Quantum resistance
Also called: quantum-resistant · quantum-resistant cryptography · harvest now decrypt later · post-quantum · CNSA 2.0
The property of a cryptographic scheme that a cryptographically relevant quantum computer would not break in any practical sense.
Quantum resistance is the property of a cryptographic primitive or scheme that a large quantum computer would not break in practice. The distinction that matters is between the two families of cryptography. Classical asymmetric schemes — RSA, elliptic curves — fall to Shor's algorithm and must be replaced by post-quantum algorithms (NIST's ML-KEM, ML-DSA, SLH-DSA). Symmetric primitives — AES-256, SHA-512 — only lose about half their effective strength to Grover's algorithm, which leaves AES-256 at roughly 128 post-quantum bits, still infeasible; NSA's CNSA 2.0 retains them as quantum-resistant.
The threat that makes this relevant today, before any such computer exists, is "harvest now, decrypt later": capturing encrypted traffic or backups now to decrypt them later. Data whose confidentiality rests only on symmetric primitives, with keys that never travelled through a classical key exchange, is not exposed to that attack. When evaluating a vendor's claim, ask which layer it refers to: the TLS of the hosting, whose key exchange is still classical until hybrid ML-KEM is deployed by platforms and browsers, or the application's own encryption layers, whose primitives may already be symmetric-only. A precise claim names the scope.
On this site: Security →