The Global Centre for Risk and Innovation (GCRI)
Post-quantum cryptography replaces public-key algorithms that a future quantum computer could break with new classical algorithms designed to resist it. NIST has published standards, protocols are being updated, and organizations face a long migration across software, hardware and certificates. This page sets out the new algorithms, how migration is planned and measured, and what evidence serves the organizations and agencies carrying it out.
GCRI · In development · service level R0
Post-quantum cryptography is a family of classical algorithms designed to resist attack by quantum computers, now standardised by NIST in FIPS 203, 204 and 205. They rely on new hard problems, often use larger keys, are deployed in hybrid modes during transition and reward systems built for crypto-agility.
For post quantum cryptography, in GCRI's spatial-intelligence reading, the map opens on night lights, population density and true-colour imagery with true colour from NASA GIBS, framed on Japan and Korea; every other NASA layer, live feed and forecast waits in the layer list.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 3
Connected activity, for this page
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
For post quantum cryptography, in GCRI's spatial-intelligence reading, the map opens on night lights, population density and true-colour imagery with true colour from NASA GIBS, framed on Japan and Korea; every other NASA layer, live feed and forecast waits in the layer list.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place; claim ceiling INTEGRATED.
Layers and dates
The working screen behind this subject: its structure, terms and states. Names are placeholders and values illustrative.
Post quantum cryptography · Crypto inventory · Wave 3
| Archive signing | RSA-2048 | 29 | ML-DSA hybrid | Piloting |
| VPN gateway | ECDH | 8 | ML-KEM hybrid | Planned |
| Payments HSM | RSA-3072 | 11 | Vendor roadmap | Blocked |
| Web TLS | ECDHE | 2 | Hybrid key exchange | Done |
Transition security and algorithm standards. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Post-quantum algorithms rely on mathematical problems, such as those on lattices or hash functions, for which no efficient quantum attack is known.
Many post-quantum schemes use larger keys or signatures than current ones, affecting bandwidth, storage and constrained devices.
Combining a classical and a post-quantum algorithm keeps security if one is later broken, a common choice during transition.
Systems designed to swap algorithms easily reduce the cost of this migration and the next one.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| ML-KEM | A lattice-based key encapsulation mechanism standardised by NIST in FIPS 203. |
| Lattice-based cryptography | Cryptography built on mathematical problems involving high-dimensional lattices that are believed hard for quantum computers. |
| Key encapsulation mechanism | A method for securely establishing a shared secret key between parties. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Standardised post-quantum algorithms | count | per standard release | NIST and other standards bodies | OFFICIAL |
| Protocols with post-quantum support specified | count | per assessment | IETF and other standards | OFFICIAL |
| Web traffic using post-quantum key agreement | percent of connections | monthly | Network measurements | OBSERVED |
| Organizations with migration plans | percent of surveyed organizations | per survey | Surveys | REPORTED |
| Cryptanalysis results against candidate schemes | count of significant attacks | per review | Cryptographic literature | REPORTED |
| Validated implementations | count | annual | Cryptographic module validation lists | OFFICIAL |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| NIST post-quantum cryptography project and FIPS 203, 204 and 205 | Standards, documentation and additional selections | Public domain, US government |
| IETF post-quantum and hybrid protocol work | Integration into TLS, SSH and other protocols | Open, IETF Trust terms |
| National cyber agency migration guidance | Timelines and priorities | Public, terms per agency |
| Open Quantum Safe project | Open-source implementations for testing | Open source, MIT licence |
| Cloudflare Radar and similar measurements | Adoption in web traffic | Public, terms per provider (to check) |
Quantum Technologies prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Organizations and security teams | Which systems to migrate first and how | Planning guides; performance comparisons |
| Standards bodies | Which algorithms and parameters to standardise | Cryptanalysis evidence |
| Vendors | When and how to ship post-quantum support | Adoption and protocol evidence |
Migration questions start with an inventory.
Today's public-key cryptography rests on mathematical problems, such as factoring large numbers, that are hard for classical computers but could be solved efficiently by a large quantum computer running known algorithms. Symmetric encryption and hash functions are much less affected and can be strengthened by using longer keys. The urgent problem is therefore key exchange and digital signatures.
Two pressures drive timing. The harvest-now, decrypt-later threat means confidential data intercepted today could be read once a capable machine exists. Migration time is long: cryptography is embedded in hardware, firmware, protocols and supply chains, and some devices stay in service for decades. If the time data must stay secret plus the time migration takes exceeds the time until a capable quantum computer exists, data is already at risk.
| Method or data | What it shows | Limits |
|---|---|---|
| Cryptographic inventory and discovery tools | Where vulnerable algorithms are used | Embedded and third-party cryptography is easily missed |
| Cryptanalysis of candidate algorithms | Confidence in algorithm security | New algorithms have less analysis history; some candidates were broken during evaluation |
| Performance and interoperability testing | Key sizes, speed and protocol fit | Results vary with hardware and implementation |
| Risk-based migration planning | Priorities by data lifetime and system criticality | Depends on uncertain quantum timelines |
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.