The Internet Is Changing Its Locks: A Plain-English Guide to Post-Quantum Cryptography

While studying cloud computing and cybersecurity, I discovered one of the biggest technology migrations most people have never heard of — and why it’s already reshaping the future of internet security.

Image by Jim Columbus using AI

One of the unexpected rewards of studying cloud computing and cybersecurity is realizing that some of the biggest technological revolutions don’t make headlines. They happen quietly, behind the scenes, long before most of us notice.

Artificial intelligence is dominating today’s technology conversation — and for good reason. But while AI captures the headlines, another transformation is quietly underway. Engineers around the world are rebuilding the mathematical foundations that secure nearly every website, banking transaction, VPN, encrypted message, and software update we use.

I hadn’t even heard of post-quantum cryptography a few weeks ago.

Once I understood what was happening, I realized this isn’t just another technical acronym. It’s one of the largest security upgrades in the history of the internet.

Right now, almost everything keeping us safe online relies on two mathematical padlocks: RSA and ECC.

To today’s computers, those locks are extraordinarily difficult to break. But researchers know that a sufficiently powerful, fault-tolerant quantum computer could eventually solve the mathematical problems behind them far faster than any classical computer.

Those machines don’t exist yet at the necessary scale.

The challenge is that rebuilding the internet’s security infrastructure isn’t something you do overnight. It will take years, which is why the migration has already begun.

To prepare for that future, the U.S. National Institute of Standards and Technology (NIST) organized a global competition to develop new cryptographic standards designed to resist attacks from future quantum computers. In August 2024, NIST finalized its first three post-quantum cryptography standards:

• ML-KEM for securely establishing shared encryption keys.

• ML-DSA for digital signatures.

• SLH-DSA as an alternative, stateless hash-based digital signature standard built on completely different mathematical foundations.

Here’s my plain-English breakdown of what they do and why they matter.

Think of these as the next generation of digital locks. Each one has a different job, but together they’re designed to help secure the internet against future quantum-era threats.

The Big Three: Meet the New Quantum-Resistant Locks

Rather than relying on mathematical problems that future quantum computers may be able to solve efficiently, these new standards use different mathematical structures that are currently believed to remain resistant to both classical and known quantum attacks.

ML-KEM — The Secret Handshake

Replaces the role of: RSA and ECC key establishment

Imagine you and a friend need to create a secret code while someone is listening to every word you say.

ML-KEM allows both of you to establish the same secret encryption key without ever revealing that key publicly. Anyone eavesdropping — including a future quantum computer — only sees meaningless fragments that cannot be assembled into the actual secret.

Once that shared key is created, it can be used by fast symmetric encryption algorithms to protect the rest of the conversation.

Its job is simple: securely establish the secret before encrypted communication begins.

ML-DSA — The Digital Signature

Replaces the role of: RSA and ECDSA digital signatures

Suppose you’re signing an online contract, approving a software update, or authorizing a bank transaction.

ML-DSA creates a digital signature that gives receiving systems strong cryptographic assurance that the message genuinely came from the expected sender and has not been altered during transmission.

Its purpose isn’t secrecy.

Its purpose is trust.

SLH-DSA — The Emergency Backup

Role: An alternative stateless hash-based digital signature standard

Every good security system needs a backup plan.

SLH-DSA uses an entirely different mathematical approach based on cryptographic hash functions instead of lattice mathematics.

It’s generally slower and produces larger digital signatures than ML-DSA, but that’s intentional.

By relying on a different family of mathematics, it provides organizations with another trusted option should future cryptographic research uncover weaknesses in lattice-based signatures.

Think of it as the emergency parachute that engineers hope they’ll never need — but are glad to have.

Why These New Puzzles Are Different

The biggest surprise for me wasn’t learning that new encryption exists.

It was realizing that the mathematics itself has fundamentally changed.

The older systems rely on mathematical problems that are extremely difficult for today’s computers.

The newer systems rely on mathematical structures that researchers currently believe will remain difficult even for large-scale quantum computers.

Imagine today’s encryption as a combination lock.

A future quantum computer isn’t simply a faster burglar.

It’s someone who discovers an entirely different way of opening the lock.

Post-quantum cryptography responds by redesigning the lock itself.

The Guard Change

Legacy StandardNew NIST StandardPurposeRSA / ECCML-KEMSecurely establishes shared encryption keysRSA / ECDSAML-DSAAuthenticates identities and digital signaturesAlternative signature methodsSLH-DSAAlternative stateless hash-based digital signatures

Where You’ll Encounter This

One thing I’ve learned through AWS cloud training is that encryption isn’t something used only by governments or banks.

It’s woven into almost everything we do online.

Secure websites.

Cloud services.

VPN connections.

Digital certificates.

Software updates.

Mobile apps.

Online shopping.

Even the devices quietly communicating behind the scenes.

That means replacing internet cryptography isn’t like installing a software update.

It’s more like replacing the plumbing underneath an entire city while everyone continues using the water.

In other words, this isn’t a niche upgrade for cryptographers. It’s an infrastructure project that will eventually touch nearly every secure digital interaction we make.

Why This Matters Today: “Harvest Now, Decrypt Later”

One concept surprised me more than anything else.

Cybersecurity professionals are increasingly preparing for a scenario known as “Harvest Now, Decrypt Later.”

Imagine someone steals a locked safe.

They can’t open it today, so they place it in storage.

Twenty years later, someone invents a machine capable of opening every safe built with that design.

Suddenly, information that once seemed permanently protected becomes accessible.

That’s the concern behind Harvest Now, Decrypt Later.

Sensitive government records.

Medical information.

Corporate intellectual property.

Research data.

Long-term financial records.

Any information with lasting value could become vulnerable if organizations wait too long to modernize their cryptography.

That’s why the migration to post-quantum cryptography is already underway — even though practical quantum computers capable of breaking today’s public-key cryptography have not yet been built.

Good cybersecurity is proactive, not reactive.

Want to Explore the Official Standards?

If you’d like to dive deeper, I encourage you to explore the official NIST publications that define these new standards.

• FIPS 203 — ML-KEM

• FIPS 204 — ML-DSA

• FIPS 205 — SLH-DSA

Final Thoughts

Before I began studying cybersecurity, I assumed internet security was something engineers had solved years ago.

What I’ve learned instead is that cybersecurity is never finished.

Every technological breakthrough creates new opportunities — and new risks.

Post-quantum cryptography is one example of how the internet quietly adapts long before most people realize change is happening.

We may never notice the moment these new standards become part of everyday life.

And if the engineers behind them have done their jobs well, that’s exactly how it should be.

Author’s Note

I’m documenting my journey through AI, cloud computing, and cybersecurity one concept at a time. My goal is to translate complex technical topics into plain English while encouraging readers to explore the original sources and continue learning alongside me.

Research Transparency

This article was researched and cross-checked against the official NIST Post-Quantum Cryptography standards (FIPS 203, FIPS 204, and FIPS 205). Technical concepts have been intentionally simplified for a general audience while remaining faithful to the intent of the official specifications.