Security Rests on Three Grounds, and a Quantum Computer Breaks Only One ── RSA at 2048 Bits Is Accelerated by 10^25.3, Yet Multiplying the Key Length by 8 Raises the Quantum Effort Only 512-fold ── What Holds No Information Cannot Be Computed by Any Machine ── [Paper 305]
The sentence “this cipher is secure” rests on one of three different grounds. This paper asks which of them a quantum computer breaks──the answer is one. No new mathematical theorem and no new law is claimed. Scope of this paper (scope note): No new mathematical theorem and no new law is claimed──the complexity of the number field sieve, Shor’s algorithm, Grover’s algorithm, and the perfect secrecy of the one-time pad are all standard. We do not build cryptography──all we use is one exponent and one mutual information. We do not explain the algorithms──Shor and Grover are quoted by their cost formulas, and we do not enter their workings. We do not discuss implementation security──key management, randomness quality, side channels, and implementation flaws are not treated at all. Most real breaks live there, but this paper treats only the type of ground. We do not discuss the feasibility of quantum computers──neither when nor whether they can be built is treated. Only what would break if they were. We assert no values for the effort──the sieve’s exponent is asymptotic, and 10^25.3 is an order with constants dropped. Only the direction and the order are claimed. We do not treat lattice cryptography──post-quantum schemes also sit on the computational ground, and which problems stay hard under quantum attack is not adjudicated here. Relation to earlier papers: Paper 281 showed that what cannot be copied can still be corrected, and that eavesdropping becomes the number 25%──the third ground here is the physical security shown there. Paper 252 counted four quantities called “information,” needing different things──the second ground here rests on a mutual information that is exactly 0. Paper 112 counted “six distinct roots sharing one rhyme”──“security” here likewise has three distinct roots under one word. Paper 302 treated how existence does not give quantity──computational security likewise sits where “hard” has no settled quantity. What is added is lining up the three grounds by what they depend on, computing the RSA-2048 acceleration as 10^25.3, showing that an eightfold key length raises the quantum effort only 512-fold, and separating symmetric from public key by square root against cube. First, there are three grounds. Computational, information-theoretic, and physical security, and all three depend on different things (Section 2). Second, this is the core of the paper. A quantum computer breaks only the first, and cannot in principle reach the other two (Section 3). Third, the breaking is dramatic. At RSA 2048 bits the ratio of classical to quantum effort is 10^25.3 (Section 4). Fourth, key length cannot answer it. Multiplying the key length by 8 raises the quantum effort only 512-fold (Section 4). Fifth, symmetric keys need only be doubled. Grover gains only a square root, and AES-256 retains an effective 128 bits (Section 5). Sixth, the separator is resting on difficulty against resting on the absence of information (Section 6). “This cipher is secure” rests on one of three different grounds──computational (it is hard), information-theoretic (there is no information), and physical (measuring destroys). A quantum computer breaks only the first──“quantum computers will break cryptography” is one third right. The breaking is indeed dramatic──at RSA 2048 bits the ratio of classical to