Types of post-quantum cryptography are becoming a boardroom topic, not just a research lab conversation, and for good reason. On August 13, 2024, NIST finalized the first official post-quantum cryptography standards, marking the starting point of a migration every business handling sensitive data will eventually need to complete.
This guide breaks down the different types of post-quantum cryptography, the mathematical approaches behind each one, and what your organization should be doing about it right now as part of a broader cybersecurity risk management strategy.
Table of Contents
- What Is Post-Quantum Cryptography
- Why Understanding the Types of Post-Quantum Cryptography Matters Right Now
- The 4 Main Types of Post-Quantum Cryptography
- Type 1: Lattice Based Cryptography
- Type 2: Hash Based Cryptography
- Type 3: Code Based Cryptography
- Type 4: Multivariate Cryptography
- NIST’s Official Standards: Which Types of Post-Quantum Cryptography Made the Cut
- Which Type of Post-Quantum Cryptography Should Your Business Actually Use
- How These Types of Post-Quantum Cryptography Fit Your Network Security Architecture
- Data Protection, Data Governance, and Long Term Risk
- VPNs, IT Security Solutions, and Post-Quantum Readiness
- How to Start Your Post-Quantum Migration
- Common Misconceptions About the Types of Post-Quantum Cryptography
- Frequently Asked Questions
- Get Your Cryptographic Risk Assessed
What Is Post-Quantum Cryptography
Post-quantum cryptography, often shortened to PQC, refers to a new generation of encryption and digital signature algorithms specifically designed to remain secure even against attacks from powerful future quantum computers.
Today’s most widely used encryption methods, including RSA and elliptic curve cryptography, rely on math problems that are extremely hard for classical computers to solve, but that a sufficiently powerful quantum computer could solve relatively quickly using a method called Shor’s algorithm. Understanding the different types of post-quantum cryptography is the first step toward choosing algorithms that don’t share this same quantum vulnerability, and toward building it properly into your organization’s information security program.
Why Understanding the Types of Post-Quantum Cryptography Matters Right Now
No large scale, cryptographically relevant quantum computer exists today, and experts differ on exactly when one will. But the risk isn’t purely future tense.
Security researchers describe a strategy called “harvest now, decrypt later,” where adversaries steal and store encrypted data today with the specific intention of decrypting it once quantum computers become capable enough. Any sensitive data with a long shelf life, financial records, health data, government communications, or intellectual property, is already exposed to this risk today.
This is exactly why NIST encourages organizations to integrate these algorithms into their systems as soon as possible, rather than waiting for quantum computers to actually arrive. Understanding the types of post-quantum cryptography has moved from academic curiosity to an active item on the cyber risk assessment agenda for information security teams everywhere.
The 4 Main Types of Post-Quantum Cryptography
Before diving into each family individually, it helps to see all four types of post-quantum cryptography side by side, since businesses rarely choose just one in isolation:
| Type of Post-Quantum Cryptography | Mathematical Basis | Best Suited For | Maturity |
|---|---|---|---|
| Lattice based | High dimensional lattice problems | General encryption and signatures | Highest, NIST’s primary standards |
| Hash based | Cryptographic hash functions | Conservative, backup signatures | High, but limited use cases |
| Code based | Error correcting codes | Long term research use cases | Established, large key sizes |
| Multivariate | Polynomial equation systems | Niche/experimental signatures | Lowest, unresolved breaks |
Each of these four types of post-quantum cryptography solves the quantum threat differently. Understanding the tradeoffs between them is exactly what separates a rushed migration from a well planned one.
Type 1: Lattice Based Cryptography
Lattice based cryptography is currently the most widely adopted category among the types of post-quantum cryptography, forming the foundation of NIST’s primary standards. It relies on mathematical problems involving high dimensional geometric lattices that remain difficult to solve even for quantum computers.
This family offers a strong balance of security, reasonably small key sizes, and solid performance, which is why it was chosen as the basis for both general encryption and digital signatures in NIST’s finalized standards.
Type 2: Hash Based Cryptography
Hash based cryptography is the second major category among the types of post-quantum cryptography, building digital signatures using cryptographic hash functions rather than lattice problems. Its major advantage is conservative, well understood security, since the underlying hash functions have been studied for decades.
The tradeoff is larger signature sizes and slower performance compared to lattice based alternatives, which is why this category is generally positioned as a backup or high assurance option rather than the default choice for everyday use.
