Post-quantum cryptography: exploring
cryptographic algorithms resistant to
quantum attacks
Introduction
Quantum computing poses a serious threat to the cryptography that
underpins much of modern digital security and transactions online.
Traditional algorithms like RSA and elliptic curve cryptography would be
vulnerable to attacks from powerful quantum computers that are on the
horizon. This has prompted significant interest and research into alternative
“post-quantum” cryptographic algorithms that are resistant even to quantum
attacks. This paper will explore some of the leading candidates for post-
quantum cryptography and analyze their strengths and weaknesses.
Traditional vs. Quantum-Safe Encryption
Traditional public-key encryption algorithms like RSA and elliptic curve
cryptography rely on the computational difficulty of factoring large prime
numbers and discrete logarithm problems respectively. However, Peter Shor
devised quantum algorithms in 1994 that can solve these problems
efficiently on a sufficiently powerful quantum computer. Some estimates
suggest quantum computers with around 50-100 qubits could break RSA-
2048 and many elliptic curve schemes.
While building large-scale fault-tolerant quantum computers is still a major
technical challenge, there is reasonable expectation that they may become a
reality within the next 10-30 years according to various projections. Even
before that, smaller non-error corrected quantum devices may be able to run
algorithms like Shor’s to crack some cryptographic keys. This poses risks
both for stored encrypted data now as well as future decryption needs.
To address these risks, the National Institute of Standards and Technology
(NIST) launched a Post-Quantum Cryptography Standardization Project in
2016 to develop and standardize alternative algorithms resilient against
quantum attacks. The project sought submissions in three categories –
quantum-resistant public-key encryption and key establishment, digital
signatures, and hash-based signatures. Over the next few years, candidates
will be evaluated and the most promising ones selected for standardization
between 2024-2026.
Lattice-based Cryptography
One of the leading candidates for post-quantum public-key encryption and
key establishment is lattice-based cryptography. Lattices are geometric
structures involving regular grids in multi-dimensional spaces with
interesting mathematical properties that seem computationally intractable
even for quantum computers.
At a high level, lattice-based cryptosystems work by generating secret
(trapdoor) and public lattice structures where finding the shortest vector in
the public lattice is easy using the trapdoor information but believed to be
hard without it. Some specific lattice candidates in NIST’s process include
NTRU, Saber, Kyber and LAC.
Compared to quantum-vulnerable schemes like RSA, lattice cryptography has
significantly smaller key sizes (a few hundred bits versus thousands) for
equivalent security levels making implementations more compact and
efficient. However, the mathematics involved are more complex than basic
integer factorization. Decryption and signature verification times are also
slower than traditional schemes especially for constrained devices.
Code-based Cryptography
Another prospective post-quantum solution leverages error correcting codes
which also appear difficult for quantum computers. Specifically, code-based
encryption schemes are based on the hardness of solving the Syndrome
Decoding problem involving linear error correcting codes.
Cryptosystems based on generalized Reed-Solomon codes and other
algebraic geometric codes have been proposed with the most notable
candidate being the McEliece cryptosystem. It relies on the inability to
efficiently solve Syndrome Decoding for random codes without knowledge of
the underlying generator matrix.
While code-based crypto enjoys very small key sizes like lattice schemes, it
faces challenges with large public key sizes and ciphertext expansion during
encryption. Signature schemes from this category are also not fully
developed yet. Additionally, the security of many code-based constructions
against quantum attacks is not yet as well understood as lattice proposals.
Hash-based Signatures
For digital signatures needed for authentication, some post-quantum options
draw from code-based techniques but also introduce hash-function based
approaches. Hash-based signature schemes provide an alternative to
traditional signature algorithms vulnerable to Shor’s algorithm such as
ECDSA.
The leading hash-based signature candidate for NIST standardization is
SPHINCS, which uses cryptographic hash functions and pseudo-random
functions in a tree-based structure to sign a message. It provides very fast
signature generation while the public keys are huge, approaching megabytes
in size.
Alternatives like the less efficient but smaller XMSS and LMS signatures
provide better constant time performance than SPHINCS but have not
achieved the same level of analysis. Overall, has-based signatures provide
quantum-resistant authentication but with significantly larger keys than
traditional ECDSA which limits their deployment in many real-world uses.
Multivariate Cryptography
Another category of post-quantum algorithms is based on multivariate
cryptography involving systems of multivariate polynomial equations. The
security lies in the difficulty of solving these very large, nonlinear equations
over finite fields.
A notable example In this area is the HFEv- and MQ-based candidate
cryptosystem known as Rainbow. It works by generating random low-degree
multivariate polynomials to construct the public key which should be hard to
invert without private trapdoor information.
While multivariate schemes can offer competitive signature sizes for
equivalent security, they have not received as much analysis against
quantum computers as other alternatives and face challenges achieving the
efficiency needed for widespread deployment. Further research is still
ongoing into improving their performance and reliability.
Isogeny-based Cryptography
A relatively novel approach to post-quantum key establishment involves
short-term private keys based on computing isogenies between
supersingular elliptic curves. The hardness assumption relies on the difficulty
of inverting random isogenies.
One prominent isogeny-based proposal is the supersingular isogeny key
encapsulation mechanism called SIKE. It involves generating ephemeral
private keys by randomly walking along isogeny paths between two
supersingular curves at set j-invariants. The public keys reveal the endpoints
but not the journey taken.
