Post-Quantum Cryptography and TLS
What quantum computers mean for TLS
Post quantum TLS refers to versions of TLS that use cryptographic algorithms designed to resist attacks from quantum computers. Today's machines cannot break the encryption used in everyday HTTPS, but a large enough quantum computer could in principle do so, so the transition is already underway.
Current TLS relies on RSA and elliptic curve cryptography for key exchange, and for the signatures in certificates. A large quantum computer running Shor's algorithm could recover the private keys behind these systems, which would break both confidentiality and authentication. The RSA and ECC key types are the foundation of today's setups.
Harvest now, decrypt later
The most pressing concern is recorded traffic. An attacker can capture encrypted HTTPS traffic today, store it and decrypt it years later if a capable quantum computer becomes available. This is often called harvest now, decrypt later.
The risk is greatest for information that must stay secret for a long time, such as health records, personal data and government or business secrets. Forward secrecy limits what a stolen key reveals, but it does not help if the key exchange itself can be broken later.
Signatures face a different timeline. A forged signature matters at the moment it is used, so replacing signature algorithms is generally considered less urgent than replacing key exchange. Certificate migration is still a larger task, because every certificate, client and authority in the chain must support the new algorithms.
Hybrid key exchange as a transition
Hybrid key exchange combines a traditional algorithm, such as elliptic curve Diffie-Hellman, with a post-quantum key encapsulation method. The session key is derived from both, so an attacker would need to break both to recover it. This protects against a failure in either one.
NIST standardized ML-KEM in 2024 as a post-quantum key encapsulation mechanism, and it is the usual choice in hybrid TLS designs. Some major browsers and servers already use hybrid exchange, and adoption is spreading as libraries and services add support.
Hybrid designs are considered a cautious transition. They keep proven classical security while adding protection against future quantum attacks. Clients that do not support them can still connect, because the two sides negotiate the method they share, as described in the comparison of TLS versions.
Frequently asked questions
Is my HTTPS connection already vulnerable to quantum computers?
Not in the sense of an immediate break. Current encryption is still considered secure against today's computers. The concern is that recorded traffic could be decrypted later, so sensitive data sent now may have a long exposure window.
Do I need to do anything about post-quantum TLS today?
Most site owners rely on their hosting provider, CDN or software vendor to adopt hybrid key exchange as it becomes available. Keeping server software and TLS libraries up to date is the main practical step. Choosing a post-quantum setting is not something most site owners configure directly.