Inside post-quantum cryptography: algorithms, trade-offs, and real-world constraints

Quantum computing has moved well beyond the realm of academic research. Governments, technology companies and cybersecurity leaders are investing billions into developing practical quantum computers, attracted by their potential to solve problems that would take today’s most powerful supercomputers thousands or even millions of years to complete.

While the timeline for large-scale, fault-tolerant quantum computers remains uncertain, the impact on cybersecurity is already shaping technology strategies today. Much of the world’s digital infrastructure still relies on public key cryptography, including RSA and Elliptic Curve Cryptography (ECC), which underpin everything from secure web browsing and software updates to financial transactions and digital identities. These cryptographic systems were designed to withstand attacks from classical computers, but sufficiently powerful quantum computers are expected to break them using algorithms such as Shor’s algorithm.

This emerging threat has made quantum-safe cybersecurity one of the highest priorities for organizations that need to protect sensitive data over the long term.

Fortunately, the cybersecurity industry is not starting from scratch. Years of research have led to the development of post-quantum cryptography (PQC), a new generation of cryptographic algorithms designed to resist attacks from both classical and quantum computers. In August 2024, the US National Institute of Standards and Technology (NIST) finalized its first three PQC standards, marking a significant milestone in the transition to quantum-safe security. These standards include FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA), providing organizations with standardized algorithms for encryption and digital signatures.

However, adopting PQC is not simply a case of replacing one algorithm with another. Every cryptographic algorithm involves trade-offs between security, performance, implementation complexity and deployment requirements. Choosing the right approach depends on the systems being protected, the environments they operate in and the long-term security objectives of the organization.

This article explores the major families of post-quantum cryptography algorithms, the practical compromises involved in deploying them, and why successful quantum cybersecurity depends as much on implementation as it does on mathematics.

Why PQC matters for quantum cybersecurity

Modern digital security depends heavily on public key cryptography. Whether you’re logging into an online banking platform, verifying the authenticity of software updates or establishing encrypted communications, public key algorithms are working behind the scenes.

The challenge is that quantum computers exploit entirely different computational principles from classical computers. Once quantum systems become sufficiently capable, they will be able to solve certain mathematical problems dramatically faster than today’s computers. This includes the integer factorization and discrete logarithm problems that underpin RSA and ECC.

Although cryptographic experts continue to debate exactly when cryptographically relevant quantum computers will become available, most agree that organizations should not wait until that day arrives.

One reason is the growing concern around “harvest now, decrypt later” (HNDL) attacks. In this scenario, attackers collect encrypted data today, store it for years and decrypt it once quantum computers become powerful enough. For organizations handling intellectual property, healthcare records, government information or long-lived customer data, information encrypted today may still need to remain confidential decades into the future.

As a result, leading cybersecurity agencies now recommend beginning the transition to quantum-safe cryptography well before quantum computers become capable of breaking today’s encryption.

The main families of PQC algorithms

Unlike classical public key cryptography, which relies primarily on a handful of mathematical problems, PQC encompasses several distinct families of algorithms. Each offers different strengths, limitations, and implementation characteristics.

Lattice-based cryptography

Lattice-based cryptography has emerged as the leading approach for many real-world applications.

Rather than relying on factorization or discrete logarithms, lattice-based algorithms are built around mathematical problems involving high-dimensional geometric lattices. These problems are believed to remain computationally difficult even for large quantum computers.

The two primary algorithms standardized by NIST, ML-KEM for key establishment and ML-DSA for digital signatures, are both lattice-based.

Their popularity stems from several practical advantages:

  • Strong security assumptions
  • Excellent performance on modern processors
  • Efficient encryption and signing operations
  • Broad applicability across enterprise, cloud and embedded environments

These characteristics have made lattice-based cryptography the foundation of many quantum-safe migration strategies.

However, implementation still requires careful optimization. Public keys, ciphertexts and signatures are often larger than those used in traditional public key cryptography, and performance characteristics can vary depending on hardware architecture, available memory and deployment constraints.

Hash-based signatures

Hash-based cryptography takes a very different approach.

Instead of relying on new mathematical assumptions, hash-based signatures are built using cryptographic hash functions, one of the oldest and most thoroughly studied primitives in modern cryptography.