SIKE offers significantly smaller ciphertext sizes than lattice and code-based
schemes while at the same time running faster than many of those
alternatives for equivalent security levels. Their main drawback is reliance on
elliptic curves which could pose implementation and standardization
challenges compared to number-theoretic primitives. Further optimization is
also still needed to improve performance on constrained devices.
Post-Quantum Standardization Progress
Since starting the standardization process in 2016, NIST has steadily
examined the strengths and weaknesses of the various candidates
submitted. Over multiple rounds, weaker proposals have been eliminated
while the most promising ones advanced.
Some lattice, code-based and isogeny-based schemes have consistently
remained on the shortlist as their security and performance profile seems
most competitive. By contrast, alternatives like multivariate schemes have
not yet achieved the same maturity level. Hash-based signatures are also
not as broadly applicable due to their large keys.
In 2020, NIST narrowed the competition significantly further by selecting as
alternate finalists – the lattice candidates Crystals-Kyber, Crystals-Dilithium,
and FrodoKEM along with the code-based CRYSTALS-Kyber and the isogeny-
based SIKE. Over the next two years, these post-quantum submissions will
face additional scrutiny and real-world testing before one or more are chosen
for final standardization.
Transition Challenges
While post-quantum solutions are actively being researched, some hurdles
remain before they can achieve widespread adoption to replace vulnerable
traditional crypto. Hardware acceleration may be needed for some proposals
to reach adequate performance levels especially on resource-constrained
devices.
Key transition and forward secrecy are also open problems since today’s
encrypted data will still need to remain secure even if the post-quantum
systems are broken in future. Hybrid schemes that combine quantum-safe
and traditional algorithms address this but increase complexity.
There are also uncertainties around performance, reliability and scalability of
some candidate algorithms when implemented at an internet scale. Further
cryptanalysis may reveal new attacks as quantum computing capabilities
advance creating ongoing challenges for standardization efforts.
Wider deployment will require compatibility across applications, protocols,
and full cryptosystem integration which may limit some transitional choices.
Incremental deployment using hybrid cryptography appears the most
manageable approach at this stage given the long lifetimes of cryptographic
standards and encrypted data archives.
More quantum computing achievements and algorithm improvements will
also inform how post-quantum efforts proceed. However, most experts now
agree that transitioning to quantum-resistant solutions within the next 10-15
years is critical to ensure future digital security is protected even against
quantum adversaries. The research is steadily progressing towards practical
implementations and widely accepted standards.
Conclusion
In summary, the threat posed by real quantum computers to prevailing
public-key cryptography underscores the need for quantum-resistant
algorithms to replace them in time. Efforts through the NIST standardization
process and independent research are advancing several viable post-
quantum candidates for encryption, signatures and key exchange based on
approaches like lattice, code-based, multivariate and isogeny techniques.
While challenges around efficiency, analysis, integration and hybrid
transition paths remain open questions, the field has made major progress
over the last few years narrowing the options and gaining implementation
experience. With continued optimization and testing, emerging post-
quantum alternatives should provide robust defenses for our digital
infrastructure in the upcoming era of operational quantum technologies
when traditional security inevitably becomes vulnerable. The transition effort
remains a high priority to future-proof critical systems.
Quantum computing poses a serious threat to the cryptography that
underpins much of modern digital security and transactions online.
Traditional algorithms like RSA and elliptic curve cryptography would be
vulnerable to attacks from powerful quantum computers that are on the
horizon. This has prompted significant interest and research into alternative
“post-quantum” cryptographic algorithms that are resistant even to quantum
attacks. This paper will explore some of the leading candidates for post-
quantum cryptography and analyze their strengths and weaknesses.
Traditional vs. Quantum-Safe Encryption
Traditional public-key encryption algorithms like RSA and elliptic curve
cryptography rely on the computational difficulty of factoring large prime
numbers and discrete logarithm problems respectively. However, Peter Shor
devised quantum algorithms in 1994 that can solve these problems
efficiently on a sufficiently powerful quantum computer. Some estimates
suggest quantum computers with around 50-100 qubits could break RSA-
2048 and many elliptic curve schemes.
While building large-scale fault-tolerant quantum computers is still a major
technical challenge, there is reasonable expectation that they may become a
reality within the next 10-30 years according to various projections. Even
before that, smaller non-error corrected quantum devices may be able to run
algorithms like Shor’s to crack some cryptographic keys. This poses risks
both for stored encrypted data now as well as future decryption needs.
To address these risks, the National Institute of Standards and Technology
(NIST) launched a Post-Quantum Cryptography Standardization Project in
2016 to develop and standardize alternative algorithms resilient against
quantum attacks. The project sought submissions in three categories –
quantum-resistant public-key encryption and key establishment, digital
signatures, and hash-based signatures. Over the next few years, candidates
will be evaluated and the most promising ones selected for standardization
between 2024-2026.
Lattice-based Cryptography
One of the leading candidates for post-quantum public-key encryption and
key establishment is lattice-based cryptography. Lattices are geometric
structures involving regular grids in multi-dimensional spaces with
interesting mathematical properties that seem computationally intractable
even for quantum computers.