Type 3: Code Based Cryptography
Code based cryptography, another one of the established types of post-quantum cryptography, relies on the mathematical difficulty of decoding certain error correcting codes without knowing a specific secret structure. This approach has one of the longest track records in cryptographic research, dating back decades.
Its main drawback is very large public key sizes, which can create practical challenges for systems with limited bandwidth or storage.
Type 4: Multivariate Cryptography
Multivariate cryptography rounds out the four major types of post-quantum cryptography and is based on the difficulty of solving systems of multivariate polynomial equations. While it has historically been considered for digital signatures, several prominent multivariate schemes have suffered significant cryptanalytic breaks during evaluation processes.
This makes it the least mature of the major post-quantum families in terms of standardized options. It remains an active area of academic research, but businesses generally aren’t relying on this category for near term production deployments.
NIST’s Official Standards: Which Types of Post-Quantum Cryptography Made the Cut
Among all the types of post-quantum cryptography, three specific algorithms have moved from academic research into official government standards, published as FIPS 203, 204, and 205:
- ML-KEM (derived from CRYSTALS-Kyber), a lattice based key encapsulation mechanism used for general encryption, such as securely accessing websites
- ML-DSA (derived from CRYSTALS-Dilithium), a lattice based algorithm chosen for general purpose digital signatures
- SLH-DSA (derived from SPHINCS+), a stateless hash based digital signature scheme used as a conservative, structurally different backup
Notice that two of these three official standards come from the lattice based family, while the third represents the hash based category. This reflects how these two types of post-quantum cryptography currently dominate real world deployment.
These three standards were approved by the Secretary of Commerce on August 13, 2024, following an eight year evaluation process that considered 82 initial algorithm submissions. You can review the full technical specifications directly through NIST’s official Computer Security Resource Center.
Which Type of Post-Quantum Cryptography Should Your Business Actually Use
For most organizations, the practical answer isn’t choosing a single type of post-quantum cryptography in isolation. A complete system typically needs both a key encapsulation mechanism and a digital signature algorithm working together.
Most enterprise deployments default to ML-KEM for encryption paired with ML-DSA for signatures. SLH-DSA is reserved for scenarios where algorithm diversity, meaning a mathematically unrelated backup, matters more than raw performance.
Businesses under stricter government or defense requirements may need parameter sets aligned with programs like the NSA’s Commercial National Security Algorithm Suite, while typical commercial deployments can rely on standard civilian parameter sets. A healthcare chief information security officer, a network security architect, or an IT security engineer evaluating these types of post-quantum cryptography should treat this as a joint decision with whoever owns cybersecurity risk management, not a purely technical call made in isolation.
How These Types of Post-Quantum Cryptography Fit Your Network Security Architecture
Post-quantum cryptography doesn’t replace your existing network security architecture, it becomes a new layer within it. VPNs, TLS certificates, email encryption, and internal service to service communication all rely on the same classical algorithms that these types of post-quantum cryptography are designed to eventually replace.
A network security assessment focused specifically on cryptographic exposure, rather than just firewall rules and access controls, is one of the clearest ways to understand where your architecture depends on algorithms that will need replacing. Many managed network security providers are beginning to fold this kind of cryptographic review into their standard assessment process, precisely because it was largely absent from traditional network security monitoring a few years ago.
Data Protection, Data Governance, and Long Term Risk
Data protection and data governance policies typically focus on access controls, retention schedules, and regulatory compliance, but rarely address the cryptographic lifespan of the data itself. This is a meaningful gap once harvest now, decrypt later risk is taken seriously.
A data governance policy that classifies information by sensitivity should also account for how long that data needs to remain confidential. Health records and long term legal documents are clear examples of data carrying meaningfully higher post-quantum urgency than data with a short useful life.
Integrating awareness of the different types of post-quantum cryptography into existing data protection frameworks is a low cost way to prioritize which systems need migration first.
VPNs, IT Security Solutions, and Post-Quantum Readiness
VPNs deserve specific attention in this conversation, since they’re often the backbone of secure remote access and are built almost entirely on classical cryptographic key exchange.
As organizations evaluate IT security solutions and VPN providers, post-quantum readiness is quickly becoming a meaningful differentiator. Some enterprise VPN and cloud security providers have already begun rolling out hybrid classical and post-quantum key exchange support.
