Promising Post-Quantum Cryptography Solutions, According To Experts
Quantum computing capabilities are accelerating, pushing traditional encryption methods closer to obsolescence. In response, cryptographers and security professionals are advancing post-quantum cryptography (PQC) solutions designed to resist attacks from quantum-capable adversaries.
A range of candidate algorithms and transition strategies are under active evaluation for their cryptographic strength, implementation efficiency, scalability and applicability across real-world use cases. Below, members of Forbes Technology Council explore the PQC approaches they believe hold the most promise—including their advantages and trade-offs—to help organizations prepare for a quantum-resilient future.
Code-Based Cryptography
Code-based cryptography offers a robust solution for post-quantum security due to its long history of analysis and strong security guarantees against quantum attacks. Recent NIST-selected variants address historic key size challenges, offering simpler, quantum-resistant encryption that may be crucial if lattice- or hash-based PQC approaches face issues. – Neil Lampton, TIAG
Cryptographic Bills Of Materials
A cryptographic bill of materials (CBOM) inventories all cryptographic components within an organization’s systems to uncover vulnerable classical algorithms and guide efficient migration to quantum-safe alternatives. Implementation is complex and tooling is still emerging, but CBOMs will jumpstart a smarter, faster path to PQC readiness. – Mark Hughes,IBM
Leighton-Micali Signature
With U.S. mandates requiring post-quantum cryptography by 2028, hardware makers must act now. Leighton-Micali Signature (LMS) is a robust choice for code signing today as it ensures authenticity and integrity, but crypto-agility is key—new algorithms may emerge with better performance. Early adoption ensures compliance and long-term security. – Anand Kashyap, Fortanix
ML-KEM (Kyber)
The ML-KEM (Kyber) protocol is approaching 40% adoption. Its downside is a fraction of a second delay in establishing a webpage connection. The upside? Unlike classical TLS security, Kyber-secured browser connections are considered substantially more immune to “record now, decrypt later” attacks, often discussed as a threat target of cryptographically relevant quantum computers. – Steven Woo, Rambus
Crypto-Agility
Crypto-agility itself is the most promising “solution” for the post-quantum era. With it, organizations can swap cryptographic primitives without rewriting infrastructure, which is critical as quantum-safe algorithms evolve. Though its main challenge lies in rearchitecting non-agile, legacy systems, Crypto-agility will separate those who are post-quantum ready from those who are exposed. – Jason Sabin, DigiCert Inc.
CRYSTALS-Kyber
CRYSTALS-Kyber is a top contender in post-quantum encryption. It’s already being tested by tech giants (for example, by Google in Chrome) to prepare for quantum threats. Though it uses larger keys, its speed and security make it ideal for Internet of Things and cloud systems. It’s a real-world step toward securing data in a future where quantum attacks are a real risk. –Mehwish Salman Ali, Data Vault
NTRU
NTRU is a public-key cryptosystem that relies on polynomial ring arithmetic. Pros: It has a faster encryption and decryption process, safeguards against future quantum decryption, and has smaller key sizes that minimize storage requirements. Cons: Intricate math requires top-level experts to implement it. It lacks widespread adoption, and all NTRUs need countermeasures from side-channel attacks. – Will Conaway, Ascent Business Partners
Lattice-Based Cryptography
Lattice-based cryptography is a prominent solution that has three schemes: NTRUEncrypt, Learning with Errors (LWE), and Ring Learning With Errors (RLWE). They are resistant to quantum attacks, versatile in applications and efficient in key generation, but they have larger keys, translating to decreased performance. – Balaji Soundararajan, Adroitts
CRYSTALS-Dilithium
A good example is CRYSTALS-Dilithium, a post-quantum digital signature scheme. It is strong against quantum attacks and runs fast on most systems. It’s good for signing documents or messages securely. But like others, it uses larger signatures than current methods and is still new, so more testing is needed. Still, it’s a top choice for future-proof digital security. – Jay Krishnan, NAIB IT Consultancy Solutions WLL
OpenSSL 3.5