At a high level, lattice-based cryptosystems work by generating secret
(trapdoor) and public lattice structures where finding the shortest vector in
the public lattice is easy using the trapdoor information but believed to be
hard without it. Some specific lattice candidates in NIST’s process include
NTRU, Saber, Kyber and LAC.
Compared to quantum-vulnerable schemes like RSA, lattice cryptography has
significantly smaller key sizes (a few hundred bits versus thousands) for
equivalent security levels making implementations more compact and
efficient. However, the mathematics involved are more complex than basic
integer factorization. Decryption and signature verification times are also
slower than traditional schemes especially for constrained devices.
Code-based Cryptography
Another prospective post-quantum solution leverages error correcting codes
which also appear difficult for quantum computers. Specifically, code-based
encryption schemes are based on the hardness of solving the Syndrome
Decoding problem involving linear error correcting codes.
Cryptosystems based on generalized Reed-Solomon codes and other
algebraic geometric codes have been proposed with the most notable
candidate being the McEliece cryptosystem. It relies on the inability to
efficiently solve Syndrome Decoding for random codes without knowledge of
the underlying generator matrix.
While code-based crypto enjoys very small key sizes like lattice schemes, it
faces challenges with large public key sizes and ciphertext expansion during
encryption. Signature schemes from this category are also not fully
developed yet. Additionally, the security of many code-based constructions
against quantum attacks is not yet as well understood as lattice proposals.
Hash-based Signatures
For digital signatures needed for authentication, some post-quantum options
draw from code-based techniques but also introduce hash-function based
approaches. Hash-based signature schemes provide an alternative to
traditional signature algorithms vulnerable to Shor’s algorithm such as
ECDSA.
The leading hash-based signature candidate for NIST standardization is
SPHINCS, which uses cryptographic hash functions and pseudo-random
functions in a tree-based structure to sign a message. It provides very fast
signature generation while the public keys are huge, approaching megabytes
in size.
Alternatives like the less efficient but smaller XMSS and LMS signatures
provide better constant time performance than SPHINCS but have not
achieved the same level of analysis. Overall, has-based signatures provide
quantum-resistant authentication but with significantly larger keys than
traditional ECDSA which limits their deployment in many real-world uses.
Multivariate Cryptography
Another category of post-quantum algorithms is based on multivariate
cryptography involving systems of multivariate polynomial equations. The
security lies in the difficulty of solving these very large, nonlinear equations
over finite fields.
A notable example In this area is the HFEv- and MQ-based candidate
cryptosystem known as Rainbow. It works by generating random low-degree
multivariate polynomials to construct the public key which should be hard to
invert without private trapdoor information.
While multivariate schemes can offer competitive signature sizes for
equivalent security, they have not received as much analysis against
quantum computers as other alternatives and face challenges achieving the
efficiency needed for widespread deployment. Further research is still
ongoing into improving their performance and reliability.
Isogeny-based Cryptography
A relatively novel approach to post-quantum key establishment involves
short-term private keys based on computing isogenies between
supersingular elliptic curves. The hardness assumption relies on the difficulty
of inverting random isogenies.
One prominent isogeny-based proposal is the supersingular isogeny key
encapsulation mechanism called SIKE. It involves generating ephemeral
private keys by randomly walking along isogeny paths between two
supersingular curves at set j-invariants. The public keys reveal the endpoints
but not the journey taken.
SIKE offers significantly smaller ciphertext sizes than lattice and code-based
schemes while at the same time running faster than many of those
alternatives for equivalent security levels. Their main drawback is reliance on
elliptic curves which could pose implementation and standardization
challenges compared to number-theoretic primitives. Further optimization is
also still needed to improve performance on constrained devices.
Post-Quantum Standardization Progress
Since starting the standardization process in 2016, NIST has steadily
examined the strengths and weaknesses of the various candidates
submitted. Over multiple rounds, weaker proposals have been eliminated
while the most promising ones advanced.
Some lattice, code-based and isogeny-based schemes have consistently
remained on the shortlist as their security and performance profile seems
most competitive. By contrast, alternatives like multivariate schemes have
not yet achieved the same maturity level. Hash-based signatures are also
not as broadly applicable due to their large keys.
In 2020, NIST narrowed the competition significantly further by selecting as
alternate finalists – the lattice candidates Crystals-Kyber, Crystals-Dilithium,
and FrodoKEM along with the code-based CRYSTALS-Kyber and the isogeny-
based SIKE. Over the next two years, these post-quantum submissions will
face additional scrutiny and real-world testing before one or more are chosen
for final standardization.
Transition Challenges
While post-quantum solutions are actively being researched, some hurdles
remain before they can achieve widespread adoption to replace vulnerable
traditional crypto. Hardware acceleration may be needed for some proposals
to reach adequate performance levels especially on resource-constrained
devices.
Key transition and forward secrecy are also open problems since today’s
encrypted data will still need to remain secure even if the post-quantum
systems are broken in future. Hybrid schemes that combine quantum-safe
and traditional algorithms address this but increase complexity.
There are also uncertainties around performance, reliability and scalability of
some candidate algorithms when implemented at an internet scale. Further
cryptanalysis may reveal new attacks as quantum computing capabilities
advance creating ongoing challenges for standardization efforts.
Wider deployment will require compatibility across applications, protocols,
and full cryptosystem integration which may limit some transitional choices.
