Encryption Is Not Broken—Yet

Quantum-security reporting often begins with a headline version of the problem: Quantum computers will break encryption. That sentence is directionally useful and technically imprecise.

There is no single thing called encryption. Modern security systems combine different classes of cryptography for different jobs.

Public-key cryptography helps strangers establish shared secrets, authenticate servers, verify signatures and prove control of identities without having previously exchanged a secret key. Symmetric cryptography uses a shared secret to encrypt bulk data efficiently.

Hash functions create fixed-size fingerprints used throughout authentication, integrity checking, signatures, password storage and many other systems. The quantum threat is not equal across these categories.

The operative phrase is sufficiently capable. Today’s quantum machines remain noisy, limited and far below what would be required to run a cryptanalytic attack against production cryptography at useful scale.

There is no publicly demonstrated CRQC. The migration is happening anyway because the lifetime of secrets can exceed the migration time of infrastructure.

The Mathematical Backstory: RSA, ECC and Shor

The public internet solved one of computing’s deepest practical problems with mathematics. Two machines that have never met need to communicate securely over a network controlled by strangers. They need to authenticate identities and establish keys without first meeting in a locked room to exchange secrets.

RSA approached this through integer factorization. Multiplying two enormous prime numbers is easy. Recovering those primes from the product is extremely difficult for classical computers when the numbers are chosen correctly and are sufficiently large.

Diffie-Hellman and elliptic-curve systems rely on forms of the discrete logarithm problem. Again, one direction of the mathematical operation is computationally convenient while reversing it is impractical at modern security parameters.

This asymmetry created the public-key revolution. Then, in 1994, mathematician Peter Shor published a quantum algorithm showing that a sufficiently capable quantum computer could solve both integer factorization and discrete logarithms efficiently enough to overturn the security assumptions behind RSA, Diffie-Hellman and elliptic-curve cryptography.

The algorithm did not instantly break encryption because the required machine did not exist. But it changed cryptography from a timeless mathematical assumption into a technology with a possible expiration date.

Harvest Now, Decrypt Later

The most urgent quantum risk does not require an attacker to break anything today. It requires storage.

An adversary records encrypted network traffic, encrypted archives or intercepted communications and preserves them until a future cryptanalytic capability becomes available. Whether this matters depends on the confidentiality lifetime of the information.

A restaurant reservation from 2026 may be worthless in 2040. A diplomatic source identity, intelligence report, genomic record, weapons-system design, merger strategy, private-key backup, legal file or long-term industrial secret may not be. This creates what migration planners often describe with a simple relationship:

The formula is not a prediction of the quantum-computing timeline. It is a planning model.

If a secret must remain protected for twenty years and replacing the systems protecting it takes eight years, the organization cannot rationally wait until a quantum computer is eight years away—particularly when nobody can identify that date with confidence. This is why NIST’s current migration guidance says anyone using public-key cryptography should be preparing to become CRQC-ready.

The NIST Standards: ML-KEM, ML-DSA and SLH-DSA

NIST began its public post-quantum standardization project in 2016. The process became one of the largest open cryptographic evaluations ever attempted. Researchers from around the world submitted candidate algorithms. Cryptographers attacked them. Implementers measured performance. Some algorithms failed. Others survived multiple rounds of scrutiny. In August 2024, the first three standards became final.

The names are intimidating because they describe mathematical families rather than products. ML-KEM is the workhorse for establishing a shared secret. It does not encrypt a terabyte file directly. It helps two endpoints establish key material that can then feed efficient symmetric encryption.

ML-DSA signs information so another party can verify authenticity and integrity. SLH-DSA provides a signature design based on hash functions, giving the ecosystem a different security foundation from lattice-based schemes.

NIST has also selected HQC for future standardization as another key-encapsulation mechanism and continues evaluating additional signature schemes. That continuing process is important: post-quantum security should not become dependent on a single mathematical family any more than conventional security should.

Why the Transition Is Hybrid

Post-quantum cryptography creates a strange engineering problem. The old algorithms have decades of implementation experience.

The new algorithms are designed to survive a future threat the old algorithms cannot. Replacing the old with the new in one step would therefore trade a known future weakness for newer implementation and mathematical risk.

