Two sides of the quantum cryptography story

Quantum computing and cryptography have a dual relationship. On one side, quantum computers threaten to break current public-key encryption (as we saw with Shor's algorithm in Lesson 12). On the other side, quantum mechanics enables cryptographic protocols that are secure in a fundamentally different way - not based on computational difficulty, but on the laws of physics themselves.

These two aspects require different responses. The threat from Shor's algorithm is addressed by post-quantum cryptography - new mathematical problems that classical computers struggle with and that quantum computers do not have known efficient algorithms for. The opportunity from quantum physics is realized through quantum key distribution - using quantum states to share secret keys in a way that any eavesdropping attempt is detectable. Think of it like upgrading a lock (post-quantum cryptography makes the lock harder for anyone, quantum or classical, to pick) versus using a tamper-evident seal (QKD makes it obvious the instant someone has tried to peek).

Quantum Key Distribution (QKD)

The most famous quantum cryptographic protocol is BB84, invented by Charles Bennett and Gilles Brassard in 1984. It allows two parties, Alice and Bob, to share a secret key - a string of random bits - with a security guarantee rooted in quantum physics, not mathematical assumptions.

The key insight comes from the measurement principle: measuring a qubit in a superposition state disturbs it and collapses it. An eavesdropper (traditionally called Eve) who intercepts qubits to read them will inevitably disturb them - and Alice and Bob can detect this disturbance by comparing a sample of their received bits over a public channel. If there is too much disturbance, they know someone was listening and discard the key.

The protocol is not just a clever trick - its security is mathematically proven under the assumption of quantum mechanics being correct. No amount of computational power can break BB84 security without being detected, because the security does not rely on a mathematical problem being hard. It relies on the physical impossibility of measuring a quantum state without disturbing it.

How BB84 works

Alice generates random bits and randomly chooses from two bases to encode each bit: either the computational basis (|0⟩ and |1⟩) or the diagonal basis (|+⟩ and |−⟩, which are superpositions created by H). She sends the encoded qubits to Bob.

Bob randomly measures each qubit in one of the two bases. About half the time, he chooses the same basis as Alice and gets the correct bit. The other half, his measurement is in the wrong basis and gives a random result.

After Bob receives all qubits, Alice and Bob publicly compare which bases they used (not the actual bits). They keep only the bits where they used the same basis - about half the total. This becomes their shared secret key. It's a bit like Alice flipping a coin and noting heads or tails through one of two different filters, then announcing only which filter she used for each flip - never the actual result - so Bob can tell her which of his guesses used the matching filter, without either of them ever saying the outcome out loud.

If Eve intercepts and measures qubits (she has to guess the basis, just like Bob), she disturbs them. When Bob measures a disturbed qubit correctly, he still gets about 25% errors even in the right basis. Alice and Bob detect this by comparing a subset of their shared bits and checking for unusually high error rates. High errors mean eavesdropping - discard everything and try again.

Post-quantum cryptography: protecting against Shor

QKD provides a theoretically perfect solution but requires quantum hardware - fiber or satellite links, quantum light sources, single-photon detectors. This is expensive and not yet globally deployable. The vast majority of internet security cannot wait for quantum networks.

Post-quantum cryptography (PQC) addresses this with new classical algorithms based on mathematical problems that no known quantum algorithm can solve efficiently. NIST's 2024 standardized algorithms include:

CRYSTALS-Kyber (ML-KEM) for key encapsulation, based on the hardness of learning with errors (LWE) - a problem involving finding a solution to a noisy system of equations. It's like trying to recover someone's exact GPS coordinates when every reading you're given has been nudged by a small, random, unknown error - individually each clue is nearly useless, and the noise compounds fast enough that brute-force search (classical or quantum) stays impractical. CRYSTALS-Dilithium (ML-DSA) and FALCON for digital signatures, also based on lattice problems. SPHINCS+ for signatures based on hash functions.

These algorithms run on existing classical hardware and can be deployed in standard software updates. Major technology companies and government agencies are already in the process of migrating to PQC standards.

The cryptographic transition ahead

The transition from current cryptography to post-quantum standards is one of the largest infrastructure upgrades in internet history. Every system that uses public-key cryptography - TLS certificates for websites, VPN protocols, email signing, software updates, financial systems - must eventually be updated.

The good news is that NIST has standardized the algorithms, and the timeline is manageable if the work starts now. The bad news is that "harvest now, decrypt later" attacks mean waiting is not safe - an adversary can record your encrypted traffic today, the way you'd photograph a locked diary, and simply wait for a future quantum computer to pick the lock and read everything inside. Organizations with sensitive long-lived data need to begin the transition immediately.

For you personally: the post-quantum cryptographic migration will be an enormous area of work for security engineers over the next decade. Understanding both the quantum threat and the solutions is a valuable and rare combination of knowledge.