Essentially, quantum computing will test many of the cryptographic principles that have been used for the past 40 years to build digital trust. Unlike classical bits, quantum qubits use superposition and entanglement to solve mathematical problems in polynomial time, such as integer factorization and discrete logarithms. As a result, the ability of RSA, Diffie-Hellman, and elliptic curve cryptography (ECC) is already rendered redundant by Shor's algorithm. Grover's algorithm further cripples symmetric encryption, reducing AES-128's effective security to 64 bits. These are not hypothetical: the "harvest now, decrypt later" approach allows attackers to collect encrypted messages for later decryption using quantum technology, threatening confidentiality in the healthcare, defence, and finance sectors. The existing literature has documented these threats but lacks a practical tool for organizational migration planning. This review fills that gap by proposing the Quantum-Crypto Readiness Index (QCRI), a novel heuristic scoring framework across four dimensions: Cryptographic Inventory, Data Longevity Exposure, Algorithm Agility, and Hardware Dependency. Synthesizing 20 years of peer-reviewed research, we evaluate leading post-quantum cryptography candidates—latticebased (Kyber, Dilithium), hash-based (SPHINCS+), and code-based (McEliece)—against performance benchmarks. We conclude that hybrid cryptographic architectures and immediate migration planning are essential before large-scale quantum decryption becomes feasible.
Essentially, quantum computing will test many of the cryptographic principles that have been used for the past 40 years to build digital trust. Unlike classical bits, quantum qubits use superposition and entanglement to solve mathematical problems in polynomial time, such as integer factorization and discrete logarithms. As a result, the ability of RSA, Diffie-Hellman, and elliptic curve cryptography (ECC) is already rendered redundant by Shor's algorithm. Grover's algorithm further cripples symmetric encryption, reducing AES-128's effective security to 64 bits. These are not hypothetical: the "harvest now, decrypt later" approach allows attackers to collect encrypted messages for later decryption using quantum technology, threatening confidentiality in the healthcare, defence, and finance sectors. The existing literature has documented these threats but lacks a practical tool for organizational migration planning. This review fills that gap by proposing the Quantum-Crypto Readiness Index (QCRI), a novel heuristic scoring framework across four dimensions: Cryptographic Inventory, Data Longevity Exposure, Algorithm Agility, and Hardware Dependency. Synthesizing 20 years of peer-reviewed research, we evaluate leading post-quantum cryptography candidates—latticebased (Kyber, Dilithium), hash-based (SPHINCS+), and code-based (McEliece)—against performance benchmarks. We conclude that hybrid cryptographic architectures and immediate migration planning are essential before large-scale quantum decryption becomes feasible.
Abstract Classical computing architectures cannot reasonably solve computationally challenging problems, such as those of RSA public-key encryption, Diffie-Hellman key exchange, and elliptic curve cryptography, which form the cryptographic foundations of modern enterprise information security. Superposition and entanglement phenomena can be used to make quantum computers efficient in solving these problems, which are efficiently solved by Shor's algorithm and Grover's algorithm, and make existing cryptographic infrastructure entirely insecure. While quantum computing is fault-tolerant and still under development, the 'harvest now, decrypt later' threat model by which adversaries can harvest encrypted data now to be decrypted later when they can operate quantum systems signals that the cryptographic threat is present, not future. The objective of this study is to examine the current state of enterprise cryptographic readiness against threats in the quantum era and to create a model for organizational transition to the new cryptographic standards in the quantum era, which is called the Quantum-Resilient Security Architecture (QRSA) Framework. It uses a mixed-methods research methodology, consisting of a systematic literature review, an expert Delphi survey of 38 cybersecurity practitioners from 16 countries, and a qualitative analysis of five enterprise organizations, to examine the state of quantum-capable cryptographic protocols, the readiness of organizations in the technical, governance and capability aspects, and the most important enablers and blockers for the post-quantum migration. The key findings include that: 94 percent of enterprise systems assessed are today still using quantum-vulnerable cryptographic primitives; less than 12 percent of organizations surveyed have started formal planning efforts for quantum migration; and, in most of the cases analyzed, the National Institute of Standards and Technology (NIST) post-quantum cryptography standardization process has not made significant impacts on enterprise security roadmaps. The QRSA Framework offers a staged migration architecture based on the NIST standardized algorithms such as CRYSTALS-Kyber, CRYSTALS-Dilithium and SPHINCS+ that integrates with the enterprise security infrastructure. Contributions include cybersecurity governance scholarship, enterprise risk management theory, and information security policy.
