On August 13, 2024, the U.S. National Institute of Standards and Technology released three finalized post-quantum cryptographic standards — the culmination of an eight-year global standardization process that began when NIST first issued its call for quantum-resistant algorithm submissions in 2016. Two of the three standards are lattice-based: ML-KEM (Module-Lattice Key Encapsulation Mechanism, derived from CRYSTALS-Kyber) for key establishment, and ML-DSA (Module-Lattice Digital Signature Algorithm, derived from CRYSTALS-Dilithium) for digital signatures. The third, SLH-DSA, is hash-based. NIST urged organizations to begin migrating immediately. The National Security Agency has set 2030 as the mandatory migration deadline for National Security Systems. NIST’s own transition plan calls for deprecating quantum-vulnerable algorithms from its standards by 2035.
These are not theoretical recommendations for a distant future. They are active requirements responding to a present threat — and the infrastructure most at risk is the kind that cannot easily be updated.
Why Current Cryptography Is Vulnerable
The encryption protecting most of the internet, financial systems, and critical infrastructure today rests on two mathematical problems: the difficulty of factoring large integers (the basis of RSA) and the difficulty of computing discrete logarithms (the basis of elliptic curve cryptography). Classical computers cannot solve these problems efficiently at the key sizes in use. Quantum computers, running an algorithm developed by Peter Shor in 1994, can — in principle reducing the time to break RSA-2048 from billions of years to hours, once a sufficiently large, error-corrected quantum computer exists.
IBM Research described this threat plainly: “A cryptographically relevant quantum computer could break RSA-2048 in a matter of hours by applying Shor’s algorithm.” Such a computer does not yet exist, but the timeline for its arrival is actively debated, with expert estimates ranging from a decade to several decades. The uncertainty itself creates an immediate problem: adversaries conducting harvest-now-decrypt-later attacks are collecting encrypted data today — intercepting encrypted communications, copying encrypted databases — with the intention of decrypting that information once quantum capabilities arrive. Data encrypted today with RSA or elliptic curve cryptography that must remain confidential for ten or more years is already potentially compromised.
The Mathematical Foundation of Lattice Cryptography
Lattice-based cryptography rests on a different class of mathematical problem — specifically, the Learning with Errors (LWE) problem and its variants. A lattice is a regular grid of points in high-dimensional space. The LWE problem asks: given a set of equations of the form Ax + e = b (where x is a secret vector, e is a small random error, and A and b are known), find x. The error term makes the equations overdetermined in a way that prevents the solution techniques that work for systems of linear equations without error. No known quantum algorithm — including Shor’s — provides efficient solutions to LWE at the parameter sizes used in the standards. The NIST standardization process subjected these algorithms to eight years of public cryptanalytic scrutiny before finalizing them.
ML-KEM provides IND-CCA2 secure key encapsulation — a property ensuring that even an attacker who can query a decapsulation oracle learns nothing about the encapsulated key — as a direct replacement for RSA and ECDH key exchange protocols. ML-DSA provides EUF-CMA secure signatures as a replacement for ECDSA and RSA signatures. Both operate efficiently on modern hardware, with key and signature sizes larger than their classical equivalents but within practical bounds for most applications.
The Critical Infrastructure Migration Challenge
The challenge of deploying lattice-based cryptography in critical infrastructure is not primarily mathematical — the algorithms are standardized — but operational. Critical infrastructure systems present a specific set of migration difficulties that consumer software and internet protocols do not face.
Power grid control systems (SCADA and industrial control systems) run on hardware and firmware that may be decades old, cannot be easily updated, and operate in real-time environments where cryptographic latency directly affects control loop performance. A smart grid sensor that must transmit control commands within 10 milliseconds cannot afford authentication delays that bulk encryption in a data center would tolerate. Financial clearing systems process millions of transactions per second with strict latency requirements and audit trail obligations that complicate protocol changes. Government communications infrastructure spans classified and unclassified systems with different certification requirements, operated by different agencies, under different procurement timelines.
A 2024 draft NIST IR 8547 transition guidance document explicitly addressed these challenges, noting that past cryptographic migrations have taken nearly 20 years to complete and that the post-quantum migration presents additional complexities because it requires re-engineering many security protocols and updating infrastructure across both public and private sectors simultaneously.
