With the arrival of fault-tolerant quantum computers, an existential threat has come to the cryptographic underpinnings of the security infrastructure in place for modern information technologies. Virtually all secure digital communication protocols used today are based on classical public-key cryptographic systems – RSA, Elliptic Curve Cryptography (ECC) and Diffie-Hellman key exchange – that are susceptible to polynomial-time quantum attacks using Shor's algorithm. Symmetric cryptographic algorithms that are not broken are being effectively halved by Grover's algorithm, for example, AES. In this article, a complete and journal-standard systematic review of quantum computing and its implications in the field of information technology security is presented which includes 22 peer-reviewed publications from 2023-2025. The study covers the basics of quantum computing (qubits, superposition, entanglement and quantum gates), and how quantum computing specifically poses a threat to classical cryptography via algorithmic mechanisms. The three post-quantum cryptographic algorithms that were standardised by the National Institute of Standards and Technology (NIST) in August 2024 (ML-KEM, FIPS 203; ML-DSA, FIPS 204; and SLH-DSA, FIPS 205) are compared based on their security assumptions, performance, and readiness for deployment. The practical limitations and the use of Quantum Key Distribution, (QKD), as a physics based alternative to the computational security assumptions are discussed. Results show that although mature PQ solutions are now available for most cryptographic applications, the migration challenge, including legacy system transitions, migration architecture, and governance, is significant and pressing as the ‘harvest now, decrypt later’ threat model is relevant and adversaries might be collecting encrypted data for quantum decryption. The impact for financial services, health care, government, cloud infrastructure and critical national infrastructure is discussed. Lastly, the researchers list key research areas: standardisation of quantum-safe protocols, hybrid PQC-QKD designs, light-weight PQC for constrained devices, and quantum-safe blockchain.
With the arrival of fault-tolerant quantum computers, an existential threat has come to the cryptographic underpinnings of the security infrastructure in place for modern information technologies. Virtually all secure digital communication protocols used today are based on classical public-key cryptographic systems – RSA, Elliptic Curve Cryptography (ECC) and Diffie-Hellman key exchange – that are susceptible to polynomial-time quantum attacks using Shor's algorithm. Symmetric cryptographic algorithms that are not broken are being effectively halved by Grover's algorithm, for example, AES. In this article, a complete and journal-standard systematic review of quantum computing and its implications in the field of information technology security is presented which includes 22 peer-reviewed publications from 2023-2025. The study covers the basics of quantum computing (qubits, superposition, entanglement and quantum gates), and how quantum computing specifically poses a threat to classical cryptography via algorithmic mechanisms. The three post-quantum cryptographic algorithms that were standardised by the National Institute of Standards and Technology (NIST) in August 2024 (ML-KEM, FIPS 203; ML-DSA, FIPS 204; and SLH-DSA, FIPS 205) are compared based on their security assumptions, performance, and readiness for deployment. The practical limitations and the use of Quantum Key Distribution, (QKD), as a physics based alternative to the computational security assumptions are discussed. Results show that although mature PQ solutions are now available for most cryptographic applications, the migration challenge, including legacy system transitions, migration architecture, and governance, is significant and pressing as the ‘harvest now, decrypt later’ threat model is relevant and adversaries might be collecting encrypted data for quantum decryption. The impact for financial services, health care, government, cloud infrastructure and critical national infrastructure is discussed. Lastly, the researchers list key research areas: standardisation of quantum-safe protocols, hybrid PQC-QKD designs, light-weight PQC for constrained devices, and quantum-safe blockchain.
This preprint presents a systematic review of how quantum computing impacts the security of classical cryptography and what mitigation strategies are available. The review synthesises key survey papers, standards reports and transition guidelines on post-quantum cryptography (PQC) and quantum-safe security published between 2015 and 2025. First, the paper summarises the impact of Shor’s and Grover’s algorithms on widely deployed public-key schemes, symmetric ciphers and hash functions, highlighting in particular the existential break of RSA, Diffie–Hellman and elliptic-curve cryptography, and the reduced security margins for symmetric and hash-based constructions. It then examines major quantum-resilient responses, including lattice-, code-, multivariate- and hash-based PQC, quantum key distribution (QKD), hybrid classical–PQC schemes and crypto-agile architectures. Building on Mosca’s x, y, z risk-timing model, the review discusses cross-cutting themes such as harvest-now-decrypt-later threats and sector-specific implications for government and defence, finance and blockchain, healthcare, cloud providers and critical infrastructure. It identifies several research gaps, including the lack of quantitative migration-cost data, limited coverage of small and resource-constrained organisations, and few system-scale evaluations comparing PQC-only, hybrid and QKD-based designs. The paper concludes by arguing that planning and investment in quantum-resilient cryptography need to start now, before migration time and data shelf-life push critical systems into the risky regime.
