Chapter 1 — Quantum and post-quantum security: foundations and decisions
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 Locks and seals"]
N2["1.2 What a quantum computer is"]
N3["1.3 What would and would not break"]
N4["1.4 Two kinds of risk with different timing"]
N5["1.5 The new standards"]
N6["1.6 Hybrid protection"]
N7["1.7 Deciding how much it matters: Lab M"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 Locks and seals"]
N2["1.2 What a quantum computer is"]
N3["1.3 What would and would not break"]
N4["1.4 Two kinds of risk with different timing"]
N5["1.5 The new standards"]
N6["1.6 Hybrid protection"]
N7["1.7 Deciding how much it matters: Lab M"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 Locks and seals]
|
v
[1.2 What a quantum computer is]
|
v
[1.3 What would and would not break]
|
v
[1.4 Two kinds of risk with different timing]
|
v
[1.5 The new standards]
|
v
[1.6 Hybrid protection]
|
v
[1.7 Deciding how much it matters: Lab M]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) explain in plain words what encryption and digital signatures do; (2) describe what a quantum computer is and what it could break; (3) explain "harvest now, decrypt later" and "forge later"; (4) name the new post-quantum standards; (5) explain hybrid protection; and (6) make a first, sensible decision for a small organization.
1.1 Locks and seals
When you visit a web shop, your browser and the shop agree on a secret key that nobody else knows, then use it to scramble (encrypt) everything you send. This is like two people agreeing on a combination for a lock box while strangers listen — and still keeping it secret. The method that lets them do this is called public-key cryptography. The same family of methods also makes digital signatures: seals that prove a message, a website or a software update really came from who it says. Today's public-key methods have names like RSA and elliptic curves. A different family, symmetric encryption such as AES, does the bulk scrambling once the key is agreed.
1.2 What a quantum computer is
Ordinary computers use bits that are 0 or 1. Quantum computers use qubits, which follow the rules of quantum physics and can be combined in ways that let certain calculations run very differently. They are not simply faster computers; for most tasks — spreadsheets, websites, games — they bring no benefit. But for a few special mathematical problems they could be dramatically faster. One of those problems is exactly what RSA and elliptic curves rely on. In 1994 Peter Shor described a quantum method (published in a journal in 1997) that would break them on a large enough, reliable quantum computer. Such a machine does not exist yet, and experts disagree about when, or whether, it will.
1.3 What would and would not break
If a large, reliable quantum computer were built, it could work out the secret keys behind RSA and elliptic-curve cryptography. That would let an attacker read traffic protected by those methods and forge signatures. Symmetric encryption such as AES-256 and fingerprints (hashes) such as SHA-256 would remain strong. So the problem is specific: the "agree a secret" and "sign" parts of today's systems need replacing; the bulk encryption does not.
For Bluebird Bakery Online this means the card payments, the online shop's connections and the staff portal logins could all be affected one day, because they rely on agreeing keys and on signatures. The files themselves, once encrypted with AES, would stay safe. That is why the bakery's later actions focus on providers' key-agreement and signature plans rather than on its stored files.
1.4 Two kinds of risk with different timing
Harvest now, decrypt later: someone records scrambled traffic today, stores it, and unlocks it years later once a quantum computer exists. This only matters for information that must stay private for many years — medical details, contracts, identity documents, payroll. Forge later: once a quantum computer exists, someone could fake digital seals — for example, a fake software update. This matters most for things that must be trusted for a long time.
At the bakery, payroll files and customer accounts are the information most exposed to the first risk, because they must stay private for many years. The second risk matters for things like software updates on the tills or the oven controller, which rely on signatures to prove they are genuine. Order confirmations are useful only for months, so neither risk matters much for them.
1.5 The new standards
In August 2024 the US National Institute of Standards and Technology (NIST) published three new standards designed to resist quantum computers: FIPS 203 (ML-KEM, for agreeing secret keys), FIPS 204 (ML-DSA, for signatures) and FIPS 205 (SLH-DSA, also for signatures). They are called post-quantum cryptography: ordinary software designed to resist future quantum attacks. NIST has also published a draft plan, IR 8547, proposing that the old methods be phased out after 2030 and stopped after 2035; because it is a draft, those dates may change.
1.6 Hybrid protection
During the changeover, many systems use both an old and a new method together, so that an attacker would have to break both. This is called hybrid protection (RFC 9794 defines the terms). Modern web browsers and many websites already use a hybrid method called X25519MLKEM768 (RFC 10024) to agree keys. If you use an up-to-date browser, some of your connections are probably already protected this way.
1.7 Deciding how much it matters: Lab M
A simple rule from Michele Mosca (2018) helps decide what to worry about. Add how many years information must stay private (x) to how many years it takes to change systems (y). If that total is more than the number of years until a capable quantum computer exists (z), the information is already at risk. Nobody knows z, so try several guesses.