Incremental deployment using hybrid cryptography appears the most
manageable approach at this stage given the long lifetimes of cryptographic
standards and encrypted data archives.
More quantum computing achievements and algorithm improvements will
also inform how post-quantum efforts proceed. However, most experts now
agree that transitioning to quantum-resistant solutions within the next 10-15
years is critical to ensure future digital security is protected even against
quantum adversaries. The research is steadily progressing towards practical
implementations and widely accepted standards.
Conclusion
In summary, the threat posed by real quantum computers to prevailing
public-key cryptography underscores the need for quantum-resistant
algorithms to replace them in time. Efforts through the NIST standardization
process and independent research are advancing several viable post-
quantum candidates for encryption, signatures and key exchange based on
approaches like lattice, code-based, multivariate and isogeny techniques.
While challenges around efficiency, analysis, integration and hybrid
transition paths remain open questions, the field has made major progress
over the last few years narrowing the options and gaining implementation
experience. With continued optimization and testing, emerging post-
quantum alternatives should provide robust defenses for our digital
infrastructure in the upcoming era of operational quantum technologies
when traditional security inevitably becomes vulnerable. The transition effort
remains a high priority to future-proof critical systems.
Quantum computing poses a serious threat to the cryptography that
underpins much of modern digital security and transactions online.
Traditional algorithms like RSA and elliptic curve cryptography would be
vulnerable to attacks from powerful quantum computers that are on the
horizon. This has prompted significant interest and research into alternative
“post-quantum” cryptographic algorithms that are resistant even to quantum
attacks. This paper will explore some of the leading candidates for post-
quantum cryptography and analyze their strengths and weaknesses.
Traditional vs. Quantum-Safe Encryption
Traditional public-key encryption algorithms like RSA and elliptic curve
cryptography rely on the computational difficulty of factoring large prime
numbers and discrete logarithm problems respectively. However, Peter Shor
devised quantum algorithms in 1994 that can solve these problems
efficiently on a sufficiently powerful quantum computer. Some estimates
suggest quantum computers with around 50-100 qubits could break RSA-
2048 and many elliptic curve schemes.
While building large-scale fault-tolerant quantum computers is still a major
technical challenge, there is reasonable expectation that they may become a
reality within the next 10-30 years according to various projections. Even
before that, smaller non-error corrected quantum devices may be able to run
algorithms like Shor’s to crack some cryptographic keys. This poses risks
both for stored encrypted data now as well as future decryption needs.
To address these risks, the National Institute of Standards and Technology
(NIST) launched a Post-Quantum Cryptography Standardization Project in
2016 to develop and standardize alternative algorithms resilient against
quantum attacks. The project sought submissions in three categories –
quantum-resistant public-key encryption and key establishment, digital
signatures, and hash-based signatures. Over the next few years, candidates
will be evaluated and the most promising ones selected for standardization
between 2024-2026.
Lattice-based Cryptography
One of the leading candidates for post-quantum public-key encryption and
key establishment is lattice-based cryptography. Lattices are geometric
structures involving regular grids in multi-dimensional spaces with
interesting mathematical properties that seem computationally intractable
even for quantum computers.
At a high level, lattice-based cryptosystems work by generating secret
(trapdoor) and public lattice structures where finding the shortest vector in
the public lattice is easy using the trapdoor information but believed to be
hard without it. Some specific lattice candidates in NIST’s process include
NTRU, Saber, Kyber and LAC.
Compared to quantum-vulnerable schemes like RSA, lattice cryptography has
significantly smaller key sizes (a few hundred bits versus thousands) for
equivalent security levels making implementations more compact and
efficient. However, the mathematics involved are more complex than basic
integer factorization. Decryption and signature verification times are also
slower than traditional schemes especially for constrained devices.
Code-based Cryptography
Another prospective post-quantum solution leverages error correcting codes
which also appear difficult for quantum computers. Specifically, code-based
encryption schemes are based on the hardness of solving the Syndrome
Decoding problem involving linear error correcting codes.
Cryptosystems based on generalized Reed-Solomon codes and other
algebraic geometric codes have been proposed with the most notable
candidate being the McEliece cryptosystem. It relies on the inability to
efficiently solve Syndrome Decoding for random codes without knowledge of
the underlying generator matrix.
While code-based crypto enjoys very small key sizes like lattice schemes, it
faces challenges with large public key sizes and ciphertext expansion during
encryption. Signature schemes from this category are also not fully
developed yet. Additionally, the security of many code-based constructions
against quantum attacks is not yet as well understood as lattice proposals.
Hash-based Signatures
For digital signatures needed for authentication, some post-quantum options
draw from code-based techniques but also introduce hash-function based
approaches. Hash-based signature schemes provide an alternative to
traditional signature algorithms vulnerable to Shor’s algorithm such as
ECDSA.
The leading hash-based signature candidate for NIST standardization is
SPHINCS, which uses cryptographic hash functions and pseudo-random
functions in a tree-based structure to sign a message. It provides very fast
signature generation while the public keys are huge, approaching megabytes
in size.
Alternatives like the less efficient but smaller XMSS and LMS signatures
provide better constant time performance than SPHINCS but have not
achieved the same level of analysis. Overall, has-based signatures provide
quantum-resistant authentication but with significantly larger keys than
traditional ECDSA which limits their deployment in many real-world uses.
