Post-Quantum Cryptography

late 1970s · 56 years ago

Ralph Merkle invented hash-based digital signatures

Merkle devised digital signatures built from hash functions rather than number-theoretic problems such as those underlying RSA and DSA. Because hash functions are considered relatively resistant to quantum attack, these constructions became one of the earliest and most durable families of post-quantum signature schemes.

1978 · 48 years ago

Robert McEliece proposed a public-key cryptosystem based on error-correcting codes

The scheme has resisted both classical and quantum cryptanalysis for nearly five decades despite large key sizes limiting its adoption, making it the ancestor of the code-based candidates NIST evaluated during standardisation.

1979 · 47 years ago

Ralph Merkle proposed hash-based digital signatures

Building on Leslie Lamport's one-time signature idea, Merkle's tree construction produced signatures secure against any adversary, quantum or otherwise, provided the underlying hash function held, an approach revived decades later as SPHINCS+.

1989 · 37 years ago

Moni Naor and Moti Yung invented UOWHF hashing and a hash-based signature without trapdoors

Naor and Yung introduced universal one-way hash functions and designed a signature scheme based on hashing that could be used for unlimited time. It was the first such signature not requiring trapdoor properties, broadening the hash-based route to quantum-resistant signatures.

1994 · 32 years ago

Peter Shor published a quantum algorithm that breaks RSA and Diffie-Hellman

Shor's algorithm showed that a sufficiently large quantum computer could factor integers and solve discrete logarithms in polynomial time, undermining the assumptions behind nearly all public-key cryptography then in use and creating the field this capability now covers.

1996 · 30 years ago

Lattice-based cryptography gained its theoretical grounding

Miklós Ajtai showed that certain lattice problems were as hard on average as in the worst case, giving cryptographers confidence to build systems on foundations that later underpinned NIST's leading candidates.

• NTRU was proposed as the first practical lattice-based cryptosystem

2005 · 21 years ago

Oded Regev introduced the Learning With Errors problem

The Israeli computer scientist's work gave lattice-based cryptography a hardness assumption tied to worst-case problems believed to resist quantum attack, becoming the mathematical basis for the algorithms later standardised as ML-KEM and ML-DSA.

2005 · 21 years ago

Luis Garcia proved a security reduction for Merkle hash tree signatures

Garcia showed that the security of Merkle hash tree signatures reduces to the security of the underlying hash function. This gave hash-based post-quantum signatures a firm theoretical grounding rather than mere heuristic confidence.

2006 · 20 years ago

PQCrypto conference series began hosting the field's dedicated research conference

The PQCrypto series gave post-quantum cryptography a standing venue, drawing attention from both academics and industry. Alongside later ETSI Quantum Safe Cryptography workshops and the Institute for Quantum Computing, it institutionalised the field.

2011 · 15 years ago

Jintai Ding proposed LWE and Ring-LWE key exchange at the University of Cincinnati

Ding filed the fundamental idea of using learning-with-errors and ring-LWE problems for key exchange, including a rounding signal bit. The construction became the basis of the lattice-based key exchange family that later dominated post-quantum standardisation.

2012 · 14 years ago

Jintai Ding published the Ring-LWE key exchange paper after a provisional patent filing

The paper describing the LWE and Ring-LWE key exchange appeared in 2012, following a provisional patent application filed the same year. Publication made the approach available for subsequent extensions by other researchers.

2012 · 14 years ago

Güneysu, Lyubashevsky and Pöppelmann published the GLP lattice signature scheme

The GLP signature provided a practical lattice-based signature construction. Later research results were folded into the GLYPH variant, which revised GLP in light of post-publication analysis.

2013 · 13 years ago

The Snowden disclosures exposed efforts to weaken cryptographic standards from within

Edward Snowden's disclosures about the NSA both exposed efforts to weaken cryptographic standards from within — the Dual_EC_DRBG backdoor and the Bullrun programme — and confirmed that even the largest classical supercomputers of the time could not break correctly implemented public-key cryptosystems. The first damaged confidence in closed standard-setting and pushed NIST toward the transparent, competitively judged process later used to select post-quantum algorithms; the second framed the quantum computer, rather than classical computing power, as the decisive future threat to public-key cryptography.