quantum effort is 10^25.3, and at 4096 bits 10^36.3. And key length cannot answer it──against the classical attack 2538 bits reaches 2^128, while on the quantum side an eightfold key raises the effort only 512-fold. Symmetric keys are another matter──Grover gains only a square root, so AES-256 retains an effective 128 bits. One thing separates them──whether the security rests on difficulty or on the absence of information. Difficulty moves with machines. I(M;C)=0 does not move. Put exactly──a quantum computer breaks the ciphers that rest on difficulty. On the making of this work: The ideas and content of this work stem from the author's own considerations. Assistance from an AI (a large language model) was used for structuring, English translation, and checking the algebra. Any remaining errors or misinterpretations are solely the author's. Feedback and corrections are sincerely appreciated. ----- 「この暗号は安全である」という一文は、三つの別の根拠のどれかに立っている。本稿が問うのは、量子計算機が壊すのはどれかである──答は、一つだけである。新しい数学定理も新しい法則も主張しない。 本稿の射程(射程注記):新しい数学定理も新しい法則も主張しない──数体篩の計算量、ショアのアルゴリズム、グローバーのアルゴリズム、ワンタイムパッドの完全秘匿性は、いずれも標準的である。暗号を作らない──使うのは一つの指数と、一つの相互情報量だけである。アルゴリズムを説明しない──ショアもグローバーも手間の式を引くだけであり、中身には立ち入らない。実装の安全を論じない──鍵管理、乱数の質、サイドチャネル、実装の欠陥は一切扱わない。現実の破られ方の大半はここにあるが、本稿は根拠の型だけを扱う。量子計算機の実現可能性を論じない──いつ作れるかも、作れるかも扱わない。作れたとして何が壊れるかだけを数える。手間の値を主張しない──数体篩の指数は漸近形であり、10^25.3 は定数因子を無視した桁である。比較の向きと桁だけが本稿の主張である。格子暗号を扱わない──耐量子暗号も計算量的安全の側にあるが、どの問題が量子で難しいままかは本稿では判定しない。既刊との関係:論文281 は複製できないのに訂正できることを示し、盗聴が 25% という数になると書いた──本稿の三つ目の根拠はそこで示された物理的安全である。論文252 は「情報量」が四つあり要るものが違うと数えた──本稿の二つ目の根拠は相互情報量が厳密に 0であることに立つ。論文112 は「同じ韻を踏む六つの別根」を数えた──本稿の「安全」も一語の下に三つの別根を持つ。論文302 は存在が定量を教えないことを扱った──本稿の計算量的安全も「難しい」の定量が定まらない側にある。加えたのは三つの根拠を依存先で並べたこと、RSA 2048 bit の加速を 10^25.3 と計算したこと、鍵長を 8 倍にしても量子側が 512 倍にしかならないと示したこと、対称鍵と公開鍵で対処法が違う理由を平方根と三乗で分けたことである。 第一に、根拠は三つある。計算量的安全・情報理論的安全・物理的安全であり、依存先が三つとも違う(第2節)。 第二に、これが本稿の芯である。量子計算機が壊すのは一つ目だけであり、残り二つには原理的に届かない(第3節)。 第三に、壊れ方は劇的である。 RSA 2048 bit で古典と量子の手間の比は 10^25.3 である(第4節)。 第四に、鍵長では対抗できない。鍵長を 8 倍にしても、量子側の手間は 512 倍にしかならない(第4節)。 第五に、対称鍵は倍にすれば済む。グローバーは平方根しか稼がず、AES-256 は実効 128 bitで足りる(第5節)。 第六に、分離子は「難しさに立つか、情報の不在に立つか」である(第6節)。 「この暗号は安全である」は、三つの別の根拠のどれかに立っている──計算量的安全(難しい)、情報理論的安全(情報が無い)、物理的安全(測れば壊れる)である。量子計算機が壊すのは一つ目だけである──「量子計算機が暗号を破る」という一文は、三分の一しか当たっていない。壊れ方は確かに劇的である──RSA 2048 bit で古典と量子の手間の比は 10^25.3、4096 bit では 10^36.3 である。そして鍵長では対抗できない──古典に対しては 2538 bit で 2^128 相当まで行けるのに、量子側は鍵長を 8 倍にしても手間が 512 倍にしかならない。対称鍵は事情が違う──グローバーは平方根しか稼がないので、AES-256 にすれば実効 128 bit で足りる。分けるものは一つ──その安全が、難しさに立っているか、情報の不在に立っているか。難しさは計算機で動く。 I(M;C)=0 は動かない。正確に言えばこうである──量子計算機は、難しさに立つ暗号を破る。 作成にあたって:本稿の着想と内容は、著者自身の考察に基づくものです。文章の構成整理や英訳、数式の確認には AI(大規模言語モデル)の助力を得ました。最終的な内容の解釈や誤りがあれば、それらはすべて著者の責に帰します。お気づきの点があれば、ご教示いただければ幸いです。
The sentence “this cipher is secure” rests on one of three different grounds. This paper asks which of them a quantum computer breaks──the answer is one. No new mathematical theorem and no new law is claimed. Scope of this paper (scope note): No new mathematical theorem and no new law is claimed──the complexity of the number field sieve, Shor’s algorithm, Grover’s algorithm, and the perfect secrecy of the one-time pad are all standard. We do not build cryptography──all we use is one exponent and one mutual information. We do not explain the algorithms──Shor and Grover are quoted by their cost formulas, and we do not enter their workings. We do not discuss implementation security──key management, randomness quality, side channels, and implementation flaws are not treated at all. Most real breaks live there, but this paper treats only the type of ground. We do not discuss the feasibility of quantum computers──neither