusted for a long time, such as root certificates, signed archives and devices that cannot be updated.

Ask data owners which records fall under each clock before ranking anything.

1.4 Hybrid key exchange

During the transition, systems combine a post-quantum method with a traditional one so an attacker would need to break both. This hybrid approach (terminology in RFC 9794) is now available in common web software as the TLS group X25519MLKEM768 (RFC 10024). Hybrid key exchange protects the confidentiality of sessions; it does not by itself make certificates or signatures post-quantum.

For MTI this means the broker portal's recorded sessions are protected once hybrid is negotiated, but the portal's RSA-2048 certificate still needs its own plan.

1.5 Worked example

A draft status report says: "Our website is now quantum-proof because we enabled Kyber." Corrected: "The broker portal now uses hybrid post-quantum key exchange (X25519MLKEM768, based on ML-KEM from NIST FIPS 203) for connections from up-to-date browsers. This protects recorded portal traffic against future decryption. The portal's certificate still uses a classical signature; certificate migration is planned separately."

Note what the correction does. It names the service, the algorithm and its standard, says which clients benefit, states what is protected, and says plainly what is not yet done. It also drops "Kyber", the pre-standard name, in favour of ML-KEM. Use the same pattern whenever a team reports progress to you.

1.6 Practice task

Rewrite three sentences from a vendor brochure or news article about quantum security so that they are accurate, sourced and appropriately cautious.

For each sentence, record the original, your rewrite and the source you used to check it. Look for three typical faults: claims of permanence such as "quantum-proof", draft dates presented as rules, and hybrid key exchange described as if it also covered certificates. Where a claim cannot be checked, say so instead of guessing. Keep the rewrites; they become your accurate explainer for the portfolio.

1.7 Common errors and limits

"Quantum-proof" or "unbreakable" claims.
Treating IR 8547's draft dates as final.
Saying hybrid key exchange makes the whole system post-quantum.

Each error costs credibility later. An MTI report that called the portal "quantum-proof" would be contradicted by the first auditor who looked at its classical certificate. A plan built on IR 8547's proposed 2030 and 2035 dates as fixed law would need rewriting if the final text changes. Check every status report against these three before it leaves your desk. Ask a colleague to read it too.

Exercises

EX001 — Keep or replace. Classify AES-256, RSA-2048, SHA-256 and ECDSA P-256. Rubric: 3 = four correct with reasons.
EX002 — Standards. Name the three 2024 NIST standards and what each is for. Rubric: 3 = FIPS 203 ML-KEM key establishment; FIPS 204 ML-DSA and FIPS 205 SLH-DSA signatures.
EX003 — Two clocks. Give one MTI example each of HNDL and forge-later risk. Rubric: 3 = correct, explained examples.
EX004 — Draft status. Write one accurate sentence about IR 8547's dates. Rubric: 3 = draft, proposal, years.
EX005 — Correct the claim. Correct: "Hybrid TLS makes our certificates quantum-safe." Rubric: 3 = separates key exchange from authentication.

Synthesis

Quantum computers threaten public-key key agreement and signatures, not symmetric encryption. NIST's 2024 standards provide replacements; hybrid key exchange addresses harvest-now-decrypt-later now, while signatures follow a planned path.

Continue studying — chapter 01 of 12

← Course home · Course chapter index · Chapter 02 (draft) →