Can Quantum Computers Break It? Why Lattice-Based Cryptography Is Becoming a Foundation of Post-Quantum Security

Quantum computing headlines often lead to a dramatic question:

“If powerful quantum computers arrive, will all of today’s encryption suddenly stop working?”

The answer is more complicated.

Certain widely used public-key systems, especially RSA and elliptic-curve cryptography, could be seriously affected by a sufficiently capable fault-tolerant quantum computer. That is one reason governments, researchers and technology companies are already preparing for post-quantum cryptography, or PQC.

Does quantum computing threaten every kind of encryption?

No.

RSA relies on the difficulty of integer factorization, while widely used elliptic-curve systems rely on versions of the discrete logarithm problem. Shor’s algorithm shows that a sufficiently powerful quantum computer could solve these types of problems far more efficiently than known classical methods.

Symmetric encryption such as AES is affected differently. Grover’s algorithm can theoretically speed up brute-force searches, but this is not the same kind of dramatic attack that Shor’s algorithm provides against RSA and ECC. NIST therefore does not treat all modern cryptography as equally vulnerable to quantum computing.

What is post-quantum cryptography?

Post-quantum cryptography is conventional cryptographic software designed around mathematical problems that are believed to remain difficult for both classical and quantum computers.

It does not require a quantum computer.

This makes PQC different from quantum key distribution, or QKD, which uses properties of quantum physics and specialized communication technology.

One of the most important families of PQC is lattice-based cryptography.

What does “lattice” mean?

Imagine regularly spaced points on a sheet of graph paper.

In two dimensions, finding a nearby point may look simple. Real lattice-based cryptography, however, deals with mathematical structures in spaces with very large numbers of dimensions.

Finding a vector or secret satisfying certain conditions can become extremely difficult as the dimension and parameters grow.

This picture is only an analogy, but it helps explain why lattice problems can be useful in cryptography.

Why are these problems considered difficult?

One important example is Learning With Errors, or LWE.

A simple way to picture it is to imagine a hidden mathematical rule whose outputs contain carefully added small errors. An attacker sees the noisy results but has to reconstruct the secret rule behind them.

ML-KEM, one of NIST’s standardized PQC algorithms, relies on a structured version known as Module Learning With Errors. With properly chosen parameters, no efficient classical or quantum algorithm is currently known that solves the underlying problem well enough to defeat the scheme.

That does not mean it is mathematically guaranteed to remain secure forever. Cryptographic assumptions can change when researchers discover new attacks.

Why doesn’t Shor’s algorithm solve the problem?

Shor’s algorithm is extremely important because of what it can do to factoring and discrete-logarithm systems.

But no comparable efficient Shor-style quantum algorithm is currently known for the hard lattice problems underlying standardized schemes such as ML-KEM and ML-DSA.

That is why lattice cryptography has become a major part of the post-quantum transition.

What has NIST standardized?

In August 2024, NIST published its first three finalized PQC standards.

ML-KEM is derived from the algorithm previously known as CRYSTALS-Kyber. ML-DSA is derived from CRYSTALS-Dilithium. The newer names are the names used in the final NIST standards.

Not every PQC algorithm is lattice based.

In March 2025, NIST selected HQC as an additional key-encapsulation mechanism. HQC is based on error-correcting codes rather than lattices and is intended to provide mathematical diversity alongside ML-KEM. Its standard is still being developed.

NIST is also developing FIPS 206 for FN-DSA, derived from FALCON. As of September 2026, it is not yet one of the finalized FIPS 203–205 standards.

Traditional public-key cryptography vs. lattice-based PQC

Should ordinary users change anything today?

For most people, there is no need to stop online banking or manually replace encryption software.

The larger challenge belongs to governments, financial institutions, healthcare organizations, cloud providers and other organizations that must protect sensitive information for many years.

One reason is the “harvest now, decrypt later” threat. An attacker could collect encrypted data today and keep it until a future quantum computer becomes powerful enough to attack the cryptography that originally protected it.

This means migration may need to happen years before a cryptographically relevant quantum computer actually exists.

Is PQC already being used?

Yes, in some areas.

Cloudflare, for example, supports the hybrid TLS key agreement X25519MLKEM768, which combines the conventional X25519 method with ML-KEM-768. Hybrid approaches allow organizations to add post-quantum protection while retaining compatibility and the security properties of established cryptography during the transition.

South Korea is also moving from research toward practical migration. In 2026, the Ministry of Science and ICT and KISA expanded PQC pilot migration efforts into areas including telecommunications, finance, transportation, defense and space.

What happens next?

The Internet is unlikely to switch from traditional cryptography to PQC overnight.

Browsers, operating systems, VPNs, cloud services, digital signatures, certificates, financial networks and public-sector systems all have different upgrade cycles. Hybrid deployments and gradual migration are therefore likely to remain important during the transition.

NIST is encouraging organizations to identify where quantum-vulnerable cryptography is used, prioritize critical systems and improve “crypto agility” — the ability to replace cryptographic algorithms without rebuilding an entire system.

The most important point is not that quantum computers will suddenly break the entire Internet.

The important point is that changing global cryptographic infrastructure takes years, so governments and technology companies are preparing before the threat becomes practical.

Lattice-based cryptography is one of the technologies at the center of that transition. Understanding it gives us a useful glimpse of how Internet security, banking, digital signatures and cloud systems may evolve in the post-quantum era.