when nor whether they can be built is treated. Only what would break if they were. We assert no values for the effort──the sieve’s exponent is asymptotic, and 10^25.3 is an order with constants dropped. Only the direction and the order are claimed. We do not treat lattice cryptography──post-quantum schemes also sit on the computational ground, and which problems stay hard under quantum attack is not adjudicated here. Relation to earlier papers: Paper 281 showed that what cannot be copied can still be corrected, and that eavesdropping becomes the number 25%──the third ground here is the physical security shown there. Paper 252 counted four quantities called “information,” needing different things──the second ground here rests on a mutual information that is exactly 0. Paper 112 counted “six distinct roots sharing one rhyme”──“security” here likewise has three distinct roots under one word. Paper 302 treated how existence does not give quantity──computational security likewise sits where “hard” has no settled quantity. What is added is lining up the three grounds by what they depend on, computing the RSA-2048 acceleration as 10^25.3, showing that an eightfold key length raises the quantum effort only 512-fold, and separating symmetric from public key by square root against cube. First, there are three grounds. Computational, information-theoretic, and physical security, and all three depend on different things (Section 2). Second, this is the core of the paper. A quantum computer breaks only the first, and cannot in principle reach the other two (Section 3). Third, the breaking is dramatic. At RSA 2048 bits the ratio of classical to quantum effort is 10^25.3 (Section 4). Fourth, key length cannot answer it. Multiplying the key length by 8 raises the quantum effort only 512-fold (Section 4). Fifth, symmetric keys need only be doubled. Grover gains only a square root, and AES-256 retains an effective 128 bits (Section 5). Sixth, the separator is resting on difficulty against resting on the absence of information (Section 6). “This cipher is secure” rests on one of three different grounds──computational (it is hard), information-theoretic (there is no information), and physical (measuring destroys). A quantum computer breaks only the first──“quantum computers will break cryptography” is one third right. The breaking is indeed dramatic──at RSA 2048 bits the ratio of classical to quantum effort is 10^25.3, and at 4096 bits 10^36.3. And key length cannot answer it──against the classical attack 2538 bits reaches 2^128, while on the quantum side an eightfold key raises the effort only 512-fold. Symmetric keys are another matter──Grover gains only a square root, so AES-256 retains an effective 128 bits. One thing separates them──whether the security rests on difficulty or on the absence of information. Difficulty moves with machines. I(M;C)=0 does not move. Put exactly──a quantum computer breaks the ciphers that rest on difficulty. On the making of this work: The ideas and content of this work stem from the author's own considerations. Assistance from an AI (a large language model) was used for structuring, English translation, and checking the algebra. Any remaining errors or misinterpretations are solely the author's. Feedback and corrections are sincerely appreciated. ----- 「この暗号は安全である」という一文は、三つの別の根拠のどれかに立っている。本稿が問うのは、量子計算機が壊すのはどれかである──答は、一つだけである。新しい数学定理も新しい法則も主張しない。 本稿の射程(射程注記):新しい数学定理も新しい法則も主張しない──数体篩の計算量、ショアのアルゴリズム、グローバーのアルゴリズム、ワンタイムパッドの完全秘匿性は、いずれも標準的である。暗号を作らない──使うのは一つの指数と、一つの相互情報量だけである。アルゴリズムを説明しない──ショアもグローバーも手間の式を引くだけであり、中身には立ち入らない。