With the arrival of fault-tolerant quantum computers, an existential threat has come to the cryptographic underpinnings of the security infrastructure in place for modern information technologies. Virtually all secure digital communication protocols used today are based on classical public-key cryptographic systems – RSA, Elliptic Curve Cryptography (ECC) and Diffie-Hellman key exchange – that are susceptible to polynomial-time quantum attacks using Shor's algorithm. Symmetric cryptographic algorithms that are not broken are being effectively halved by Grover's algorithm, for example, AES. In this article, a complete and journal-standard systematic review of quantum computing and its implications in the field of information technology security is presented which includes 22 peer-reviewed publications from 2023-2025. The study covers the basics of quantum computing (qubits, superposition, entanglement and quantum gates), and how quantum computing specifically poses a threat to classical cryptography via algorithmic mechanisms. The three post-quantum cryptographic algorithms that were standardised by the National Institute of Standards and Technology (NIST) in August 2024 (ML-KEM, FIPS 203; ML-DSA, FIPS 204; and SLH-DSA, FIPS 205) are compared based on their security assumptions, performance, and readiness for deployment. The practical limitations and the use of Quantum Key Distribution, (QKD), as a physics based alternative to the computational security assumptions are discussed. Results show that although mature PQ solutions are now available for most cryptographic applications, the migration challenge, including legacy system transitions, migration architecture, and governance, is significant and pressing as the ‘harvest now, decrypt later’ threat model is relevant and adversaries might be collecting encrypted data for quantum decryption. The impact for financial services, health care, government, cloud infrastructure and critical national infrastructure is discussed. Lastly, the researchers list key research areas: standardisation of quantum-safe protocols, hybrid PQC-QKD designs, light-weight PQC for constrained devices, and quantum-safe blockchain.
This preprint presents a systematic review of how quantum computing impacts the security of classical cryptography and what mitigation strategies are available. The review synthesises key survey papers, standards reports and transition guidelines on post-quantum cryptography (PQC) and quantum-safe security published between 2015 and 2025. First, the paper summarises the impact of Shor’s and Grover’s algorithms on widely deployed public-key schemes, symmetric ciphers and hash functions, highlighting in particular the existential break of RSA, Diffie–Hellman and elliptic-curve cryptography, and the reduced security margins for symmetric and hash-based constructions. It then examines major quantum-resilient responses, including lattice-, code-, multivariate- and hash-based PQC, quantum key distribution (QKD), hybrid classical–PQC schemes and crypto-agile architectures. Building on Mosca’s x, y, z risk-timing model, the review discusses cross-cutting themes such as harvest-now-decrypt-later threats and sector-specific implications for government and defence, finance and blockchain, healthcare, cloud providers and critical infrastructure. It identifies several research gaps, including the lack of quantitative migration-cost data, limited coverage of small and resource-constrained organisations, and few system-scale evaluations comparing PQC-only, hybrid and QKD-based designs. The paper concludes by arguing that planning and investment in quantum-resilient cryptography need to start now, before migration time and data shelf-life push critical systems into the risky regime.
