Post-Quantum Cryptography Solutions
What is Post - Quantum Cryptography?
Post-quantum cryptography (PQC) comprises algorithms and protocols designed to resist quantum computer attacks. They remain compatible with current computing systems and support the transition from quantum-vulnerable algorithms such as RSA, Elliptic Curve Cryptography (ECC), and Diffie-Hellman.
The Quantum Threat: Why Action Must Begin Now
Current public-key cryptographic algorithms, including RSA, ECC, and Diffie–Hellman, rely on mathematical problems that are difficult for classical computers to solve. Future quantum computers could overcome these challenges, potentially compromising existing encryption and digital security systems. The threat of “harvest now, decrypt later” makes early preparation essential, as attackers may collect encrypted data today to decrypt it when quantum technology advances.
Organizations should start preparing for Post-Quantum Cryptography (PQC) by identifying vulnerable cryptographic systems, prioritizing sensitive and long-term data, and planning a phased transition to hybrid cryptographic environments. This includes adopting NIST-standardized PQC algorithms such as ML-KEM, ML-DSA, and SLH-DSA to strengthen security against emerging quantum threats.
Learn more about today's top security risks in the 2026 Thales Data Threat Report: Quantum & AI Trends
Post-Quantum readiness Starts with Crypto-Agility
Crypto-agility is a business strategy that enables you to future-proof your organization by:
- Having the flexibility to quickly change protocols, keys, and algorithms
- Using flexible, upgradeable technology
- Reacting quickly to cryptographic threats, such as Quantum computing
- Adding to your tech stack with minimal to no disruption
Thales products have been purposely designed to help you be crypto-agile and Quantum-safe.
Building a Future-Proof Post-Quantum Strategy
Securing an enterprise against quantum threats requires cybersecurity solutions that support Quantum Resistant Algorithms (QRA), and also offer options for Quantum Key Distribution (QKD) and Quantum Random Number Generation (QRNG). Thales is committed to delivering solutions that support a Post-Quantum crypto agile strategy.
Quantum Random Number Generation
QRNG is a high bit rate random number source harnessing the inherent randomness in quantum mechanics to create encryption keys
Quantum Resistant Algorithms
QRAs are fundamental to protecting against quantum attacks whether Lattice based, Multivariate, Hash based, or Code-based cryptography
Quantum Key Distribution
QKD distributes encryption keys between shared parties based on the principles of quantum physics and the properties of quantum mechanics
Questions our customers often ask
How does post-quantum cryptography work?
Post-quantum cryptography (PQC) modernizes quantum-vulnerable public-key cryptography such as RSA, ECC, Diffie-Hellman, and DSA with new algorithms designed to resist attacks from future quantum computers. Instead of relying on factorization or discrete logarithms, PQC uses different mathematical approaches that are intended to remain secure in a post-quantum world. NIST’s first finalized PQC standards are ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205).
PQC is mainly used to replace the public-key cryptography that protects TLS handshakes, PKI hierarchies, certificates, code signing, firmware signing, and machine identities. During migration, many organizations will use hybrid cryptography allowing classical and post-quantum algorithms to coexist to maintain interoperability during rollouts.
What are the risks if our organization does not migrate to PQC?
If your organization does not migrate to PQC, today’s public-key algorithms such as RSA and ECC will eventually become vulnerable to quantum attacks. This creates a “harvest now, decrypt later” (HNDL) risk, where encrypted data captured today can be decrypted in the future once cryptographically relevant quantum computers are available.
The risk is highest for long-lived systems and trust models, including PKI, root and intermediate certificate authorities, code signing, firmware signing, IoT, industrial control systems, and medical devices. Without a clear PQC migration strategy, organizations face long-term data exposure, broken trust chains, supply chain risk, and growing regulatory pressure.
Why do organizations need to start PQC migration now?
Organizations need to start PQC migration now because the transition is already underway. NIST has finalized the first PQC standards, and its transition guidance is intended to help industry and government move away from quantum-vulnerable cryptography. NSA’s CNSA 2.0 guidance also gives organizations a clear signal to plan, budget, and prepare now rather than wait.
The bigger issue is time; PQC migration is not a simple algorithm swap. Certificates, firmware, applications, embedded systems, and cryptographic dependencies often live for years. Waiting too long compresses testing, rollout, vendor coordination, and compliance into a much riskier and more expensive project.
How can I prepare for post-quantum cryptography migration?
Start by identifying where quantum-vulnerable cryptography is used across applications, infrastructure, certificates, APIs, firmware, networks, and machine identities. Then prioritize high-risk assets such as long-lived sensitive data, external-facing systems, trust anchors, and signing environments. NIST’s migration guidance is specifically meant to inform timelines and transition planning for products, services, and infrastructure.
Next, build a crypto-agile migration plan. Most organizations will need phased, hybrid deployments so classical and PQC algorithms can coexist during the transition. Strong key management, certificate lifecycle management, governance, and testing are essential to make cryptographic change manageable over time.
What technologies are required to support PQC?
Supporting PQC requires both new algorithms and modern cryptographic infrastructure. At a minimum, organizations should evaluate support for ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205), as well as hybrid cryptographic operations for transitional environments.
Hardware Security Modules (HSMs), key management systems, PKI platforms, certificate lifecycle tools, and cryptographic APIs all play a role. HSMs are especially important because they secure key generation, storage, and signing operations, and PQC-ready platforms increasingly need support for hybrid keys and certificates, crypto agility, and the new NIST algorithms.
Network encryption can also play an important role in PQC readiness, especially for protecting long-lived or high-value data in motion during multi-year migrations. High Speed Encryptors (HSE) help reduce exposure to “harvest now, decrypt later” risk on critical network links and backbones, and can provide a crypto-agile foundation that supports evolving standards and profiles over time. In some environments, organizations may also integrate complementary technologies such as quantum key distribution (QKD) or high-quality entropy sources (e.g., QRNG) alongside standards-based PQC approaches.