Multivariate Cryptography
Another category of post-quantum algorithms is based on multivariate
cryptography involving systems of multivariate polynomial equations. The
security lies in the difficulty of solving these very large, nonlinear equations
over finite fields.
A notable example In this area is the HFEv- and MQ-based candidate
cryptosystem known as Rainbow. It works by generating random low-degree
multivariate polynomials to construct the public key which should be hard to
invert without private trapdoor information.
While multivariate schemes can offer competitive signature sizes for
equivalent security, they have not received as much analysis against
quantum computers as other alternatives and face challenges achieving the
efficiency needed for widespread deployment. Further research is still
ongoing into improving their performance and reliability.
Isogeny-based Cryptography
A relatively novel approach to post-quantum key establishment involves
short-term private keys based on computing isogenies between
supersingular elliptic curves. The hardness assumption relies on the difficulty
of inverting random isogenies.
One prominent isogeny-based proposal is the supersingular isogeny key
encapsulation mechanism called SIKE. It involves generating ephemeral
private keys by randomly walking along isogeny paths between two
supersingular curves at set j-invariants. The public keys reveal the endpoints
but not the journey taken.
SIKE offers significantly smaller ciphertext sizes than lattice and code-based
schemes while at the same time running faster than many of those
alternatives for equivalent security levels. Their main drawback is reliance on
elliptic curves which could pose implementation and standardization
challenges compared to number-theoretic primitives. Further optimization is
also still needed to improve performance on constrained devices.
Post-Quantum Standardization Progress
Since starting the standardization process in 2016, NIST has steadily
examined the strengths and weaknesses of the various candidates
submitted. Over multiple rounds, weaker proposals have been eliminated
while the most promising ones advanced.
Some lattice, code-based and isogeny-based schemes have consistently
remained on the shortlist as their security and performance profile seems
most competitive. By contrast, alternatives like multivariate schemes have
not yet achieved the same maturity level. Hash-based signatures are also
not as broadly applicable due to their large keys.
In 2020, NIST narrowed the competition significantly further by selecting as
alternate finalists – the lattice candidates Crystals-Kyber, Crystals-Dilithium,
and FrodoKEM along with the code-based CRYSTALS-Kyber and the isogeny-
based SIKE. Over the next two years, these post-quantum submissions will
face additional scrutiny and real-world testing before one or more are chosen
for final standardization.
Transition Challenges
While post-quantum solutions are actively being researched, some hurdles
remain before they can achieve widespread adoption to replace vulnerable
traditional crypto. Hardware acceleration may be needed for some proposals
to reach adequate performance levels especially on resource-constrained
devices.
Key transition and forward secrecy are also open problems since today’s
encrypted data will still need to remain secure even if the post-quantum
systems are broken in future. Hybrid schemes that combine quantum-safe
and traditional algorithms address this but increase complexity.
There are also uncertainties around performance, reliability and scalability of
some candidate algorithms when implemented at an internet scale. Further
cryptanalysis may reveal new attacks as quantum computing capabilities
advance creating ongoing challenges for standardization efforts.
Wider deployment will require compatibility across applications, protocols,
and full cryptosystem integration which may limit some transitional choices.
Incremental deployment using hybrid cryptography appears the most
manageable approach at this stage given the long lifetimes of cryptographic
standards and encrypted data archives.
More quantum computing achievements and algorithm improvements will
also inform how post-quantum efforts proceed. However, most experts now
agree that transitioning to quantum-resistant solutions within the next 10-15
years is critical to ensure future digital security is protected even against
quantum adversaries. The research is steadily progressing towards practical
implementations and widely accepted standards.
Conclusion
In summary, the threat posed by real quantum computers to prevailing
public-key cryptography underscores the need for quantum-resistant
algorithms to replace them in time. Efforts through the NIST standardization
process and independent research are advancing several viable post-
quantum candidates for encryption, signatures and key exchange based on
approaches like lattice, code-based, multivariate and isogeny techniques.
While challenges around efficiency, analysis, integration and hybrid
transition paths remain open questions, the field has made major progress
over the last few years narrowing the options and gaining implementation
experience. With continued optimization and testing, emerging post-
quantum alternatives should provide robust defenses for our digital
infrastructure in the upcoming era of operational quantum technologies
when traditional security inevitably becomes vulnerable. The transition effort
remains a high priority to future-proof critical systems.
Quantum computing poses a serious threat to the cryptography that
underpins much of modern digital security and transactions online.
Traditional algorithms like RSA and elliptic curve cryptography would be
vulnerable to attacks from powerful quantum computers that are on the
horizon. This has prompted significant interest and research into alternative
“post-quantum” cryptographic algorithms that are resistant even to quantum
attacks. This paper will explore some of the leading candidates for post-
quantum cryptography and analyze their strengths and weaknesses.
Traditional vs. Quantum-Safe Encryption
Traditional public-key encryption algorithms like RSA and elliptic curve
cryptography rely on the computational difficulty of factoring large prime
numbers and discrete logarithm problems respectively. However, Peter Shor
devised quantum algorithms in 1994 that can solve these problems
efficiently on a sufficiently powerful quantum computer. Some estimates
suggest quantum computers with around 50-100 qubits could break RSA-
2048 and many elliptic curve schemes.