The maturation of quantum computing hardware and algorithms has transformed what was once a theoretical concern into an active planning priority for governments, enterprises, and standards bodies. This paper assesses the current and projected threat that quantum computation poses to classical public-key cryptographic standards, namely RSA, elliptic curve cryptography (ECC), and Diffie-Hellman key exchange, all of which derive their security from mathematical problems that Shor's algorithm renders tractable on a sufficiently large fault-tolerant quantum computer. We synthesize recent hardware progress, algorithmic refinements that have substantially reduced estimated qubit requirements, and the finalization of NIST's post-quantum cryptography (PQC) standards (FIPS 203, 204, and 205) to provide an evidence-based assessment of where the field stands as of mid-2026. Particular attention is given to the widening gap between optimistic resource estimates, including a contested March 2026 claim of a thousand-fold reduction in factoring resources, and the practical reality that no existing quantum computer approaches the logical qubit counts required to threaten deployed encryption. We further examine migration challenges, including performance overhead, cryptographic agility, constraints on embedded and IoT systems, and the harvest-now-decrypt-later threat model that makes migration urgency independent of exact timeline predictions. Drawing on NIST transition guidance and recent G7 coordination targets, we argue that organizations should treat cryptographic migration as a present-tense operational requirement rather than a future contingency, regardless of unresolved disagreement among experts about when a cryptographically relevant quantum computer will exist. The paper concludes with practical recommendations for risk-based migration prioritization and identifies open research questions in cryptographic agility and quantum-resistant system design.
Abstract Classical computing architectures cannot reasonably solve computationally challenging problems, such as those of RSA public-key encryption, Diffie-Hellman key exchange, and elliptic curve cryptography, which form the cryptographic foundations of modern enterprise information security. Superposition and entanglement phenomena can be used to make quantum computers efficient in solving these problems, which are efficiently solved by Shor's algorithm and Grover's algorithm, and make existing cryptographic infrastructure entirely insecure. While quantum computing is fault-tolerant and still under development, the 'harvest now, decrypt later' threat model by which adversaries can harvest encrypted data now to be decrypted later when they can operate quantum systems signals that the cryptographic threat is present, not future. The objective of this study is to examine the current state of enterprise cryptographic readiness against threats in the quantum era and to create a model for organizational transition to the new cryptographic standards in the quantum era, which is called the Quantum-Resilient Security Architecture (QRSA) Framework. It uses a mixed-methods research methodology, consisting of a systematic literature review, an expert Delphi survey of 38 cybersecurity practitioners from 16 countries, and a qualitative analysis of five enterprise organizations, to examine the state of quantum-capable cryptographic protocols, the readiness of organizations in the technical, governance and capability aspects, and the most important enablers and blockers for the post-quantum migration. The key findings include that: 94 percent of enterprise systems assessed are today still using quantum-vulnerable cryptographic primitives; less than 12 percent of organizations surveyed have started formal planning efforts for quantum migration; and, in most of the cases analyzed, the National Institute of Standards and Technology (NIST) post-quantum cryptography standardization process has not made significant impacts on enterprise security roadmaps. The QRSA Framework offers a staged migration architecture based on the NIST standardized algorithms such as CRYSTALS-Kyber, CRYSTALS-Dilithium and SPHINCS+ that integrates with the enterprise security infrastructure. Contributions include cybersecurity governance scholarship, enterprise risk management theory, and information security policy.