実装の安全を論じない──鍵管理、乱数の質、サイドチャネル、実装の欠陥は一切扱わない。現実の破られ方の大半はここにあるが、本稿は根拠の型だけを扱う。量子計算機の実現可能性を論じない──いつ作れるかも、作れるかも扱わない。作れたとして何が壊れるかだけを数える。手間の値を主張しない──数体篩の指数は漸近形であり、10^25.3 は定数因子を無視した桁である。比較の向きと桁だけが本稿の主張である。格子暗号を扱わない──耐量子暗号も計算量的安全の側にあるが、どの問題が量子で難しいままかは本稿では判定しない。既刊との関係:論文281 は複製できないのに訂正できることを示し、盗聴が 25% という数になると書いた──本稿の三つ目の根拠はそこで示された物理的安全である。論文252 は「情報量」が四つあり要るものが違うと数えた──本稿の二つ目の根拠は相互情報量が厳密に 0であることに立つ。論文112 は「同じ韻を踏む六つの別根」を数えた──本稿の「安全」も一語の下に三つの別根を持つ。論文302 は存在が定量を教えないことを扱った──本稿の計算量的安全も「難しい」の定量が定まらない側にある。加えたのは三つの根拠を依存先で並べたこと、RSA 2048 bit の加速を 10^25.3 と計算したこと、鍵長を 8 倍にしても量子側が 512 倍にしかならないと示したこと、対称鍵と公開鍵で対処法が違う理由を平方根と三乗で分けたことである。 第一に、根拠は三つある。計算量的安全・情報理論的安全・物理的安全であり、依存先が三つとも違う(第2節)。 第二に、これが本稿の芯である。量子計算機が壊すのは一つ目だけであり、残り二つには原理的に届かない(第3節)。 第三に、壊れ方は劇的である。 RSA 2048 bit で古典と量子の手間の比は 10^25.3 である(第4節)。 第四に、鍵長では対抗できない。鍵長を 8 倍にしても、量子側の手間は 512 倍にしかならない(第4節)。 第五に、対称鍵は倍にすれば済む。グローバーは平方根しか稼がず、AES-256 は実効 128 bitで足りる(第5節)。 第六に、分離子は「難しさに立つか、情報の不在に立つか」である(第6節)。 「この暗号は安全である」は、三つの別の根拠のどれかに立っている──計算量的安全(難しい)、情報理論的安全(情報が無い)、物理的安全(測れば壊れる)である。量子計算機が壊すのは一つ目だけである──「量子計算機が暗号を破る」という一文は、三分の一しか当たっていない。壊れ方は確かに劇的である──RSA 2048 bit で古典と量子の手間の比は 10^25.3、4096 bit では 10^36.3 である。そして鍵長では対抗できない──古典に対しては 2538 bit で 2^128 相当まで行けるのに、量子側は鍵長を 8 倍にしても手間が 512 倍にしかならない。対称鍵は事情が違う──グローバーは平方根しか稼がないので、AES-256 にすれば実効 128 bit で足りる。分けるものは一つ──その安全が、難しさに立っているか、情報の不在に立っているか。難しさは計算機で動く。 I(M;C)=0 は動かない。正確に言えばこうである──量子計算機は、難しさに立つ暗号を破る。 作成にあたって:本稿の着想と内容は、著者自身の考察に基づくものです。文章の構成整理や英訳、数式の確認には AI(大規模言語モデル)の助力を得ました。最終的な内容の解釈や誤りがあれば、それらはすべて著者の責に帰します。お気づきの点があれば、ご教示いただければ幸いです。
This chapter explores the cryptographic implications of quantum computing, offering a detailed yet accessible breakdown of how quantum systems fundamentally differ from classical ones and why that difference threatens modern digital security. It introduces key quantum concepts such as superposition and parallelism, and explains how these capabilities enable powerful algorithms like Shor's and Grover's to solve mathematical problems that underpin today's encryption systems. The chapter compares symmetric encryption (e.g., AES) and asymmetric encryption (e.g., RSA, ECC, Diffie-Hellman), showing why public-key infrastructure (PKI) is especially vulnerable to quantum attacks. The chapter provides a clear explanation of how Shor's Algorithm breaks RSA and ECC by efficiently factoring large integers and solving discrete logarithms – problems considered infeasible for classical computers. It also examines Grover's Algorithm, which weakens symmetric encryption by reducing brute-force search times, prompting recommendations to adopt longer key lengths such as AES-256. Real-world experiments from Google's Willow processor and China's Zuchongzhi 3.0 demonstrate meaningful progress in quantum hardware, indicating that the Q-Day scenario – when cryptographically relevant quantum computers emerge – is rapidly approaching.
Quantum computing endangers classical cryptography via two main avenues: Shor’s al-gorithm reduces integer factorization to polynomial time, and Grover’s algorithm yields a quadratic speed-up for unstructured key search. We develop rigorous mathematical treatment of both algorithms, enrich the literature survey with detailed complexity and resource analyses, and extend the development section to include quantum er-ror-correction overhead, resource estimates for breaking 2048-bit RSA, and advanced as-ymptotic bounds. In Discussion, we propose lattice-, code-, multivariate-, and hash-based post-quantum schemes, analyze their security margins against quantum attacks, and out-line standardized migration strategies. We include three illustrative figures and 35+ se-quential IEEE citations.