The dominant solution is hybrid cryptography. A hybrid key exchange combines output from a traditional algorithm and a post-quantum algorithm. The final shared secret is designed so that an attacker must defeat both components to recover it.

In July 2026, the IETF published RFC 10024, a Standards Track specification defining hybrid TLS 1.3 groups including X25519MLKEM768. The name literally describes the strategy: combine the widely deployed X25519 elliptic-curve mechanism with ML-KEM-768.

This is not evidence that cryptographers distrust ML-KEM specifically. It is migration discipline. The system does not need to bet the internet on a single unproven assumption during a generational transition.

The Web Is Already Changing: TLS

TLS is the cryptographic protocol beneath HTTPS. When the browser shows a secure connection, TLS has generally performed at least two major jobs: authenticated the server and established encryption keys for the session.

The key-establishment half is moving faster. Cloudflare says more than two-thirds of the human-generated TLS traffic reaching its infrastructure is already protected using post-quantum cryptography. Browser and cloud deployments have made hybrid ML-KEM key establishment increasingly invisible to ordinary users.

The migration is also moving into ordinary cloud plumbing rather than remaining an experimental browser feature. AWS has added hybrid ML-KEM key exchange to Application and Network Load Balancers, Secrets Manager clients, payment-cryptography API traffic and other service paths. That matters because these are the layers through which applications retrieve credentials, terminate HTTPS sessions and move regulated data. The post-quantum transition is increasingly becoming something infrastructure software negotiates automatically rather than something an end user consciously turns on.

A June 2026 measurement study of 32,011 domains found 49.3 percent supporting hybrid post-quantum key exchange while 50.7 percent remained classical. The same study found that 15.7 percent of tested domains still negotiated TLS 1.2, with lagging deployments concentrated in sectors including banking and government.

A much larger July study established more than two billion TLS handshakes across one million domains. Its researchers found that PQ-TLS adoption was converging heavily on one hybrid construction and that managed infrastructure providers were driving much of the apparent progress. They also found no meaningful latency increase in ordinary internet conditions.

That last finding matters because the early objection to post-quantum cryptography was often performance. Many post-quantum public keys, ciphertexts and signatures are much larger than elliptic-curve equivalents.

But the practical cost of migration is increasingly operational rather than raw CPU time. The hard problem is discovering every TLS termination point, appliance, library, proxy, load balancer, API gateway and embedded system that needs to negotiate the new cryptography correctly.

The Harder Half: Certificates and Authentication

Protecting the shared secret is only half a secure connection. The browser also needs to know that it is talking to the correct server.

That authentication system depends heavily on digital signatures and certificate chains. The June measurement study found an extraordinary split: nearly half of observed domains supported hybrid post-quantum key exchange, while the study observed zero hybrid post-quantum certificates.

That does not mean HTTPS is presently unsafe. It means key establishment is easier to migrate than public-key infrastructure.

Certificate ecosystems involve:

The IETF is actively working on hybrid authentication designs using traditional and post-quantum certificates together. NIST’s June 2026 working drafts for federal PIV credentials likewise envision a dual-stack transition that preserves classical credential objects while adding ML-KEM and ML-DSA capabilities.

The lesson is broader than quantum security. Encryption can often be upgraded in a library. Trust infrastructure is institutional.

iMessage, Signal and the Messaging Migration

Consumer messaging became an early post-quantum laboratory because private conversations are an obvious Harvest Now, Decrypt Later target. Signal introduced PQXDH, a post-quantum key-agreement protocol that adds a post-quantum key-encapsulation mechanism to the initial establishment of encrypted conversations.

Apple went further with PQ3 for iMessage. Apple’s design combines classical elliptic-curve cryptography with Kyber-derived post-quantum key establishment and introduces periodic post-quantum rekeying within ongoing conversations. The objective is not only to protect the first connection but to restore security after future key compromise.

The design illustrates why “quantum-safe messaging” cannot be reduced to swapping RSA for a new algorithm. Secure messaging depends on:

Apple’s 2026 publication of formally verified ML-KEM and ML-DSA implementations inside its corecrypto library shows the migration continuing below the application layer. Consumers may never see an “enable post-quantum” button. That is probably a sign of success.