The arrival of cryptographically relevant quantum computers (CRQCs) represents an existential threat to the public-key cryptographic infrastructure underpinning global enterprise operations. Enterprise security today relies on RSA and elliptic-curve cryptography (ECC) for TLS, VPNs, PKI, code signing, and identity systems—all of which are fundamentally broken by Shor's algorithm on a sufficiently powerful quantum computer. The defining risk is time-shifted compromise: adversaries can harvest encrypted traffic today and decrypt it once CRQCs exist, a threat already underway according to U.S. intelligence assessments. NIST finalized three post-quantum cryptographic (PQC) standards in August 2024 (FIPS 203/204/205) and mandates deprecation of quantum-vulnerable algorithms by 2035. Yet only 5% of organizations have implemented quantum-safe encryption and 95% lack formal quantum transition plans. This paper provides a comprehensive, threat-driven analysis across seven dimensions: quantum algorithm impact, harvest-now-decrypt-later (HNDL) threat models, enterprise asset risks (PKI, TLS, VPNs, code signing, cloud, IoT, identity, blockchain, supply chain), sector-specific vulnerabilities (financial services, healthcare, critical infrastructure), cryptographic primitive analysis, migration standards and roadmaps, and enterprise readiness gaps. The convergence of HNDL attacks already underway, multi-decade data sensitivity windows, and 12–15 year enterprise migration timelines means the migration deadline has, for most sectors, already passed.
The accelerating development of quantum computing represents one of the most significant paradigm shifts in the history of information security. Cryptographic systems that currently underpin global digital infrastructure—including RSA, Diffie–Hellman, and Elliptic Curve Cryptography—rely on mathematical assumptions that collapse under quantum algorithms such as Shor’s and Grover’s. Post-Quantum Cryptography (PQC) emerges as the most viable and immediate solution to secure communications in the quantum era, offering cryptographic primitives that can be deployed on today’s classical hardware while resisting both classical and quantum attacks. This review provides a comprehensive, detailed examination of PQC, analyzing its mathematical foundations, algorithmic families, standardization progress, and deployment challenges. Special emphasis is placed on the NIST PQC standardization process, the risk posed by “harvest-now-decrypt-later” adversaries, the complexities of global cryptographic migration, and the implications for critical digital infrastructures such as cloud computing, blockchain systems, long-lifespan data archives, IoT ecosystems, and national cybersecurity. Through standalone equations, tables, and figures—including a conceptual visual provided by the user—this paper offers a complete, cohesive, and rigorous synthesis. The findings underscore that the transition to PQC is not optional but imperative, requiring coordinated scientific, governmental, and industrial effort to safeguard the digital future.
Quantum computing is a transformational technology once implemented, capable of addressing problems far beyond the capacity of classical computers. But this progress is also a real challenge to the core of today's modern security. Traditional cryptographic algorithms, such as those based on RSA, ECC, and Diffie-Hellman key exchange, are based on the computational hardness of problems such as prime factorization and discrete logarithms that quantum algorithms solve in polynomial time. As a particular research interesting example, with Shor's Algorithm one can factorize large numbers efficiently, rendering insecure the majority of public key cryptosystems used nowadays. This urgently demands a reevaluation of existing encryption schemes in the context of a post-quantum world. In this paper, we take a closer look at the threats that quantum computers pose to classical security infrastructure including encryption scheme and explore the impact that quantum computation can have on current cryptographic schemes. It calculates the cost in terms of symmetric and asymmetric security, accounting for effects of both Shor's and Grover's algorithms. Symmetric key systems such as AES are also harder hit—Grover's algorithm can give only a quadratic speedup here—but they do need to double key sizes for a sufficient level of post-quantum security. In reaction to those threats, the paper investigates nextgeneration post-quantum cryptographic (PQC) solutions resistant to quantum cryptanalysis. Lattice-based cryptosystems, hash-based signature schemes, multivariate polynomial systems, and code-based cryptosystems are some of the candidates that are being considered in international standardization work, including especially at NIST. In this paper, we compare those alternatives for security, performance, scalability, and feasibility of implementation in real system. An important aspect of this contribution is a comparative study of traditional and post-quantum cryptographic protocols in the context of a number of cybersecurity applications, including secure communications, blockchain networks and IoT contexts. It also covers the quantum readiness timeline and transitional issues, such as backward compatibility, standardization lag and the associated increased computational overhead. Through a mitigated risk evaluation and cryptanalytic attack simulation based on quantum-inspired algorithms, this analysis emphasizes the need to prepare ourselves against quantum-induced security issues. It provides strategic guidance to organizations as they plan for the post-quantum future, stressing cryptographic agility, hybrid encryption models and real-time threat monitoring. Ultimately, the results of this work add to the worldwide conversation on establishing secure systems within the digital age of quantum computing and recommend proactive migration plans for the integrity, confidentiality, and trust one should have in the future cyber world.