In today’s digital world, most of our personal, financial, and health data is stored online. This makes cybersecurity extremely important — but also more challenging. Recent cyberattacks like the one on Australia’s MediSecure show how weak security can lead to huge losses. Now, a new risk is emerging: quantum computers. These work very differently from classical computers and can break the encryption methods (like RSA and AES) that we currently use to protect online data. This paper explains how cryptography works, what types exist (symmetric and asymmetric), and why current systems may not survive in a world where quantum computers are common. It introduces powerful quantum algorithms like Shor’s and Grover’s, which can break RSA and weaken AES much faster using quantum computers than any normal computers. This shows the power of quantum computers. These developments have pushed scientists to create new encryption systems called Post-Quantum Cryptography (PQC), which are built to resist quantum attacks but still run on regular devices. The paper also explores how quantum computing is evolving — from early research in the 1980s to real working processors today — and how countries and companies are investing in this technology. It suggests that in the future, people may access quantum computers over the cloud, rather than owning them. Finally, this research shows that the rise of quantum computing is both a threat and an opportunity. It challenges us to update our security systems, but it also opens the door for new startups and careers in quantum-safe cybersecurity.
The present knowledge we had in quantum computer and the most possible architecture of a quantum computer might be able to break RSA 2048 in future. In classical computer two bits represents any one of four bit information whereas in quantum due to superposition it can be represent all four states. For ‘n’ qubits system is analogous to 2n classical bits. Quantum teleportation, quantum entanglement and other makes it possible to break present cryptosystem. Shor’s Algorithm is used for integer factorization which is polynomial time for quantum computer. This can be threat for RSA security. In this paper matlab implementation of Shor’s algorithm is presented. Used classical way for getting period of function because classical computers not engage quantum phenomena. As numbers of iterations grow, probability of getting exact factor of ‘n’ acutely increased. This paper also discusses popular methods for making qubits like Silicon based Qubits in which electron is put inside nano material which is used as a transistor. In Superconducting circuit method insulator is used as a sandwich in between two metal layers. Used by Google, IBM, Intel, Microsoft. In Flux qubits method very small size loop of superconducting metal is used. This paper also discusses Quantum Proof Algorithm like Lattice-based cryptography used concept of good and bad base. In Learning with errors method if we have more equation then variable, it is over defined system. In Code based cryptography some matrixes allow for efficient error correction (good matrix) but most matrix’s does not (bad matrix) concept is used. In Hash based signatures scheme have long signatures or keys, but they are secure. Also discuss Multivariate Quantum proof algorithm. The abstract should contain maximum of 300 words. No abbreviation should be mentioned in the abstract. Give a brief summary of your research work.
Large quantum computers pose a threat to our public-key cryptographic infrastructure. The possible responses are: \n \nDo nothing; accept the fact that quantum computers might be used to break widely deployed protocols. \nMitigate the threat by switching entirely to symmetric-key protocols. \nMitigate the threat by switching to different public-key protocols. \n \nEach user of public-key cryptography will make one of these choices, and we should not expect consensus. Some users will do nothing---perhaps because they view the threat as being too remote. And some users will find that they never needed public-key cryptography in the first place. \n \nThe work that I present here is for people who need public-key cryptography and want to switch to new protocols. Each of the three articles raises the security estimate of a cryptosystem by showing that some attack is less effective than was previously believed. Each article thereby reduces the cost of using a protocol by letting the user choose smaller (or more efficient) parameters at a fixed level of security. \n \nIn Part 1, I present joint work with Samuel Jaques in which we revise security estimates for the Supersingular Isogeny Key Exchange (SIKE) protocol. We show that known quantum claw-finding algorithms do not outperform classical claw-finding algorithms. This allows us to recommend 434-bit primes for use in SIKE at the same security level that 503-bit primes had previously been recommended. \n \nIn Part 2, I present joint work with Martin Albrecht, Vlad Gheorghiu, and Eamonn Postelthwaite that examines the impact of quantum search on sieving algorithms for the shortest vector problem. Cryptographers commonly assume that the cost of solving the shortest vector problem in dimension d is 2(0.265ldots+o(1))d quantumly and 2(0.292ldots+o(1))d classically. These are upper bounds based on a near neighbor search algorithm due to Becker--Ducas--Gama--Laarhoven. Naively, one might think that d must be at least 483(approx128/0.265) to avoid attacks that cost fewer than 2128 operations. Our analysis accounts for terms in the o(1) that were previously ignored. In a realistic model of quantum computation, we find that applying the Becker--Ducas--Gama--Laarhoven algorithm in dimension d>376 will cost more than 2128 operations. We also find reason to believe that the classical algorithm will outperform the quantum algorithm in dimensions d<288. \n \nIn Part 3, I present solo work on a variant of post-quantum RSA. The original pqRSA proposal by Bernstein--Heninger--Lou--Valenta uses terabyte keys of the form n=p1p2p3p4cdotspicdotsp231 where each pi is a 4096-bit prime. My variant uses terabyte keys of the form n=p12p23p35p47cdotspipiicdotsp20044225287 where each pi is a 4096-bit prime and pii is the i-th prime. Prime generation is the most expensive part of post-quantum RSA in practice, so the smaller number of prime factors in my proposal gives a large speedup in key generation. The repeated factors help an attacker identify an element of small order, and thereby allow the attacker to use a small-order variant of Shor's algorithm. I analyze small-order attacks and discuss the cost of the classical pre-computation that they require.