VPNs, IPsec, SSH and Enterprise Networks

The web browser is only one cryptographic environment. Enterprises protect branch offices with IPsec, administrators use SSH, remote workers use VPNs, routers authenticate control traffic, APIs depend on TLS, and internal service meshes may terminate millions of encrypted connections.

These environments are moving at different speeds. In April 2026, Cloudflare made hybrid post-quantum IPsec generally available and said it had tested interoperability with Cisco and Fortinet branch connectors. NSA’s March 2026 Commercial Solutions for Classified updates began incorporating CNSA 2.0 objectives into mobile access, campus wireless and key-management architectures.

IETF work also defines hybrid ML-KEM methods for SSH. The distinction between protocols matters because packet size, handshake design, embedded devices and hardware acceleration differ enormously. What is easy for a cloud TLS endpoint may be difficult for:

This is why protocol surveys in 2026 consistently find that TLS and messaging are leading the migration while DNSSEC, BGP and other infrastructure protocols face deeper structural obstacles. This point matters because the technology should be evaluated as part of the surrounding system rather than as an isolated claim or capability.

The Federal Deadline Moves the Market

Government cryptography requirements rarely remain confined to government. When federal agencies require certified algorithms, contractors, cloud providers, equipment vendors, identity products, networking companies and software suppliers must support them.

Executive Order 14412 therefore matters far beyond Washington. The June 22, 2026 order directs federal agencies to identify migration leadership, inventory high-value systems and move those systems toward NIST-approved post-quantum standards. Its headline deadlines are:

NIST’s broader transition planning still points toward deprecating and ultimately removing quantum-vulnerable public-key algorithms from its standards by 2035, with high-risk systems moving earlier. This turns post-quantum cryptography into a procurement clock.

A product being purchased today may still be installed in 2035. If it cannot change algorithms, the buyer may be purchasing technical debt with an expiration date already attached.

Cryptographic Inventory: The Problem Nobody Sees

Ask a company how many laptops it owns and its asset-management system may answer. Ask where RSA, ECDSA, ECDH or embedded certificates are used across the enterprise and the answer is often much less certain.

Cryptography is hidden inside:

That makes inventory the first operational problem. A May 2026 financial-infrastructure study examined thousands of real-world Nginx configurations and concluded that the bottleneck is increasingly operational rather than algorithmic. Hybrid ML-KEM may already be available in mainstream software libraries, but organizations need repeatable methods to discover where cryptography is configured and whether PQC is actually negotiated.

The emerging concept is the cryptographic bill of materials—an inventory of algorithms, certificates, keys, libraries and dependencies analogous to a software bill of materials. Without that map, an organization cannot migrate what it cannot find.

Crypto Agility Is the Real Strategic Capability

The post-quantum migration will not be the last time cryptography changes. An algorithm may be weakened by new mathematics.

A library may contain a catastrophic implementation bug. A random-number generator may fail.

A certificate hierarchy may need replacement. A new protocol may require larger keys or different signature formats.

For decades, many systems embedded algorithms as permanent assumptions. The better model is crypto agility: the ability to identify, configure, replace and rotate cryptography without rebuilding the entire product.

NIST now treats that capability as a discipline in its own right. Its finalized guidance on crypto agility defines the problem across protocols, applications, software, hardware, firmware and infrastructure, emphasizing that algorithm replacement must preserve both security and ongoing operations. That is a deeper lesson than “install ML-KEM.” The post-quantum migration is forcing organizations to discover whether they actually know where cryptography lives inside their systems—and whether they can change it again when the next transition arrives.

This may be the most durable lesson of the entire quantum transition. The organization that successfully installs ML-KEM but still cannot replace cryptography quickly has solved today’s migration and preserved tomorrow’s vulnerability.

Bitcoin and Blockchain: A Different Migration Problem

Quantum stories frequently claim that a sufficiently powerful quantum computer will “destroy Bitcoin.” The real problem is more specific. Bitcoin uses elliptic-curve cryptography—secp256k1—for digital signatures that authorize spending. A cryptographically relevant quantum computer capable of solving the corresponding discrete-log problem could threaten exposed public keys by deriving private signing keys.