PQC is made tangible with the release of OpenSSL 3.5. The open-source library has added support for all three current NIST-standardized PQC algorithms: ML-KEM for key encapsulation and ML-DSA and SLH-DSA for signatures. It even enables a hybrid approach, combining classical encryption with PQC. There are transition challenges, implementation risks and bugs, but PQC is now easier to implement. – Kim Bozzella, Protiviti
McEliece Cryptosystem
Code-based cryptography, specifically the McEliece cryptosystem, is a promising post-quantum solution. Its core strength lies in its decades of proven resistance to cryptanalysis. It relies on the difficulty of decoding general linear codes, which is believed to be intractable for quantum computers. However, its main weakness is its very large public key size, which poses practical challenges. – Pradeep Kumar Muthukamatchi, Microsoft
Blockchain Plus Post-Quantum Encryption
Blockchain, when paired with post-quantum encryption, shows real promise in securing future digital ecosystems. Its decentralized nature adds resilience, while quantum-resistant algorithms protect data integrity. The challenge lies in scalability and retrofitting existing chains, but it’s a strong foundation for long-term security. – Adrian Stelmach, EXPLITIA
BIKE
BIKE, a code-based key encapsulation method, is one to watch. It’s less talked about than Kyber but brings solid speed and compact key sizes to the table. The challenge? It’s still maturing and needs more scrutiny from the cryptographic community. But in a diverse post-quantum toolkit, BIKE could play a quiet but important role. – Umesh Kumar Sharma
HQC-KEM
HQC-KEM shows strong promise. Its power comes from classic code-based hardness plus a quasi-cyclic trick that slashes McEliece-size keys to ~10-20 KB, delivers constant-time operations, and resists known side-channel attacks. The trade-offs are that ciphertexts remain bulky and the decoding step is compute-hungry, so resource-constrained or high-throughput environments need careful optimization. – Pawan Anand, Ascendion
Picnic
Picnic, a post-quantum signature scheme based on zero-knowledge proofs, shows promise by avoiding reliance on lattices or number-theoretic assumptions. This diversification strengthens its resilience against unforeseen quantum breakthroughs. However, its large signature sizes and slower verification limit practicality for real-time or resource-constrained systems. – Rahul Wankhede, Humana
SPHINCS+
I’m bullish on SPHINCS+ for digital signatures. It’s hash-based, meaning its security relies on well-understood SHA-2/SHA-3 rather than exotic math. For mobile apps handling sensitive data, this conservative approach appeals to me. The downside? Signature sizes are massive—sometimes 40 KB. That’s painful for bandwidth-constrained mobile apps, but the peace of mind might be worth it. – Marc Fischer, Dogtown Media LLC
Google Cloud
I would honestly go with Google Cloud, since it would have the most to lose on the data front if its cryptography is ever cracked. Its strength is that you are backed by a huge player that takes data security seriously. Its weakness is that it is large and therefore a common target for all who wish to crack crypto algorithms—and in the same vein, for them, there’s a lot to gain. –WaiJe Coler, InfoTracer
FrodoKEM
FrodoKEM is a learning-with-errors-based algorithm designed without structured lattices, offering “conservative” cryptography. Its biggest strength is transparency, built from simple, well-understood math. However, it comes with a trade-off: significantly larger key sizes and slower performance than competitors like Kyber. This limits its practicality in resource-limited systems. – Jagadish Gokavarapu, Wissen Infotech
Hash-Based XMSS
Hash-based XMSS stands out for post-quantum security. With global cyberthreats, regulatory shifts and quantum risks rising, it’s NIST-endorsed, offering robust digital signatures for banking. Its strengths are high security and efficient signing. Its weaknesses are complex implementation and higher computational costs. By 2030, it will secure transactions, but it needs simplification. Discipline drives trust and resilience. – Kalyan Gottipati, Citizens Financial Group, Inc.
Kyber Plus Dilithium
NIST has finalized its first PQC standards with Kyber for encryption and Dilithium for digital signatures. The challenge is bringing them into embedded systems such as cars, planes and medical devices, where performance, security and reliability must all scale together. A solution is working with semiconductor partners already delivering early silicon optimized for quantum-safe cryptography. – Javed Khan, Aptiv
Previously published on Forbes.com