2014 · 12 years ago

Chris Peikert presented a lattice key transport scheme extending Ding's idea

Peikert's construction followed the same basic idea as Ding's, reusing the additional rounding signal bit. It became one of the reference lattice key-encapsulation designs, with parameter sets giving roughly 6956-bit public keys at above 128-bit security.

2015 · 11 years ago

Eurocrypt 2015 authors presented an authenticated key exchange with provable forward security

The scheme extended the HMQV construction of Crypto 2005 to the lattice setting, following Ding's basic idea. The paper supplied parameters and key sizes for security levels from 80 to 350 bits, aiding practical deployment analysis.

2016 · 10 years ago

NIST launched a public competition to select quantum-resistant algorithms

The call for proposals followed warnings that a sufficiently capable quantum computer could break the RSA and elliptic-curve cryptography underlying most internet security, setting in motion the process that produced the eventual standards.

2016 · 10 years ago

Yongge Wang proposed the RLCE random linear code encryption scheme

Wang's RLCE scheme built on McEliece-style code-based encryption. It added to the code-based family that provided an alternative to lattice assumptions in post-quantum encryption.

late 2016 · 10 years ago

Open Quantum Safe project was founded to prototype quantum-resistant cryptography

The OQS project set out to develop and prototype implementations of post-quantum algorithms, including key exchange schemes. It became a common open-source substrate for experimentation and integration ahead of formal standards.

2016 · 10 years ago

Google ran post-quantum TLS experiments in live traffic

Google used hybrid schemes combining a post-quantum algorithm with conventional elliptic-curve cryptography in TLS tests in 2016 and again in 2019. The hybrid design meant that a break of the experimental algorithm would not expose the protected data.

Early 2026 · this year

Cloudflare and major browser vendors pushed post-quantum key exchange toward the default for web traffic

Following Chrome's move to enable hybrid post-quantum key exchange by default from 2024, the share of encrypted web traffic using quantum-safe key establishment continued to grow through early 2026, according to content delivery networks that measure protocol adoption.

Early 2026 · this year

The UAE's Technology Innovation Institute expanded applied post-quantum cryptography research

The Abu Dhabi-based institute broadened work on post-quantum implementation and side-channel resistance, part of a wider Gulf effort to build sovereign expertise in quantum-safe security rather than rely solely on standards imported from the United States or Europe.

March 2025 · last year

NIST selected HQC as a structurally different backup algorithm

The code-based scheme was chosen to complement the lattice-based ML-KEM standardised in 2024, giving encryption a second mathematical foundation in case future cryptanalysis weakens lattice-based assumptions.

• The decision was framed as insurance against a lattice break

2025 · last year

The European Commission and EU member states endorsed a coordinated roadmap for quantum-safe migration

The plan set common milestones for member states to inventory cryptographic systems and begin migrating critical infrastructure to post-quantum algorithms, aiming for substantial completion around 2030 across the bloc's public administrations and regulated sectors.

2025–2026 · this year

India pressed ahead with quantum-safe cryptography research and financial-sector planning

Research hubs funded under India's National Quantum Mission continued work on quantum-safe cryptography, while Indian financial regulators and payment bodies began assessing timelines for migrating banking systems away from algorithms vulnerable to quantum attack.

2025–2026 · this year

Japan's CRYPTREC continued assessing NIST's finalised algorithms for domestic adoption

Japan's cipher evaluation body reviewed ML-KEM, ML-DSA and related algorithms for possible inclusion in the government's recommended cipher list, continuing a multi-year assessment of which cryptographic standards Japanese public systems are permitted to use.

August 2024 · 2 years ago

NIST finalised its first three post-quantum cryptography standards

NIST published the final versions of its first three post-quantum cryptography standards, FIPS 203, 204 and 205, setting out algorithms for general encryption and digital signatures based on the schemes previously known as Kyber, Dilithium and SPHINCS+, with a fourth standard expected near the end of the year. Standardisation gave industry and governments a formal basis for migration away from RSA and elliptic-curve cryptography, converting a research field into the foundation for compulsory and commercial transition worldwide.