SLH-DSA, standardized by NIST in FIPS 205, belongs to this family.

Hash-based signatures offer several advantages:

  • Conservative security assumptions
  • A long history of cryptographic analysis
  • Strong confidence in long-term security

Their primary limitation is that they are designed for digital signatures rather than encryption or key establishment. Signature sizes are also typically larger than lattice-based alternatives, making them less suitable for bandwidth-constrained applications.

For organizations prioritizing long-term assurance over performance, however, hash-based signatures remain an important option.

Code-based cryptography

Code-based cryptography is one of the oldest branches of PQC, with research dating back to the late 1970s.

Its strongest advantage is the maturity of its security foundations. Certain code-based problems have resisted decades of cryptanalysis, giving researchers considerable confidence in their resilience.

The trade-off lies in implementation.

Compared with lattice-based algorithms, code-based cryptography often requires substantially larger public keys. While this may be acceptable in some enterprise or infrastructure deployments, it can create challenges for embedded systems, constrained networks and devices with limited storage.

Nevertheless, code-based approaches continue to play an important role in the broader post-quantum ecosystem and remain an active area of research and standardization.

Other approaches

Researchers have also explored several additional mathematical foundations for PQC, including multivariate cryptography, isogeny-based cryptography and other specialized constructions.

Some of these approaches initially appeared highly promising but later proved vulnerable to new cryptanalytic attacks, for example, SIKE (2022). This highlights one of the defining characteristics of modern cryptography: algorithms are continually scrutinized by the global research community, and only the strongest survive years of public analysis.

That process is precisely why NIST’s standardization program has been so important. Rather than selecting algorithms based solely on theoretical performance, it subjected candidates to years of international review before publishing the first production-ready standards.

The result is greater confidence that organizations adopting standardized PQC algorithms are building on some of the most thoroughly evaluated cryptographic research available today.

There is no “best” PQC algorithm

One of the biggest misconceptions surrounding PQC is that there will eventually be a single algorithm that replaces RSA or ECC.

The reality is far more nuanced.

Every cryptographic algorithm involves trade-offs. Some prioritize performance, while others are designed around conservative security assumptions. Some are well suited to cloud environments with abundant computing resources, while others need to operate within the strict memory and power constraints of embedded devices.

Choosing the right algorithm means understanding the environment in which it will operate.

Some of the key considerations include:

  • Security strength: Does the algorithm provide the required level of protection against both classical and quantum attacks?
  • Key and signature sizes: Larger keys or signatures can affect storage, bandwidth and network performance.
  • Processing speed: Authentication and encryption should not introduce noticeable delays for users or systems.
  • Memory requirements: Resource-constrained devices may have only a few kilobytes of available memory.
  • Power consumption: Battery-powered and industrial devices need highly efficient cryptographic operations.
  • Implementation complexity: Simpler implementations can reduce development effort and security risks.
  • Side-channel resilience: Algorithms must be implemented to resist attacks that exploit power consumption, timing or electromagnetic emissions.

Rather than asking, “Which algorithm is best?”, organizations should ask, “Which algorithm best fits this application?”

That distinction is critical when developing a long-term post-quantum cybersecurity strategy.

Performance is only one part of the picture

Cryptographic benchmarking often focuses on metrics such as encryption speed or signature generation. While these measurements are useful, they rarely reflect the complexity of real-world deployments.

For example, a cloud server processing thousands of encrypted connections per second has very different requirements from:

  • An automotive electronic control unit (ECU)
  • A secure element inside a payment card
  • An industrial IoT sensor
  • A software update mechanism for connected devices
  • A semiconductor root of trust

Each environment introduces different constraints that influence algorithm selection.

An enterprise server may prioritize throughput and scalability.

An embedded device, by contrast, may prioritize:

  • Minimal RAM usage
  • Small code footprint
  • Low energy consumption
  • Long product lifecycles
  • Hardware acceleration

This is why optimization has become such an important aspect of PQC.

Developing an efficient algorithm is only part of the challenge. Successfully integrating that algorithm into existing hardware and software architectures often requires significant engineering expertise to maintain performance while strengthening security.

Real-world constraints drive deployment decisions

As organizations begin planning their migration to quantum-safe security, implementation considerations often outweigh theoretical ones.