When evaluating new IT security solutions or renewing existing contracts, it’s worth explicitly asking vendors which types of post-quantum cryptography they support, rather than assuming it will be handled automatically down the line.
How to Start Your Post-Quantum Migration
Migrating to post-quantum cryptography isn’t a single overnight switch. NIST itself has emphasized that organizations should begin preparing now even though full migration will take time.
Practical first steps include:
- Build a cryptographic asset inventory identifying every place your organization currently uses RSA, ECC, or other classical encryption, including certificates, VPNs, and internal applications.
- Prioritize systems protecting long lived sensitive data, since these carry the highest harvest now, decrypt later risk.
- Adopt crypto agility principles, designing systems so the types of post-quantum cryptography you rely on can be swapped out without a full rebuild, rather than hard coding a single algorithm indefinitely.
- Test hybrid approaches that combine classical and post-quantum algorithms together, an approach several major providers, including Cloudflare, have already deployed at scale to protect a meaningful share of encrypted traffic today.
- Monitor vendor and platform support, since browser, cloud, and infrastructure providers are rolling out support for different types of post-quantum cryptography on different timelines.
- Reassess data protection and data governance policies to explicitly account for quantum related risk, not just current, classical threats.
- Fold cryptographic exposure into existing cyber risk assessment processes, rather than treating post-quantum migration as a separate, standalone initiative.
Common Misconceptions About the Types of Post-Quantum Cryptography
A few misunderstandings show up repeatedly in this space:
- “Quantum computers are already breaking encryption today.” They aren’t yet. No current quantum computer has the scale or stability to break standard encryption in practice, though experts expect this could change within the next decade.
- “This is only a future problem.” Harvest now, decrypt later means data stolen today remains at risk once quantum decryption becomes viable, making this a present tense data protection issue.
- “Only governments and large enterprises need to worry about this.” Any business handling long lived sensitive data, financial, medical, legal, or proprietary, faces the same underlying exposure, regardless of size.
- “One algorithm fits every use case.” As the different types of post-quantum cryptography show, encryption and signature needs are typically solved by different algorithms working together, not a single universal choice.
- “Our network security architecture already handles this.” Most existing architectures were built entirely around classical cryptography and require deliberate updates to support the types of post-quantum cryptography discussed here; it doesn’t happen automatically.
Frequently Asked Questions
What is post-quantum cryptography?
It’s a category of encryption and digital signature algorithms specifically designed to remain secure against attacks from future quantum computers, unlike current standards such as RSA and ECC.
What are the main types of post-quantum cryptography?
The primary types of post-quantum cryptography are lattice based, hash based, code based, and multivariate cryptography, each relying on a different underlying mathematical problem believed to resist quantum attacks.
Is RSA encryption already broken by quantum computers?
No. No existing quantum computer is currently capable of breaking RSA or ECC encryption in practice, though experts anticipate this capability could emerge within the next decade.
What is harvest now, decrypt later?
It’s a strategy where adversaries steal and store encrypted data today with the intention of decrypting it once quantum computers become powerful enough, making current data theft a future decryption risk.
Which of the types of post-quantum cryptography should businesses use first?
Most organizations start with ML-KEM for encryption and ML-DSA for digital signatures, since these lattice based standards offer the strongest balance of performance and NIST endorsed security.
Do small businesses need to worry about post-quantum cryptography?
Any business storing long lived sensitive data should begin planning, even informally, since the harvest now, decrypt later risk doesn’t discriminate by company size.
How does this affect our VPN and remote access setup?
Most VPNs currently rely on classical key exchange methods, so businesses should ask vendors directly which types of post-quantum cryptography they support rather than assuming existing IT security solutions already include it.
How long will post-quantum migration take?
Full migration is expected to take years across most industries, which is exactly why NIST recommends starting the planning and inventory process now rather than waiting for a mandated deadline.
How can my business figure out where its actual cryptographic risk sits today?
A structured security risk assessment and penetration test can identify where outdated or vulnerable cryptographic implementations exist across your network security architecture, giving you a concrete starting point before deciding which types of post-quantum cryptography to prioritize.
Get Your Cryptographic Risk Assessed
Understanding the types of post-quantum cryptography is the easy part. Knowing exactly where your organization’s current encryption is weakest, and which systems carry the highest harvest now, decrypt later exposure, requires a real assessment of your network security architecture and data protection posture.
Book a security risk assessment with Nexus Web Security today