While building large-scale fault-tolerant quantum computers is still a major
technical challenge, there is reasonable expectation that they may become a
reality within the next 10-30 years according to various projections. Even
before that, smaller non-error corrected quantum devices may be able to run
algorithms like Shor’s to crack some cryptographic keys. This poses risks
both for stored encrypted data now as well as future decryption needs.
To address these risks, the National Institute of Standards and Technology
(NIST) launched a Post-Quantum Cryptography Standardization Project in
2016 to develop and standardize alternative algorithms resilient against
quantum attacks. The project sought submissions in three categories –
quantum-resistant public-key encryption and key establishment, digital
signatures, and hash-based signatures. Over the next few years, candidates
will be evaluated and the most promising ones selected for standardization
between 2024-2026.
Lattice-based Cryptography
One of the leading candidates for post-quantum public-key encryption and
key establishment is lattice-based cryptography. Lattices are geometric
structures involving regular grids in multi-dimensional spaces with
interesting mathematical properties that seem computationally intractable
even for quantum computers.
At a high level, lattice-based cryptosystems work by generating secret
(trapdoor) and public lattice structures where finding the shortest vector in
the public lattice is easy using the trapdoor information but believed to be
hard without it. Some specific lattice candidates in NIST’s process include
NTRU, Saber, Kyber and LAC.
Compared to quantum-vulnerable schemes like RSA, lattice cryptography has
significantly smaller key sizes (a few hundred bits versus thousands) for
equivalent security levels making implementations more compact and
efficient. However, the mathematics involved are more complex than basic
integer factorization. Decryption and signature verification times are also
slower than traditional schemes especially for constrained devices.
Code-based Cryptography
Another prospective post-quantum solution leverages error correcting codes
which also appear difficult for quantum computers. Specifically, code-based
encryption schemes are based on the hardness of solving the Syndrome
Decoding problem involving linear error correcting codes.
Cryptosystems based on generalized Reed-Solomon codes and other
algebraic geometric codes have been proposed with the most notable
candidate being the McEliece cryptosystem. It relies on the inability to
efficiently solve Syndrome Decoding for random codes without knowledge of
the underlying generator matrix.
While code-based crypto enjoys very small key sizes like lattice schemes, it
faces challenges with large public key sizes and ciphertext expansion during
encryption. Signature schemes from this category are also not fully
developed yet. Additionally, the security of many code-based constructions
against quantum attacks is not yet as well understood as lattice proposals.
Hash-based Signatures
For digital signatures needed for authentication, some post-quantum options
draw from code-based techniques but also introduce hash-function based
approaches. Hash-based signature schemes provide an alternative to
traditional signature algorithms vulnerable to Shor’s algorithm such as
ECDSA.
The leading hash-based signature candidate for NIST standardization is
SPHINCS, which uses cryptographic hash functions and pseudo-random
functions in a tree-based structure to sign a message. It provides very fast
signature generation while the public keys are huge, approaching megabytes
in size.
Alternatives like the less efficient but smaller XMSS and LMS signatures
provide better constant time performance than SPHINCS but have not
achieved the same level of analysis. Overall, has-based signatures provide
quantum-resistant authentication but with significantly larger keys than
traditional ECDSA which limits their deployment in many real-world uses.
Multivariate Cryptography
Another category of post-quantum algorithms is based on multivariate
cryptography involving systems of multivariate polynomial equations. The
security lies in the difficulty of solving these very large, nonlinear equations
over finite fields.
A notable example In this area is the HFEv- and MQ-based candidate
cryptosystem known as Rainbow. It works by generating random low-degree
multivariate polynomials to construct the public key which should be hard to
invert without private trapdoor information.
While multivariate schemes can offer competitive signature sizes for
equivalent security, they have not received as much analysis against
quantum computers as other alternatives and face challenges achieving the
efficiency needed for widespread deployment. Further research is still
ongoing into improving their performance and reliability.
Isogeny-based Cryptography
A relatively novel approach to post-quantum key establishment involves
short-term private keys based on computing isogenies between
supersingular elliptic curves. The hardness assumption relies on the difficulty
of inverting random isogenies.
One prominent isogeny-based proposal is the supersingular isogeny key
encapsulation mechanism called SIKE. It involves generating ephemeral
private keys by randomly walking along isogeny paths between two
supersingular curves at set j-invariants. The public keys reveal the endpoints
but not the journey taken.
SIKE offers significantly smaller ciphertext sizes than lattice and code-based
schemes while at the same time running faster than many of those
alternatives for equivalent security levels. Their main drawback is reliance on
elliptic curves which could pose implementation and standardization
challenges compared to number-theoretic primitives. Further optimization is
also still needed to improve performance on constrained devices.
Post-Quantum Standardization Progress
Since starting the standardization process in 2016, NIST has steadily
examined the strengths and weaknesses of the various candidates
submitted. Over multiple rounds, weaker proposals have been eliminated
while the most promising ones advanced.
Some lattice, code-based and isogeny-based schemes have consistently
remained on the shortlist as their security and performance profile seems
most competitive. By contrast, alternatives like multivariate schemes have
not yet achieved the same maturity level. Hash-based signatures are also
not as broadly applicable due to their large keys.
In 2020, NIST narrowed the competition significantly further by selecting as
alternate finalists – the lattice candidates Crystals-Kyber, Crystals-Dilithium,
and FrodoKEM along with the code-based CRYSTALS-Kyber and the isogeny-
based SIKE. Over the next two years, these post-quantum submissions will
face additional scrutiny and real-world testing before one or more are chosen
for final standardization.