This paper provides a comprehensive review of quantum readiness as a critical, multidimensional framework for navigating the upcoming quantum computing era. It addresses the imminent threat posed by cryptographically relevant quantum computers (CRQCs), which will be capable of breaking the public-key cryptographic systems (like RSA and ECC) that currently secure digital communications and e-commerce. The concept of ”harvest now, decrypt later” (HNDL), where adversaries collect encrypted data today to decrypt it once quantum computers are available, highlights the urgency of this transition. The review is structured around three key dimensions: the theoretical foundations of post-quantum cryptography (PQC), global standardization efforts, and real-world sectoral implementations. It discusses how quantum algorithms, specifically Shor’s and Grover’s algorithms, can render classical cryptography obsolete, and it analyzes the NIST Post-Quantum Cryptography Standardization Project, which has selected the first-generation PQC standards. The paper also examines strategies from the European Union and other nations, noting the geopolitical implications of standards fragmentation. Furthermore, the review explores the practical adoption of PQC in critical sectors like finance, telecommunications, and defense, emphasizing the importance of crypto-agility—the ability to rapidly switch cryptographic algorithms—for future-proofing systems. It also highlights open challenges, including performance overheads, legacy system migration, and the shortage of skilled professionals. The paper concludes by outlining future directions for a secure transition, advocating for continuous research, global collaboration, and sustained investment to build a quantum-resilient digital ecosystem.
The advent of large-scale quantum computers poses an existential threat to the cryptographic algorithms that underpin modern digital security. Shor's algorithm enables quantum computers to factor large integers and compute discrete logarithms in polynomial time, rendering RSA, Elliptic Curve Cryptography (ECC), and Diffie-Hellman key exchange fundamentally insecure. Meanwhile, Grover's algorithm provides a quadratic speedup for brute-force search, effectively halving the security strength of symmetric ciphers and hash functions. This paper presents a comprehensive investigation into the impact of quantum computing on both asymmetric and symmetric cryptographic algorithms. We analyze the computational resources required by quantum attacks on current standards, evaluate the timeline of quantum threats based on hardware roadmaps from leading quantum computing companies, and conduct a systematic performance comparison of NIST-standardized post-quantum cryptographic (PQC) algorithms. Our experimental evaluation covers key generation time, encapsulation/decapsulation latency, signature generation/verification speed, key sizes, and bandwidth overhead across lattice-based, code-based, hash-based, and multivariate cryptographic schemes. Results indicate that lattice-based schemes, particularly CRYSTALS-Kyber and CRYSTALS-Dilithium, offer the most favorable balance of security and performance for practical deployment. We also propose a phased migration framework for transitioning existing cryptographic infrastructure to quantum-resistant alternatives, addressing compatibility, performance, and operational challenges.
Quantum computing offers major computational advances but threatens modern public-key cryptography. Classical algorithms such as RSA, Diffie–Hellman (DH), and Elliptic Curve Cryptography (ECC) are vulnerable to quantum attacks, particularly Shor’s algorithm. As large-scale quantum capabilities emerge, post-quantum cryptography (PQC) has become essential to ensure future data confidentiality, integrity, and authentication. This paper discusses the need to replace classical cryptography, explores quantum-safe solutions, and examines challenges in large-scale migration. PQC is critical across government, critical infrastructure, finance, healthcare, telecommunications, IoT, autonomous vehicles, and 6G networks. A key concern is “harvest-now, decrypt-later” attacks, where encrypted data is stored today for future quantum decryption. The study analyzes classical cryptographic vulnerabilities and reviews major PQC families: lattice-based, hash-based, code-based, multivariate-based, and isogeny-based schemes, highlighting the ongoing NIST standardization efforts. It proposes a migration framework including quantum-readiness assessment, algorithm selection, hybrid implementation, and performance evaluation. Results show that although PQC introduces higher computational complexity, optimized implementations can support real-time applications with reasonable overhead. Among PQC approaches, lattice-based schemes appear most mature and balanced in terms of security and key size. The paper concludes that quantum-safe cryptography is a necessary evolution requiring continuous monitoring, adaptable systems, and alignment with emerging standards.