# Lab M (ch 1): Mosca's inequality x + y > z for synthetic Bluebird Bakery Online data, sweeping z.
assets = [ # (name, shelf-life x in years, migration time y in years) - synthetic
("customer accounts", 10, 2), ("supplier contracts", 7, 1), ("order confirmations", 0.5, 1), ("staff payroll files", 12, 2)]
for z in (10, 15, 20): # years until a cryptographically relevant quantum computer: an assumption, not a forecast
late = [n for n, x, y in assets if x + y > z]
print(f"z={z:>2}: at risk now -> {', '.join(late) if late else 'none'}")
Expected output:
z=10: at risk now -> customer accounts, staff payroll files
z=15: at risk now -> none
z=20: at risk now -> none
With a guess of ten years, customer accounts and payroll files would be at risk; with fifteen or twenty, nothing at the bakery would be. The sensible conclusion is not panic, but: keep software and services up to date so the bakery benefits from new protections as providers adopt them, and ask the providers holding long-lived data what their plans are.
1.8 Worked example
Priya asks: "Should I buy a 'quantum-proof' security box I saw advertised?" Answer: "No. There is no such thing as 'quantum-proof', and the protection that matters for us comes from the software our providers run. The new standards are already appearing in browsers and web services. Our job is to keep devices updated, use reputable providers and ask the ones holding customer and payroll data about their post-quantum plans."
Notice what the answer avoids: it does not promise the bakery is safe, and it does not suggest spending money now. It names the two kinds of data that matter most and the people who control them. A good first decision for a small organization is usually about asking the right questions of providers, not about buying equipment.
1.9 Practice activities
- Write a three-sentence explanation of quantum risk for a friend who is not technical. 2. Find one news article about quantum computers and underline any claim that sounds exaggerated. 3. Re-run Lab M in your head with z = 8: which items would be at risk?
For the first activity, test your explanation on the friend and note any word they did not understand. For the second, compare the article's claims with what you learned here: does it say all encryption breaks, or give one firm date? For the third, check each item by adding its two numbers and comparing the total with 8.
1.10 Common mistakes
- Saying quantum computers "break all encryption" — symmetric encryption and hashes remain strong.
- Quoting a single date for when quantum computers will arrive.
- Buying products marketed as "quantum-proof".
- Treating draft dates as final rules.
Each mistake has a short correction. Say which methods are at risk: key agreement and signatures, not bulk encryption. Give ranges for timing, and say they are guesses. Ask what a product actually does instead of trusting a label. And when you mention the 2030 and 2035 dates, say they come from a draft.
Exercises
- EX001 — Lock and seal. In one sentence each, explain what encryption and a digital signature do. Rubric: 3 = both accurate and plain.
- EX002 — Not a faster laptop. Explain why a quantum computer would not make a bakery's spreadsheet faster. Rubric: 3 = only special problems benefit.
- EX003 — What breaks. Which of RSA, AES-256, elliptic curves and SHA-256 would a large quantum computer break? Rubric: 3 = RSA and elliptic curves only.
- EX004 — Harvest now. Describe harvest-now-decrypt-later in your own words. Rubric: 3 = record now, unlock later, matters for long-lived secrets.
- EX005 — Forge later. Give one example of forge-later risk. Rubric: 3 = fake signed update or website, explained.
- EX006 — Which data. Which bakery data needs protection for many years: order confirmations, payroll files, today's menu? Rubric: 3 = payroll files, with reason.
- EX007 — Standards. Name the three 2024 NIST post-quantum standards and what each is for. Rubric: 3 = FIPS 203 key agreement; 204 and 205 signatures.
- EX008 — Draft. Is IR 8547 a final rule? Explain in one sentence. Rubric: 3 = draft proposing dates.
- EX009 — Hybrid. Explain hybrid protection in one sentence. Rubric: 3 = old and new together, both must be broken.
- EX010 — Mosca. With x = 7 and y = 1 (supplier contracts), at which guesses of z would they be at risk? Rubric: 3 = z below 8 years.
- EX011 — Myth. Correct: "Quantum computers can already read all internet traffic." Rubric: 3 = no such machine yet; only some methods vulnerable.
- EX012 — Advice. Give Priya two sensible actions. Rubric: 3 = updates, ask providers (or similar).
- EX013 — Quantum-proof. Why should "quantum-proof" claims make you cautious? Rubric: 3 = undefined claim, no guarantees, marketing.
Synthesis
Quantum computers, if built at scale, would break today's methods for agreeing keys and signing, but not bulk encryption. New NIST standards and hybrid protection are already rolling out. For most organizations, the sensible decision is calm: protect long-lived information first, keep systems updated and ask providers about their plans.