PQC vs QKD

Post-Quantum Cryptography

Software algorithms believed to be hard for quantum computers.

• Runs on existing classical infrastructure
• NIST-standardised: ML-KEM, ML-DSA, SLH-DSA
• Works over the public internet
• Drops into TLS, IKE, PKI, and code signing
• Recommended by NSA, BSI, ANSSI, NCSC, ASD

Quantum Key Distribution

Physical key exchange whose security comes from quantum mechanics.

• Requires dedicated fibre or satellite links
• Detects eavesdropping at the physical layer
• Bounded distance — needs trusted nodes
• Used for high-assurance government links
• Hardware-heavy, low throughput

Pure PQC

Use as the default. Internet-scale, enterprise, IoT, signatures — everywhere classical cryptography lives today.

PQC + Classical Hybrid

Transitional posture: run X25519 and ML-KEM together. If either holds, the channel remains safe.

PQC + QKD

Reserve for national-security backbones where the budget exists for dedicated infrastructure and trusted-node operations.

Breaks public-key crypto

Peter Shor's 1994 algorithm factors integers and computes discrete logs in polynomial time on a quantum computer. That collapses RSA, Diffie-Hellman, and elliptic-curve cryptography in one stroke — every key-exchange and signature scheme in use today.

Halves symmetric strength

Lov Grover's 1996 algorithm gives a quadratic speed-up for unstructured search. AES-128 effectively halves to ~64-bit. AES-256 remains comfortably safe — which is why most agencies now mandate AES-256 as the post-quantum default for symmetric cryptography.

The arrival threshold

A Cryptographically Relevant Quantum Computer is one with enough logical qubits, depth, and error correction to actually run Shor's algorithm against a real RSA-2048 or P-256 key. That's the moment classical public-key cryptography fails — not the qubit-count headlines.