Transition Challenges
While post-quantum solutions are actively being researched, some hurdles
remain before they can achieve widespread adoption to replace vulnerable
traditional crypto. Hardware acceleration may be needed for some proposals
to reach adequate performance levels especially on resource-constrained
devices.
Key transition and forward secrecy are also open problems since today’s
encrypted data will still need to remain secure even if the post-quantum
systems are broken in future. Hybrid schemes that combine quantum-safe
and traditional algorithms address this but increase complexity.
There are also uncertainties around performance, reliability and scalability of
some candidate algorithms when implemented at an internet scale. Further
cryptanalysis may reveal new attacks as quantum computing capabilities
advance creating ongoing challenges for standardization efforts.
Wider deployment will require compatibility across applications, protocols,
and full cryptosystem integration which may limit some transitional choices.
Incremental deployment using hybrid cryptography appears the most
manageable approach at this stage given the long lifetimes of cryptographic
standards and encrypted data archives.
More quantum computing achievements and algorithm improvements will
also inform how post-quantum efforts proceed. However, most experts now
agree that transitioning to quantum-resistant solutions within the next 10-15
years is critical to ensure future digital security is protected even against
quantum adversaries. The research is steadily progressing towards practical
implementations and widely accepted standards.
Conclusion
In summary, the threat posed by real quantum computers to prevailing
public-key cryptography underscores the need for quantum-resistant
algorithms to replace them in time. Efforts through the NIST standardization
process and independent research are advancing several viable post-
quantum candidates for encryption, signatures and key exchange based on
approaches like lattice, code-based, multivariate and isogeny techniques.
While challenges around efficiency, analysis, integration and hybrid
transition paths remain open questions, the field has made major progress
over the last few years narrowing the options and gaining implementation
experience. With continued optimization and testing, emerging post-
quantum alternatives should provide robust defenses for our digital
infrastructure in the upcoming era of operational quantum technologies
when traditional security inevitably becomes vulnerable. The transition effort
remains a high priority to future-proof critical systems.
Quantum computing poses a serious threat to the cryptography that
underpins much of modern digital security and transactions online.
Traditional algorithms like RSA and elliptic curve cryptography would be
vulnerable to attacks from powerful quantum computers that are on the
horizon. This has prompted significant interest and research into alternative
“post-quantum” cryptographic algorithms that are resistant even to quantum
attacks. This paper will explore some of the leading candidates for post-
quantum cryptography and analyze their strengths and weaknesses.
Traditional vs. Quantum-Safe Encryption
Traditional public-key encryption algorithms like RSA and elliptic curve
cryptography rely on the computational difficulty of factoring large prime
numbers and discrete logarithm problems respectively. However, Peter Shor
devised quantum algorithms in 1994 that can solve these problems
efficiently on a sufficiently powerful quantum computer. Some estimates
suggest quantum computers with around 50-100 qubits could break RSA-
2048 and many elliptic curve schemes.
While building large-scale fault-tolerant quantum computers is still a major
technical challenge, there is reasonable expectation that they may become a
reality within the next 10-30 years according to various projections. Even
before that, smaller non-error corrected quantum devices may be able to run
algorithms like Shor’s to crack some cryptographic keys. This poses risks
both for stored encrypted data now as well as future decryption needs.
To address these risks, the National Institute of Standards and Technology
(NIST) launched a Post-Quantum Cryptography Standardization Project in
2016 to develop and standardize alternative algorithms resilient against
quantum attacks. The project sought submissions in three categories –
quantum-resistant public-key encryption and key establishment, digital
signatures, and hash-based signatures. Over the next few years, candidates
will be evaluated and the most promising ones selected for standardization
between 2024-2026.
Lattice-based Cryptography
One of the leading candidates for post-quantum public-key encryption and
key establishment is lattice-based cryptography. Lattices are geometric
structures involving regular grids in multi-dimensional spaces with
interesting mathematical properties that seem computationally intractable
even for quantum computers.
At a high level, lattice-based cryptosystems work by generating secret
(trapdoor) and public lattice structures where finding the shortest vector in
the public lattice is easy using the trapdoor information but believed to be
hard without it. Some specific lattice candidates in NIST’s process include
NTRU, Saber, Kyber and LAC.
Compared to quantum-vulnerable schemes like RSA, lattice cryptography has
significantly smaller key sizes (a few hundred bits versus thousands) for
equivalent security levels making implementations more compact and
efficient. However, the mathematics involved are more complex than basic
integer factorization. Decryption and signature verification times are also
slower than traditional schemes especially for constrained devices.
Code-based Cryptography
Another prospective post-quantum solution leverages error correcting codes
which also appear difficult for quantum computers. Specifically, code-based
encryption schemes are based on the hardness of solving the Syndrome
Decoding problem involving linear error correcting codes.
Cryptosystems based on generalized Reed-Solomon codes and other
algebraic geometric codes have been proposed with the most notable
candidate being the McEliece cryptosystem. It relies on the inability to
efficiently solve Syndrome Decoding for random codes without knowledge of
the underlying generator matrix.