Classical cryptography has been around for a long time in the documented human history, but most classical ciphers were broken and even solved by hand. Shannon introduced the notion of perfect secrecy that formally defines confidentiality in the information-theoretic sense, which is only possible in the restricted scenarios where the message is no longer than the encryption key. The invention of public-key cryptography (the Diffie-Hellman key exchange protocol in 1976 and the RSA crypto-system in 1977) marks the birth of modern cryptography, allowing parties to exchange messages securely without sharing any secrets in advance. Furthermore, it provides computational security based on the conjectured hardness of mathematical problems such as factorization and the discrete logarithm. Public-key cryptography has found numerous applications in the Internet, financial and banking industry, and blockchains, and it plays a crucial role in protecting information security and asset safety. Unfortunately, in the 1990s, Shor proposed efficient quantum algorithms that solve number-theoretic problems, including factorization and discrete logarithms in polynomial time. Once a quantum computer of a particular scale becomes a reality, it will cause a devastating blow to the existing public-key infrastructure. To deal with such a ‘quantum crisis’, academia and industry are looking into the design, analysis and standardization of cryptographic algorithms that can resist quantum computers referred to as post-quantum cryptography (PQC). The National Institute of Standards and Technology (NIST) has been soliciting proposals for the post-quantum public-key algorithms since 2016. More recently, the Chinese Association for Cryptologic Research (CACR) held a competition on designing cryptographic algorithms whose public-key cryptography track focused on post-quantum cryptographic algorithms. Lattice-based cryptography is considered by most to be the mainstream technical route of post-quantum cryptography, which is reflected in the number of proposals (and their percentage of the total) received in the NIST PQC process. To reflect the status quo of post-quantum cryptography, we invite leading experts in this area to contribute three technical perspectives that aim to help readers understand the algorithms, the underlying basic techniques and different technical routes to achieve quantum resistance. The first perspective, presented by Lu and Zhang, introduces public-key cryptographic algorithms whose quantum security is reducible from the conjectured quantum hardness of lattice problems. In particular, they mainly focus on public-key encryption (PKE) and the key encapsulation mechanism (KEM), which are essential building blocks for securing the confidentiality of communication without pre-shared secrets. Both types of crypto-systems are solicited by the NIST PQC standardization and the CACR algorithm design competition. This perspective gives a comprehensive survey on practical lattice-based PKEs/KEMs, and their best-known quantum and classical attacks. Another important post-quantum crypto-system is digital signature, which ensures that three goals of information security are met other than confidentiality, namely, integrity, authentication and non-repudiation. The second perspective is on lattice-based signature by Lyubashevsky. In this perspective, he surveys different techniques in building lattice-based post-quantum crypto-systems, discusses the challenges in overcoming performance issues and gives us state-of-the-art digital signature schemes. In addition to ensuring the ‘static’ security of information in storage and transmission, advanced cryptographic algorithms and protocols can guarantee information security during the computation process (possibly among multiple parties), referred to as privacy-preserving computation. Cryptographic techniques involved in privacy-preserving computation include secure multi-party computation, zero-knowledge proof and fully homomorphic encryption. There is a pressing need to migrate them to the post-quantum era. The third perspective, by Yu and Xie, presents practical instantiations of these algorithms and discusses possible ways to migrate them to their quantum-resistant counterparts. To summarize, post-quantum cryptography has received widespread attention and made significant progress in recent years. Some post-quantum cryptographic algorithms, such as the lattice-based candidate, also have other advantages (e.g., computational efficiency and full homomorphism) over their classical counterparts. Lattice-based cryptography is an emerging field with high theoretical value and wide application, and we encourage young researchers to enter and explore this new and exciting field.