How to Use Post-Quantum Cryptography

Problem

Shor's algorithm will break RSA and ECC once large-scale quantum computers arrive. You need to transition to post-quantum cryptography (PQC) but are unsure which algorithms to choose and how to hybridize them safely.

Prerequisites

• Understanding of public-key cryptography (RSA, ECDH, ECDSA)
• Familiarity with key encapsulation mechanisms (KEM) and digital signatures
• Knowledge of NIST PQC standardization process

Steps

1. 1. Identify vulnerable cryptographic primitives

   Audit your system for RSA key exchange, RSA signatures, ECDH key exchange, and ECDSA signatures. These are all vulnerable to Shor's algorithm. Symmetric encryption (AES) and hashing (SHA-2/3) only lose half their security bits to Grover's algorithm, so AES-256 and SHA-256/512 remain quantum-safe with doubled key sizes.

   Input

   RSA-2048, ECDH-P256, ECDSA-P256

   Output

   vulnerable: RSA-2048, ECDH-P256, ECDSA-P256 | safe: AES-256, SHA-256

2. 2. Select NIST-standardized PQC algorithms

   Use ML-KEM-768 (formerly Kyber) for key encapsulation, replacing ECDH/RSA key exchange. Use ML-DSA-65 (formerly Dilithium) for digital signatures, replacing RSA/ECDSA. For stateful hash-based signatures, use SLH-DSA (formerly SPHINCS+). ML-KEM-1024 and ML-DSA-87 provide NIST Level 5 security (equivalent to AES-256).

   Input

   security level: 3 (AES-192 equivalent)

   Output

   KEM: ML-KEM-768 | signature: ML-DSA-65

3. 3. Implement hybrid key exchange

   Do not deploy PQC algorithms alone initially. Use a hybrid approach: combine classical ECDH with ML-KEM by XORing or concatenating the shared secrets. This ensures that if the PQC algorithm is later broken, the classical component still provides security, and vice versa. Generate both classical and PQC key pairs, perform both exchanges, then derive the final key with HKDF over the concatenated shared secrets.

   Input

   ECDH-P256 + ML-KEM-768

   Output

   shared_secret = HKDF(ECDH_ss || MLKEM_ss)

4. 4. Test and validate the implementation

   Verify that the KEM decapsulation produces the correct shared secret. Test signature verification with valid and invalid signatures. Check that key sizes and ciphertext sizes match the NIST specifications (ML-KEM-768 public key: 1184 bytes, ciphertext: 1088 bytes). Use the hash tool to verify known-answer test vectors against NIST KAT vectors.

   Input

   ML-KEM-768 KAT vector

   Output

   shared_secret matches reference

Expected result

A hybrid post-quantum cryptographic system using ML-KEM and ML-DSA that resists both classical and quantum attacks, with fallback security from the classical component.

Common errors

Deploying PQC algorithm without hybrid fallback

Always use hybrid mode (classical + PQC) during the transition period. If the PQC algorithm has an undiscovered flaw, the classical component preserves security.

Using superseded algorithm names (Kyber, Dilithium)

Use the NIST FIPS 203/204/205 standardized names: ML-KEM, ML-DSA, SLH-DSA. The older names refer to pre-standardization variants with different parameters.

Ignoring larger key and ciphertext sizes

PQC keys are much larger (ML-KEM-768 public key: 1184 bytes vs ECDH-P256: 32 bytes). Update protocols, buffers, and storage to accommodate these sizes.

Troubleshooting

• If performance is a concern, ML-KEM is faster than ECDH on most platforms, but ML-DSA signatures are larger than ECDSA. Benchmark on your target hardware.
• For TLS, use the hybrid key exchange groups defined in IETF drafts (e.g., X25519MLKEM768) rather than custom combinations.
• If interoperability fails, verify you are using the same parameter set and that the implementation follows FIPS 203 exactly.

Security limits

• Post-quantum algorithms are newer and have less cryptanalytic maturity than RSA/ECC. Hybrid mode mitigates this risk.
• All cryptographic operations are performed locally; no keys or secrets are transmitted.
• PQC does not protect against all quantum attacks — Grover's algorithm still halves symmetric key security.