Post-Quantum Cryptography, Explained: The Four Algorithm Families Replacing RSA

A previous post on this blog covered why quantum computing threatens today's encryption and the deadline governments have put on fixing it. This one is about the fix itself — the actual replacement math, why there isn't just one, and how far the real-world rollout has actually gotten.

"Post-quantum cryptography" gets used as if it's a single technology, like there's one new algorithm waiting to swap in for RSA. In reality, NIST's post-quantum program evaluated cryptographic ideas built on at least five distinct mathematical foundations, and it has deliberately kept several of them alive in parallel rather than crowning one winner. Understanding why takes the topic from "the encryption is changing" to something genuinely useful: what's actually different about the new math, and why the people building it are hedging their bets so carefully.

Why one algorithm was never going to be enough

Three of NIST's first finalized standards — ML-KEM, ML-DSA, and FN-DSA — all rest on a branch of mathematics called lattice cryptography, which builds security around the difficulty of certain problems involving high-dimensional grids of points. That's a legitimate concern in its own right: if lattice-based math has some shared structural weakness nobody has found yet, three "different" standards could all fail at once. NIST's response was to deliberately fund and standardize alternatives built on entirely unrelated math, so the system doesn't have a single point of failure. That's the actual reason there are four families instead of one, and it's worth knowing because it changes how you read the news every time a new algorithm gets selected — it's not a replacement for the others, it's a deliberate backup.

The four families, in plain terms

Lattice-based cryptography is the workhorse. It relies on the difficulty of solving certain geometry problems in many-dimensional space — given a scrambled set of points and a small amount of intentional noise, recovering the original structure is extremely hard, even for a quantum computer. ML-KEM (for encrypting data in transit) and ML-DSA (for digital signatures) are both lattice-based, and together they're the algorithms most systems will actually run day to day, because lattice schemes tend to be fast and produce reasonably small keys.

Hash-based cryptography takes a more conservative approach. SLH-DSA (built from the earlier SPHINCS+ design) doesn't rely on any novel hard-math problem at all — it's built entirely from hash functions, the same well-understood building blocks that have secured passwords and file integrity checks for decades. The tradeoff is size: hash-based signatures tend to be considerably larger than lattice-based ones. The benefit is confidence; if you want the algorithm with the fewest new assumptions baked in, this is it.

Code-based cryptography is built on the difficulty of decoding deliberately corrupted error-correcting codes — a problem that's been studied since the 1970s and has held up well. NIST selected HQC, a code-based scheme, specifically as a structurally independent backup to lattice-based ML-KEM, with finalization expected through 2026–2027. If a weakness ever turns up in lattice math, code-based encryption is the fallback that doesn't share the same blind spot.

Multivariate cryptography is the most unsettled of the four. It builds security around the difficulty of solving large systems of polynomial equations with many variables — and unlike the other three families, NIST has been notably more cautious here. Several multivariate signature candidates suffered serious cryptanalytic attacks during evaluation in 2025, and as of NIST's May 2026 announcement, four multivariate schemes (MAYO, QR-UOV, SNOVA, and UOV) are still moving through a third round of scrutiny rather than being finalized. It's a real category with real promise, but the math is younger and the candidates have a rougher track record so far.

The rollout gap nobody's headline mentions

Finalizing the standards in 2024 turned out to be the easy part. A 2025 survey of more than a thousand senior cybersecurity managers found that while 69% recognized quantum computing as a threat to their encryption, only about 5% had actually deployed quantum-safe encryption anywhere in their systems. A separate 2026 industry study put active "transitioning" closer to 40% — a more encouraging number, but one that likely counts planning and assessment work rather than completed deployment. The most concrete measurement is also the starkest: a 2026 scan of over 32,000 live domains found that not a single one was using a hybrid post-quantum TLS certificate, meaning the certificates that authenticate most of the websites you visit are still entirely classical.

That gap is closing, just unevenly. Google has begun defaulting some of its own connections to quantum-safe key exchange in 2026, and the certificate authority industry is independently forcing the issue by shortening public TLS certificate lifespans toward a 47-day validity window — a change aimed at building the automated, frequently-renewed certificate infrastructure that post-quantum migration will eventually require, whether or not any given organization is thinking about quantum computers yet.

What this actually means if you run anything online

• You're very likely not behind schedule — the data above suggests almost no one has fully migrated yet, including large, well-resourced organizations. The realistic move in 2026 is building a cryptographic inventory (knowing where RSA and ECC are actually used in your stack) rather than panicking about a deployment deadline.
• Your cloud provider, CMS, and CA are doing more of this than you think. AWS, Azure, and Google Cloud all have public post-quantum TLS roadmaps, and certificate authorities are restructuring their entire issuance model around shorter, more automatable certificate lifecycles specifically to support this transition.
• The "harvest now, decrypt later" risk doesn't wait for your migration schedule. Data that needs to stay confidential for five-plus years is the priority category, regardless of how far off a capable quantum computer actually is.

For the underlying math — what a hash function or a public key actually is, from first principles — Cryptography 101 is the place this whole series of posts is really pointing back to.

---