Some of the most common deployment challenges include:

1. Legacy infrastructure

Many organizations operate systems that were never designed with cryptographic agility in mind.

Applications may depend on legacy protocols, proprietary hardware or software that is difficult to modify. Updating these environments requires careful planning to avoid disrupting existing services.

2. Embedded and resource-constrained devices

Devices used in automotive, industrial IoT, healthcare and consumer electronics often have strict limits on processing power, memory and storage.

In these environments, every kilobyte matters.

Optimized implementations help ensure PQC can be deployed without significantly increasing hardware requirements or reducing battery life.

3. Long product lifecycles

Some products remain in service for 10, 20 or even 30 years.

Industrial control systems, aerospace platforms and medical devices may still be operating long after today’s cryptographic standards have evolved.

Organizations therefore need solutions that support future updates rather than assuming today’s algorithms will remain unchanged indefinitely.

4. Interoperability

Migration rarely happens all at once.

During the transition, organizations often need classical and PQC to coexist.

Hybrid cryptography allows existing systems to maintain compatibility while gradually introducing quantum-resistant algorithms, helping reduce operational risk during migration.

Cryptographic agility is the foundation of quantum cybersecurity

The shift to PQC should not be viewed as a one-time upgrade.

Instead, it represents an opportunity to build greater cryptographic agility across an organization’s technology estate.

Cryptographic agility is the ability to replace or update cryptographic algorithms without requiring major changes to applications, hardware or infrastructure.

This flexibility is increasingly important because cryptography continues to evolve.

New standards emerge.

Implementation guidance improves.

Additional algorithms may be standardized in the future.

Organizations that build cryptographic agility into their systems today will be better positioned to respond to future developments with minimal disruption.

For this reason, many cybersecurity leaders recommend focusing not only on today’s standardized algorithms but also on creating architectures that can adapt over time.

Standards are only the beginning

The publication of NIST’s first PQC standards represents a major milestone, but standardization is not the same as deployment.

Successfully implementing quantum-safe cryptography requires much more than selecting an approved algorithm.

Organizations must also consider:

  • Secure software implementation
  • Hardware optimization
  • Side-channel attack protection
  • Interoperability with existing systems
  • Regulatory compliance
  • Performance testing
  • Validation and certification
  • Long-term maintenance

Poor implementation can undermine even the strongest cryptographic algorithm.

For example, side-channel attacks exploit information leaked through timing, power consumption or electromagnetic emissions rather than attacking the mathematics itself. Protecting against these attacks requires specialist implementation techniques, such as constant-time implementations, particularly in hardware and embedded environments.

As a result, organizations increasingly need partners that understand not only cryptographic theory but also the practical realities of deploying post-quantum security across complex technology ecosystems.

Looking beyond the algorithm

The transition to quantum-safe security is often described as an algorithm replacement exercise. In reality, it is much broader than that.

Organizations need to understand:

  • Which cryptographic assets they currently rely on
  • Where vulnerable algorithms are deployed
  • How those algorithms interact with existing infrastructure
  • Which systems require long-term protection
  • How future updates can be delivered securely

This process is often referred to as cryptographic inventory or cryptographic discovery, and it forms the foundation of an effective migration strategy.

Without visibility into existing cryptography, replacing vulnerable algorithms becomes significantly more difficult.

Building a practical quantum cybersecurity strategy

Quantum computing represents one of the most significant technological shifts facing cybersecurity in decades. While practical quantum computers capable of breaking today’s public key cryptography are still under development, the transition to quantum-safe security is already underway.

Organizations do not need to panic, but they do need to plan.

The publication of standardized post-quantum algorithms provides confidence that the industry now has trusted building blocks for the future. The next challenge is selecting, optimizing and deploying those algorithms in ways that meet real-world performance, security and operational requirements.

Ultimately, successful quantum cybersecurity requires balancing security with performance, embracing cryptographic agility, and recognizing that implementation quality is just as important as algorithm selection.

Organizations that begin preparing today will be far better positioned to protect their systems, data and customers throughout the quantum era.

Preparing for quantum cybersecurity starts with the right strategy. Whether you’re assessing your cryptographic landscape, planning your migration or optimizing post-quantum implementations, PQShield can help you build a practical path to quantum-safe security. Talk to our experts today.