NIST Post-Quantum Cryptography and the Race to Replace RSA and ECC
NIST's post-quantum program moved quantum-resistant cryptography from research candidates to deployable standards, beginning a long migration away from RSA and elliptic-curve systems vulnerable to large quantum computers.
The post-quantum problem is a migration problem before it is a quantum-computer problem
RSA and elliptic-curve cryptography protect authentication, software updates, VPNs, web sessions and many other systems. A sufficiently capable quantum computer running Shor-style algorithms could break the mathematical problems on which those public-key systems rely. No such cryptographically relevant quantum computer is known to exist today, but systems cannot wait until one appears to begin replacement. NIST’s post-quantum program now tells organizations to start migration because standards, protocols, products and cryptographic inventories take years to change.[1]
Long-lived secrets create a harvest-now-decrypt-later risk
An adversary can collect encrypted traffic today and hope to decrypt it later if the protected information remains valuable when quantum capabilities arrive.
NIST began an open competition-like standardization process in 2016
NIST launched its Post-Quantum Cryptography Standardization Process to evaluate public-key algorithms designed to resist both classical and quantum attacks. The program attracted submissions from international research teams and progressed through multiple rounds of public cryptanalysis and performance evaluation.[1] The method was intentionally cautious. New cryptography needs time for researchers to attack candidate constructions, compare implementation tradeoffs and identify weaknesses before the algorithms become infrastructure.
FIPS 203 made ML-KEM the primary standardized mechanism for quantum-resistant key establishment
In August 2024 NIST finalized FIPS 203, 204 and 205.[2] FIPS 203 specifies ML-KEM, derived from CRYSTALS-Kyber, as a key-encapsulation mechanism for establishing shared secrets over an untrusted network. A KEM does not directly replace every use of RSA encryption, but it supplies the key-establishment primitive that protocols can integrate into secure sessions. NIST continues to recommend migration toward the finalized standards rather than waiting for additional candidates.[1]
Post-quantum deployment changes protocols as well as algorithms
Key sizes, message sizes, handshake flows and hardware constraints differ, so replacing one primitive may require changes across libraries, certificates, protocols and devices.
FIPS 204 and 205 created two distinct standardized signature families
FIPS 204 specifies ML-DSA, derived from CRYSTALS-Dilithium, as the primary lattice-based digital-signature standard. FIPS 205 specifies SLH-DSA, derived from SPHINCS+, using a stateless hash-based design.[2] NIST intentionally standardized more than one mathematical approach because cryptographic diversity provides resilience if future research weakens one family. Signature migration is especially important for software signing, identity systems and long-lived roots of trust where verification infrastructure may persist for decades.
HQC added a backup key-establishment path based on different mathematics
In March 2025 NIST selected HQC for standardization as an additional key-encapsulation mechanism and explicitly described it as a backup to ML-KEM.[3] HQC is based on error-correcting codes rather than the structured-lattice mathematics underlying ML-KEM. NIST said the diversity matters in case a weakness is found in the primary approach. The planned HQC standard was still under development as of September 2026, while ML-KEM remained the recommended general-purpose choice.[1][3]
Algorithm diversity is insurance against future cryptanalysis
A standards portfolio is more resilient when not every critical primitive depends on the same mathematical assumption.
The migration now has concrete federal deadlines as well as technical standards
In June 2026 U.S. Executive Order 14412 directed federal agencies to accelerate migration of high-value and high-impact systems, including deadlines of December 31, 2030 for post-quantum key establishment and December 31, 2031 for digital signatures in those systems.[4] This changed the policy environment. Post-quantum migration is no longer only a research recommendation; for important federal systems it has become a dated modernization obligation tied to inventory, acquisition and implementation planning.
Crypto agility became a central lesson because this migration will not be the last
NIST’s 2026 publications emphasize cryptographic agility: organizations need architectures that can discover where algorithms are used and replace them without rebuilding entire systems.[5] The difficulty of moving away from RSA and ECC exposes decades of hidden cryptographic coupling inside protocols, firmware, certificates, APIs and hardware. A system that treats one algorithm as permanent accumulates migration debt. Post-quantum planning therefore includes inventories, abstraction layers, interoperable testing and vendor coordination, not only choosing a new primitive.
Cryptographic inventory is a prerequisite for cryptographic replacement
An organization cannot migrate algorithms it does not know it is using, especially when keys and certificates are embedded in appliances, libraries and third-party services.
Why NIST’s post-quantum program belongs in the history of cryptographic trust
NIST’s post-quantum program belongs in security history because it is one of the largest coordinated replacements of public-key assumptions since modern cryptography became infrastructure. The first three standards moved PQC from candidate algorithms to deployable federal standards, HQC added mathematical diversity, and 2026 policy converted migration into an operational timetable.[2][3][4]
The transition also illustrates an unusual property of cryptographic infrastructure: systems must prepare for an attacker capability that may arrive years before anyone can predict its exact date. Waiting for a quantum break would be too late for long-lived data and deeply embedded systems.
The broader lesson is not that RSA and ECC suddenly became bad engineering. They were extraordinarily successful and remain secure against known classical attacks when correctly deployed. The lesson is that cryptographic trust is conditional on assumptions about available computation. NIST’s race to standardize and migrate is the process of changing those assumptions before the environment changes them by force.
Works Cited
- 01
- 02
- 03
- 04
- 05
CodeHistory is a living archive. Citations document the evidence used for this edition; later evidence may refine the account.
Submit a research lead