While code-based crypto enjoys very small key sizes like lattice schemes, it
faces challenges with large public key sizes and ciphertext expansion during
encryption. Signature schemes from this category are also not fully
developed yet. Additionally, the security of many code-based constructions
against quantum attacks is not yet as well understood as lattice proposals.
Hash-based Signatures
For digital signatures needed for authentication, some post-quantum options
draw from code-based techniques but also introduce hash-function based
approaches. Hash-based signature schemes provide an alternative to
traditional signature algorithms vulnerable to Shor’s algorithm such as
ECDSA.
The leading hash-based signature candidate for NIST standardization is
SPHINCS, which uses cryptographic hash functions and pseudo-random
functions in a tree-based structure to sign a message. It provides very fast
signature generation while the public keys are huge, approaching megabytes
in size.
Alternatives like the less efficient but smaller XMSS and LMS signatures
provide better constant time performance than SPHINCS but have not
achieved the same level of analysis. Overall, has-based signatures provide
quantum-resistant authentication but with significantly larger keys than
traditional ECDSA which limits their deployment in many real-world uses.
Multivariate Cryptography
Another category of post-quantum algorithms is based on multivariate
cryptography involving systems of multivariate polynomial equations. The
security lies in the difficulty of solving these very large, nonlinear equations
over finite fields.
A notable example In this area is the HFEv- and MQ-based candidate
cryptosystem known as Rainbow. It works by generating random low-degree
multivariate polynomials to construct the public key which should be hard to
invert without private trapdoor information.
While multivariate schemes can offer competitive signature sizes for
equivalent security, they have not received as much analysis against
quantum computers as other alternatives and face challenges achieving the
efficiency needed for widespread deployment. Further research is still
ongoing into improving their performance and reliability.
Isogeny-based Cryptography
A relatively novel approach to post-quantum key establishment involves
short-term private keys based on computing isogenies between
supersingular elliptic curves. The hardness assumption relies on the difficulty
of inverting random isogenies.
One prominent isogeny-based proposal is the supersingular isogeny key
encapsulation mechanism called SIKE. It involves generating ephemeral
private keys by randomly walking along isogeny paths between two
supersingular curves at set j-invariants. The public keys reveal the endpoints
but not the journey taken.
SIKE offers significantly smaller ciphertext sizes than lattice and code-based
schemes while at the same time running faster than many of those
alternatives for equivalent security levels. Their main drawback is reliance on
elliptic curves which could pose implementation and standardization
challenges compared to number-theoretic primitives. Further optimization is
also still needed to improve performance on constrained devices.
Post-Quantum Standardization Progress
Since starting the standardization process in 2016, NIST has steadily
examined the strengths and weaknesses of the various candidates
submitted. Over multiple rounds, weaker proposals have been eliminated
while the most promising ones advanced.
Some lattice, code-based and isogeny-based schemes have consistently
remained on the shortlist as their security and performance profile seems
most competitive. By contrast, alternatives like multivariate schemes have
not yet achieved the same maturity level. Hash-based signatures are also
not as broadly applicable due to their large keys.
In 2020, NIST narrowed the competition significantly further by selecting as
alternate finalists – the lattice candidates Crystals-Kyber, Crystals-Dilithium,
and FrodoKEM along with the code-based CRYSTALS-Kyber and the isogeny-
based SIKE. Over the next two years, these post-quantum submissions will
face additional scrutiny and real-world testing before one or more are chosen
for final standardization.
Transition Challenges
While post-quantum solutions are actively being researched, some hurdles
remain before they can achieve widespread adoption to replace vulnerable
traditional crypto. Hardware acceleration may be needed for some proposals
to reach adequate performance levels especially on resource-constrained
devices.
Key transition and forward secrecy are also open problems since today’s
encrypted data will still need to remain secure even if the post-quantum
systems are broken in future. Hybrid schemes that combine quantum-safe
and traditional algorithms address this but increase complexity.
There are also uncertainties around performance, reliability and scalability of
some candidate algorithms when implemented at an internet scale. Further
cryptanalysis may reveal new attacks as quantum computing capabilities
advance creating ongoing challenges for standardization efforts.
Wider deployment will require compatibility across applications, protocols,
and full cryptosystem integration which may limit some transitional choices.
Incremental deployment using hybrid cryptography appears the most
manageable approach at this stage given the long lifetimes of cryptographic
standards and encrypted data archives.
More quantum computing achievements and algorithm improvements will
also inform how post-quantum efforts proceed. However, most experts now
agree that transitioning to quantum-resistant solutions within the next 10-15
years is critical to ensure future digital security is protected even against
quantum adversaries. The research is steadily progressing towards practical
implementations and widely accepted standards.
Conclusion
In summary, the threat posed by real quantum computers to prevailing
public-key cryptography underscores the need for quantum-resistant
algorithms to replace them in time. Efforts through the NIST standardization
process and independent research are advancing several viable post-
quantum candidates for encryption, signatures and key exchange based on
approaches like lattice, code-based, multivariate and isogeny techniques.
While challenges around efficiency, analysis, integration and hybrid
transition paths remain open questions, the field has made major progress
over the last few years narrowing the options and gaining implementation
experience. With continued optimization and testing, emerging post-
quantum alternatives should provide robust defenses for our digital
infrastructure in the upcoming era of operational quantum technologies
when traditional security inevitably becomes vulnerable. The transition effort
remains a high priority to future-proof critical systems.