The Hybrid Approach
For critical infrastructure operators who cannot simply replace existing systems, the recommended near-term approach is hybrid cryptography: running classical and post-quantum algorithms in parallel, so that security is maintained if either the classical or the post-quantum algorithm is compromised. A hybrid key exchange would combine, for example, ECDH key establishment with ML-KEM key establishment, deriving a session key from both outputs. An attacker would need to break both algorithms simultaneously to compromise the session — providing protection against both classical attacks on the lattice algorithm (unlikely given the standardization vetting) and quantum attacks on the classical algorithm.
This approach allows incremental migration: existing infrastructure continues to operate while new post-quantum components are added alongside it, validated in production environments before classical cryptography is eventually removed. NIST’s migration guidance specifically recommends this approach for high-risk systems where both performance and security continuity requirements are stringent.
Implementation Vulnerabilities Require Attention
The standards themselves are robust, but their implementations may not be. A 2024 paper demonstrated an improved side-channel attack on CRYSTALS-Kyber implementations on ARM Cortex-M4 processors — using power analysis to recover the secret key with as few as 15 power traces in approximately 10 minutes. This attack works not against the mathematical algorithm but against the physical implementation: the power consumption of the microprocessor varies with the data it is processing in ways that leak information about secret values.
Side-channel attacks are a known challenge for all cryptographic implementations, classical and post-quantum alike. But they are particularly relevant for critical infrastructure contexts where attackers may have physical access to devices or the ability to monitor power consumption remotely through the power grid itself. Constant-time implementations that eliminate power and timing variations correlated with secret data are well understood in principle but require careful engineering for each new algorithm and each hardware platform.
Why It Matters
The quantum computing threat to current cryptography is not a remote possibility — it is a near-certainty on a timeline that overlaps with the life expectancy of infrastructure built today. A power substation commissioned this year may still be operating in 2050. Financial systems built today will handle transactions whose records must be confidential for decades. Government communications infrastructure built during this decade will protect information whose sensitivity does not expire on a convenient schedule. The mathematics underlying RSA and elliptic curve cryptography — which has protected digital infrastructure for 40 years — will eventually be breakable by machines that do not yet exist. Lattice-based cryptography offers the replacement that NIST has now standardized, the migration timeline has been specified, and the work of deploying it across the systems that underpin modern society has begun.
Closing Human Dimension
The encryption protecting a hospital’s patient records, a utility’s grid control systems, or a bank’s transaction clearing network is invisible — it works in background processes that none of the people depending on it ever see or think about. Its failure would also be invisible until consequences arrived: patient records in adversarial hands, grid control commands spoofed, financial transactions manipulated. Lattice mathematics is not a household concept. But the protection it provides — against threats that are years away but already being prepared for — is the kind of infrastructure investment whose value is measured in problems that never happen rather than crises that do.
Sources
1. NIST. “Post-Quantum Cryptography.” Official NIST PQC project page. https://csrc.nist.gov/projects/post-quantum-cryptography
2. NIST. “Migration to Post-Quantum Cryptography — Frequently Asked Questions.” NIST NCCoE. https://pages.nist.gov/nccoe-migration-post-quantum-cryptography/
3. NIST IR 8547 Initial Public Draft. “Transition to Post-Quantum Cryptography Standards.” (November 2024). https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8547.ipd.pdf
4. IBM Research. “NIST’s post-quantum cryptography standards are here.” (2024). https://research.ibm.com/blog/nist-pqc-standards
5. PostQuantum.com. “Post-Quantum Cryptography (PQC) Standardization — 2025 Update.” (September 2025). https://postquantum.com/post-quantum/cryptography-pqc-nist/
6. Wang, K. et al. (2024). “An Improved Two-Step Attack on Lattice-Based Cryptography: A Case Study of Kyber.” arXiv. https://arxiv.org/pdf/2407.06942 — documents side-channel vulnerability in ML-KEM implementations.
7. “Quantum-Safe Code Auditing: LLM-Assisted Static Analysis and Quantum-Aware Risk Scoring for Post-Quantum Cryptography Migration.” arXiv (2025). https://arxiv.org/pdf/2604.00560
8. “Post-Quantum Cryptography and Quantum-Safe Security: A Comprehensive Survey.” arXiv (2025). https://arxiv.org/pdf/2510.10436
Idea generated by Grok. Article expanded with Grok, substantially rewritten with Claude Sonnet 4.6. Published at artificialideas.org.
Artificial Ideas 