The National Security Agency has published the NSA Primer — a plain-language guide to post-quantum cryptography — outlining the lattice-based and hash-based algorithms the agency says are needed to protect critical networks once quantum computers can defeat today’s encryption.
The NSA Primer, posted to the agency’s Post-Quantum Cryptography Resource Hub, describes post-quantum cryptography, or PQC, as a safeguard against attacks from both conventional and quantum computers. The NSA says that while traditional encryption still protects networks from current adversaries, a powerful quantum computer could break those defenses exponentially faster, making the move to PQC critical for public key infrastructure, the system of keys and digital certificates that verifies identities and secures connections online.
Despite its name, post-quantum cryptography does not require quantum hardware. The algorithms run on ordinary computers and servers. What changes is the underlying math, which is chosen because no known quantum algorithm can solve it efficiently.
Why Quantum Computers Threaten Today’s Encryption
According to the NSA, quantum computers will operate at the atomic scale, which makes them delicate and difficult to build. That same property is what gives them their power. A stable quantum computer could apply the rules of quantum mechanics to perform calculations beyond the reach of classical machines, including breaking cryptographic systems that depend on factoring very large numbers into their prime components, the basis of RSA, or on solving discrete logarithm problems, the basis of elliptic curve cryptography, or ECC.
The method for doing so has been known since 1994, when mathematician Peter Shor published an algorithm that solves both problems dramatically faster than any classical technique. RSA and ECC underpin HTTPS web connections, VPNs, secure email and the digital signatures that confirm a software update is genuine. Symmetric encryption, such as the AES standard used to protect stored data, is less exposed and can generally be hardened by using longer keys, such as AES-256. Public-key systems have no comparable fix and must be replaced.
That replacement is what the NSA primer addresses. The agency notes that PQC algorithms rest on more intricate math problems than their classical counterparts, and that the National Institute of Standards and Technology finalized the first official PQC standards in 2024.
Lattice-Based Cryptography
The largest family of post-quantum algorithms is lattice-based cryptography. The NSA asks readers to picture an endless grid of dots stretching across many dimensions. Security comes from geometric problems in that high-dimensional space, such as finding the point in the grid closest to a given location. In two or three dimensions the task is simple. Across hundreds of dimensions, the NSA says, it becomes extraordinarily difficult, even for a quantum computer.
Lattice math is the foundation of NIST’s two primary PQC standards. ML-KEM, published as FIPS 203, is a key-encapsulation mechanism, a method for two parties to securely agree on a shared secret key over an untrusted network. It is designed to replace RSA and Diffie-Hellman key exchange in protocols such as TLS, which secures web traffic. ML-DSA, published as FIPS 204, provides digital signatures, the cryptographic stamps that prove a message, document or piece of software came from its claimed source and was not altered.
The trade-off is size, according to the NSA Primer. Lattice-based keys and signatures are substantially larger than the RSA and ECC values they replace. An ML-KEM public key at the commonly deployed security level runs about 1,184 bytes, compared with 32 bytes for a widely used elliptic curve key. Performance on modern hardware is generally competitive, but the added bulk matters for bandwidth-limited networks and small embedded devices.
Hash-Based Signatures
The second family the NSA highlights relies on cryptographic hash functions, the same mathematical tools that underpin the integrity of blockchains. A hash function converts any input into a fixed-length output, or digest, and works as a one-way street: easy to compute in one direction and practically impossible to reverse. Because the security of hash-based signatures depends only on the strength of the hash function, cryptographers consider them among the most conservative quantum-resistant options available.
The primer singles out two schemes, both specified in NIST Special Publication 800-208:
Leighton-Micali Signature (LMS) generates a sequence of unique one-time signatures from a single key. The NSA says LMS is best suited to environments where state management is feasible, making it a strong option for long-term hardware root of trust, the immutable, built-in credential a device uses to verify that its firmware and boot software are authentic.
eXtended Merkle Signature Scheme (XMSS) extends the older Merkle Signature Scheme to support many signatures from one key. The NSA describes it as a flexible, scalable approach to securing digital communications.
Both are “stateful” schemes. Each one-time signing key may be used only once, so the signer must reliably track which keys have been consumed. Reusing one can allow an attacker to forge signatures. That requirement makes LMS and XMSS a poor fit for general-purpose use, such as signing web traffic across many servers, but a good fit for tightly controlled tasks like signing firmware in a secure facility. For situations where tracking state is impractical, NIST standardized a stateless hash-based alternative, SLH-DSA, as FIPS 205, which trades larger signatures for simpler key handling.
NSA Primer Advises What Organizations Should Do Now
The NSA primer is explanatory rather than prescriptive, but it sits alongside binding guidance for government systems. The agency’s Commercial National Security Algorithm Suite 2.0, or CNSA 2.0, requires national security systems to adopt quantum-resistant algorithms, including ML-KEM, ML-DSA, LMS and XMSS, with deadlines that vary by system type and full transition targeted for 2035. Software and firmware signing, the use case where LMS and XMSS fit best, is among the earliest categories scheduled to move.
For businesses outside the national security community, the practical steps are well established. The first is a cryptographic inventory that records where RSA, ECC and other public-key algorithms are used across websites, VPNs, authentication systems, code-signing pipelines and connected devices, along with how long the protected data must remain confidential. That timeline matters because adversaries can record encrypted traffic today and store it until a quantum computer can decrypt it, a strategy known as “harvest now, decrypt later.”
From there, organizations can prioritize systems that protect long-lived sensitive data, ask vendors for specific PQC road maps tied to the NIST standards, and require cryptographic agility, the ability to swap algorithms without rebuilding entire systems, in new purchases. Many early deployments use hybrid approaches that combine a classical algorithm with a post-quantum one, so an attacker would have to break both.
The NSA directs organizations ready to begin to its PQC Resource Hub for further guidance. The underlying message of the primer is that the replacement math already exists and has been standardized. The remaining challenge is the time required to put it in place.