But Bitcoin is not one TLS server that can quietly install a library update. It is a decentralized consensus system with money locked under rules that must remain understandable to millions of participants. This creates at least three separate quantum migration problems:

Bitcoin developers are actively discussing these issues in 2026. Bitcoin Optech has documented proposals for post-quantum BIP324 transport, post-quantum wallet structures, SPHINCS-based fallback keys, post-quantum output types, STARK-assisted recovery and mechanisms that could eventually disable vulnerable elliptic-curve spending paths.

None of this means Bitcoin has adopted a final post-quantum consensus strategy. It means the problem has moved from theoretical commentary into active protocol engineering. The broader lesson applies across blockchains: cryptographic migration becomes dramatically harder when the algorithm is also the ownership system.

What This Means for Ordinary Citizens

Post-quantum cryptography is one of those security transitions where individuals have far less work than institutions. A normal user should not download an unknown “quantum-secure” messaging application merely because its marketing contains the word quantum.

The safer pattern is almost the opposite: use well-maintained systems whose cryptography is upgraded underneath you. Apple moved iMessage users to PQ3 without requiring them to understand Kyber. Signal migrated key establishment through application updates. Browser and network providers can negotiate hybrid TLS invisibly. For citizens, the priorities are therefore straightforward:

The larger citizen issue is trust.

People cannot personally audit every TLS library, messaging ratchet, device certificate or hardware security module they use. They depend on institutions to migrate competently. That makes transparency, open standards, independent cryptanalysis and interoperable specifications central to public security.

What the Future Holds

The post-quantum future will not arrive on one morning when the internet flips from classical to quantum-safe. It will be a long period of mixed cryptography.

1. Hybrid becomes normal

For years, systems will combine classical and post-quantum primitives because interoperability and risk management favor gradual transition. This point matters because the technology should be evaluated as part of the surrounding system rather than as an isolated claim or capability.

2. Authentication catches up to key exchange

Expect certificate authorities, HSMs, smart cards, identity providers and device-signing systems to become the next major migration frontier. This point matters because the technology should be evaluated as part of the surrounding system rather than as an isolated claim or capability.

3. Crypto inventories become security controls

Large organizations will increasingly maintain machine-readable cryptographic inventories and enforce deprecation centrally. This point matters because the technology should be evaluated as part of the surrounding system rather than as an isolated claim or capability.

4. PQC becomes procurement language

Government and critical-infrastructure buyers will demand algorithm agility and post-quantum roadmaps in products expected to remain deployed into the 2030s. This point matters because the technology should be evaluated as part of the surrounding system rather than as an isolated claim or capability.

5. Performance becomes less interesting

As implementations mature, the debate will shift from whether ML-KEM is “too big” to whether systems can manage certificates, keys and compatibility reliably. This point matters because the technology should be evaluated as part of the surrounding system rather than as an isolated claim or capability.

6. The quantum timeline remains uncertain

Progress in error correction, logical qubits, hardware engineering and algorithms will continue to change estimates. Security planning should avoid both complacency and breathless countdown clocks.

7. Quantum-resistant does not mean permanently secure

PQC algorithms are designed against known classical and quantum attacks. They are not mathematical promises that no new attack will ever be discovered. Agility remains essential.

The SURVXCOM Quantum-Readiness Test

A serious organization should be able to answer ten questions. This point matters because the technology should be evaluated as part of the surrounding system rather than as an isolated claim or capability.

What to Watch Next

The Encryption Migration Before the Machine

The post-quantum transition is a rare infrastructure project built around an event that has not happened. No public CRQC is breaking internet encryption.

RSA still works.

Elliptic curves still work.

Your bank connection did not become readable overnight. And yet the migration is rational.

Cryptography is unusual because failure can be retrospective. A bridge that collapses in 2040 does not cause the cars that crossed it in 2026 to fall into the river.

Encryption is different.

A cryptographic breakthrough in 2040 may expose information intercepted fourteen years earlier. That gives defenders a problem that ordinary patching cannot solve.

They must deploy the protection before the threat is operational. The result is one of the largest silent technology migrations in the history of the internet.

Browsers will change.

Certificates will change.

VPNs will change.

Smart cards will change.

Code signing will change.

Cryptocurrency protocols may change. Hardware security modules will change.

And most citizens will never see the algorithms that replaced the old ones. That invisibility should not be mistaken for irrelevance. The race to secure the post-quantum world is already underway precisely because the machine everyone fears has not arrived yet.