• The three standards each formalised a different algorithm from the finalist pool

February 2024 · 2 years ago

Apple announced the PQ3 protocol for iMessage

Apple said it would upgrade iMessage to a post-quantum protocol using ongoing keying, aiming to replace the existing protocol in all supported conversations by the end of 2024. It marked post-quantum cryptography's arrival in a default consumer messaging platform at scale.

2024 · 2 years ago

Singapore's Cyber Security Agency urged critical infrastructure operators to begin quantum-safe migration planning

Guidance directed operators of power, water, telecommunications and financial infrastructure to inventory cryptographic dependencies and prepare migration plans, positioning Singapore among the earlier movers in Southeast Asia on quantum-safe transition.

Late 2024 · 2 years ago

The Australian Signals Directorate set 2030 as the deadline to retire vulnerable public-key algorithms

Updated guidance in the Information Security Manual directed government systems to phase out RSA and elliptic-curve cryptography in favour of post-quantum alternatives, one of the more aggressive national transition timelines set anywhere to date.

Late 2024 · 2 years ago

South Korea moved its own KpqC competition toward final algorithm selection

The National Security Research Institute's multi-year effort to develop domestically designed lattice- and code-based algorithms advanced toward selection, giving South Korea an alternative to relying solely on NIST's US-led standards.

• The domestic push echoed similar thinking elsewhere in Asia

August 2023 · 3 years ago

Google released a FIDO2 security key with ECC/Dilithium hybrid signatures

Developed in partnership with ETH Zürich, the implementation combined elliptic-curve and lattice-based Dilithium signatures in a hardware authenticator. It demonstrated post-quantum signatures in constrained consumer security devices.

2023 · 3 years ago

Signal adopted PQXDH in its messaging protocol

The Signal Protocol began using Post-Quantum Extended Diffie–Hellman, bringing quantum-resistant key agreement into mass-market secure messaging. It was among the first large-scale production deployments of post-quantum key exchange.

2022 · 4 years ago

A classical cryptanalysis broke SIKE within days, eliminating the isogeny-based finalist

Wouter Castryck and Thomas Decru showed that SIKE, the supersingular isogeny encryption scheme still under NIST review, could be broken within days on an ordinary computer, removing an entire mathematical family from contention. Because Google's 2019 TLS experiment had used SIKE in a hybrid with X25519, the non-post-quantum layer still protected the data in that deployment.

2022 · 4 years ago

NIST selected the first four post-quantum algorithms to standardise

CRYSTALS-Kyber was chosen for general encryption and CRYSTALS-Dilithium, Falcon and SPHINCS+ for digital signatures, the outcome of a six-year public evaluation that eliminated dozens of competing designs through open cryptanalysis.

• Four further candidates advanced to a fourth evaluation round as potential backups

September 2020 · 6 years ago

NTRU submitters selected ntruhps2048509 parameters for the NIST process

The NIST submission fixed n = 509 and q = 2048 for 128-bit security, yielding a 699-byte public key and 935-byte private key. Compact keys made NTRU one of the more deployable lattice candidates.

2019 · 7 years ago

IBM Q quantum computer team factored 15 and 21 but not 35

A team using the IBM Q machine managed to factor only very small integers, failing at 35. The result illustrated how far practical quantum hardware remained from breaking realistic key sizes such as RSA-2048.

2017 · 9 years ago

NIST opened formal evaluation of 82 candidate algorithms

Round one of the standardisation process drew submissions from research teams across North America, Europe and Asia, beginning years of public cryptanalysis that eliminated most candidates before a shortlist emerged.

March 2016 · 10 years ago

Azarderakhsh, Jao, Kalach, Koziel and Leonardi halved the bits transmitted in SIDH

Their paper showed how to cut the number of bits transmitted in the supersingular isogeny Diffie–Hellman protocol by half. Further work by Costello, Jao, Longa, Naehrig, Renes and Urbanik reduced compressed SIDH public keys to 2640 bits, making isogeny schemes competitive on bandwidth.