TUTORIAL

How to Use Quantum Resistant Algorithms

Select and deploy quantum-resistant cryptographic algorithms that maintain security against both quantum and classical attacks.

Problem

You need cryptographic algorithms that remain secure against quantum computer attacks (Shor's and Grover's algorithms) while maintaining performance and interoperability with existing systems.

Prerequisites

Understanding of quantum computing threats to cryptography
Familiarity with symmetric and asymmetric cryptography
Knowledge of NIST PQC standardization results

Steps

1. Assess quantum vulnerability of current algorithms

Shor's algorithm breaks all widely-deployed public-key algorithms: RSA, DSA, ECDSA, ECDH, and all ECC-based schemes — polynomial time on a quantum computer. Grover's algorithm provides quadratic speedup for brute-force, meaning symmetric keys lose half their security bits: AES-256 → 128-bit quantum security, SHA-256 → 128-bit quantum security. Symmetric algorithms with 256-bit keys remain quantum-safe. Use the hash comparison and RSA tools to assess current usage.
Input
```
current: RSA-2048, AES-128, SHA-256, ECDH-P256
```
Output
```
quantum-vulnerable: RSA-2048, AES-128, ECDH-P256 | quantum-safe: SHA-256 (128-bit q-security)
```
2. Upgrade symmetric cryptography to 256-bit security

Replace AES-128 with AES-256 (quantum security: 128 bits). Replace SHA-256 with SHA-384 or SHA-512 if 128-bit quantum security is insufficient (SHA-256 gives 128-bit quantum security, generally adequate). Use SHA-3-256 or SHA-3-512 for diversity from SHA-2. Replace HMAC-SHA256 with HMAC-SHA384 for 192-bit quantum security. These changes are backward-compatible in most protocols and provide immediate quantum resistance for symmetric operations.
Input
```
AES-128-CBC, SHA-256, HMAC-SHA256
```
Output
```
AES-256-GCM, SHA-384, HMAC-SHA384 (quantum-safe)
```
3. Replace public-key algorithms with PQC alternatives

Replace key exchange: ECDH/RSA → ML-KEM (FIPS 203). Replace signatures: RSA/ECDSA → ML-DSA (FIPS 204) or SLH-DSA (FIPS 205). Use hybrid mode during transition: combine classical (X25519/P-256) with PQC (ML-KEM-768) so security holds if either component is secure. For signatures, use hybrid signatures (classical + PQC) or switch to PQC directly with hash-based fallback. Use the modular exponentiation and hash tools for understanding.
Input
```
ECDH-P256 key exchange
```
Output
```
hybrid: X25519 + ML-KEM-768 (classical + post-quantum)
```
4. Plan the cryptographic migration timeline

Follow the 'harvest now, decrypt later' threat model: adversaries may store encrypted data now to decrypt when quantum computers arrive. Prioritize migrating long-lived data first. Use crypto-agility: design systems to swap algorithms without protocol changes (named groups, algorithm negotiation). Deploy hybrid mode first (immediate protection), then transition to pure PQC as confidence grows. Set deadlines based on data sensitivity lifetimes and quantum computer progress estimates.
Input
```
data lifetime: 50 years | quantum ETA: 10-20 years
```
Output
```
priority: migrate long-lived data now | deploy hybrid immediately
```

Expected result

A cryptographic infrastructure using quantum-resistant algorithms (AES-256, SHA-384, ML-KEM, ML-DSA) with hybrid fallback, protecting against both current and future quantum attacks.

Common errors

Assuming AES-128 is quantum-safe: AES-128 provides only 64-bit quantum security (Grover's). This is insufficient. Use AES-256 for 128-bit quantum security.
Deploying PQC without hybrid fallback: PQC algorithms are newer with less cryptanalytic history. Hybrid mode (classical + PQC) ensures security if the PQC algorithm is later broken.
Ignoring 'harvest now, decrypt later' threat: Adversices may store currently-encrypted data to decrypt with future quantum computers. Migrate long-lived, sensitive data first, even if quantum computers seem distant.

Troubleshooting

If PQC algorithms are not available in your crypto library, use libraries like liboqs, OpenSSL 3.2+, or BoringSSL with PQC patches.
If performance degrades with PQC, note that ML-KEM is often faster than ECDH, but ML-DSA signatures are larger. Benchmark the specific operations.
For TLS, use the hybrid key exchange groups in IETF drafts rather than custom implementations to ensure interoperability.

Security limits

Quantum resistance does not mean perfect security — PQC algorithms may have undiscovered weaknesses. Hybrid mode mitigates this.
All cryptographic operations are local; no keys or parameters are transmitted to third parties.
Quantum-resistant algorithms have larger keys and signatures, impacting bandwidth and storage.