A New Approach to Reducing Quantum Error-Correction Overhead

Post-Quantum Cryptography Has Entered the Migration Phase

Post-quantum cryptography is no longer only a research topic. The first finalized NIST post-quantum cryptography standards have been available since 2024, and organizations are now being encouraged to begin migration planning.

The reason is straightforward: widely deployed public-key systems such as RSA and elliptic-curve cryptography could eventually be vulnerable to sufficiently capable quantum computers.

The important word is eventually. There is no current quantum computer capable of breaking ordinary internet encryption at the required scale, but replacing cryptographic infrastructure can take many years. Organizations therefore need to prepare before the threat becomes operational.

NIST Has Finalized the First Standards

In August 2024, NIST approved three Federal Information Processing Standards for post-quantum cryptography.

FIPS 203 specifies ML-KEM, a key-encapsulation mechanism designed to establish shared secrets in a way intended to resist quantum attacks.

FIPS 204 specifies ML-DSA, a post-quantum digital signature standard.

FIPS 205 specifies SLH-DSA, a stateless hash-based digital signature standard.

These names matter because older references often describe the algorithms by their pre-standardization project names. ML-KEM is derived from the CRYSTALS-Kyber submission, while ML-DSA is derived from CRYSTALS-Dilithium.

NIST has also selected HQC as an additional algorithm for future standardization work, providing a different mathematical approach that can complement ML-KEM.

Migration Is a Long Engineering Project

Replacing a cryptographic algorithm is rarely as simple as changing a configuration file.

Organizations may have encryption embedded in web services, VPNs, certificates, mobile applications, databases, operating systems, hardware devices, identity systems, and internal protocols.

Some systems may also depend on cryptography supplied indirectly through third-party libraries or hardware.

The first step is therefore inventory.

Security teams need to know where public-key cryptography is being used, which algorithms are involved, what data is protected, how long that data needs to remain confidential, and which systems cannot be upgraded quickly.

This is the foundation of cryptographic agility: the ability to replace algorithms without redesigning an entire product or infrastructure stack.

Harvest Now, Decrypt Later

One reason migration has urgency is the possibility of “harvest now, decrypt later” attacks.

An attacker can collect encrypted information today and store it for future decryption if a sufficiently capable quantum computer becomes available.

This creates a particular concern for information with a long confidentiality lifetime.

Government records, intellectual property, financial information, healthcare data, and strategic research may remain sensitive for many years. The relevant risk is therefore not only whether encryption can be broken today, but whether data captured today could become readable in the future.

That makes long-lived information a useful priority for migration planning.

2035 Is a Planning Horizon

NIST's current migration guidance says organizations should begin moving toward quantum-resistant cryptography now. Under its transition planning, quantum-vulnerable algorithms are expected to be deprecated and ultimately removed from NIST standards by 2035, with higher-risk systems moving earlier.

This should not be interpreted as a single deadline by which every private-sector system will suddenly stop working.

Migration schedules depend on industry, regulation, system architecture, data sensitivity, and supplier dependencies.

The practical implication is that organizations should not wait for a quantum computer to become capable of breaking RSA or ECC. By that point, the migration window for complex systems could already be too narrow.

Hybrid Cryptography Can Help

During the transition, some systems can use hybrid approaches that combine classical and post-quantum mechanisms.

The purpose is to reduce dependence on a single cryptographic assumption while ecosystems transition toward new standards.

Hybrid deployment can be particularly useful where compatibility with existing systems remains important. However, it also increases implementation complexity and should be handled through well-defined standards rather than improvised combinations.

What Technology Teams Should Do

A practical PQC migration program can start with five steps.

First, inventory cryptographic dependencies across applications, devices, certificates, APIs, and network protocols.

Second, identify systems protecting data with long confidentiality requirements.

Third, check whether major vendors and cloud providers have published migration plans for the products in use.

Fourth, design systems so cryptographic algorithms can be replaced without major application rewrites.

Fifth, begin testing standardized algorithms such as ML-KEM and ML-DSA in controlled environments.

The objective is not to replace every RSA or ECC deployment immediately. The objective is to understand where those algorithms are embedded and create a realistic path toward replacement.

The Security Lesson

Post-quantum cryptography is best understood as an infrastructure migration problem rather than a prediction about the arrival date of a quantum computer.

Quantum hardware will continue to develop, and the exact timing of a cryptographically relevant quantum computer remains uncertain. What is much less uncertain is the time required to inventory legacy systems, update protocols, test interoperability, replace certificates, upgrade hardware, and coordinate third-party dependencies.

The organizations that start with inventory and cryptographic agility can manage that transition gradually. Those that wait for a definitive quantum breakthrough may face a much more difficult migration under time pressure.