Report on Post-Quantum Cryptography
Open accessAbstract
Reports on Computer Systems TechnologyThe Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure.ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology.ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
NSA, NIST, and ETSI have declared that quantum cryptography such as QKD would be the only alternative for long-term secure encryption.
“However, this may change in the future as NSA, NIST, and ETSI, among others, have declared that quantum cryptography (such as QKD) would be the only alternative for long term secure encryption25–27.”
From Quantum-resistance in blockchain networks (2023) · cites this paper as [25]
The Introduction explicitly distinguishes post-quantum cryptography from quantum cryptography, including QKD. Section 4 instead describes NIST's plan to standardize quantum-resistant public-key encryption and other algorithms, contrary to the claim that it declared QKD the only long-term alternative. The report does not establish what NSA or ETSI declared. (LLM, conf=0.90)
Checked by a reasoning model — may be wrong.
Experimental — accuracy not yet measuredQuantum computing threatens blockchain protocols and networks because they utilize non-quantum resistant cryptographic algorithms.
“The advent of quantum computing threatens blockchain protocols and networks because they utilize non-quantum resistant cryptographic algorithms.”
From Quantum-resistance in blockchain networks (2023) · cites this paper as [25]
The Introduction (Table 1) says a large-scale quantum computer would make RSA and ECDSA insecure, supporting the general threat to existing cryptography. The paper does not identify blockchain protocols or networks or establish which algorithms they use, so the blockchain-specific claim goes beyond this source. (LLM, conf=0.86)
Experimental — accuracy not yet measuredNIST recommends that ECDSA and RSA signature schemes be replaced due to the impact of Shor's algorithm.
“NIST recommends that ECDSA and RSA signature schemes be replaced due to the impact of Shor’s algorithm on these schemes70.”
From Quantum-resistance in blockchain networks (2023) · cites this paper as [70]
The Introduction (Table 1; page unavailable) says RSA and ECDSA signatures would no longer be secure against a large-scale quantum computer, consistent with the report’s discussion of Shor’s algorithm. But §4, “The Path Forward” (page unavailable), recommends preparing for a future transition, not replacing those schemes immediately: it says agencies should continue using currently recommended algorithms until quantum-resistant standards are available. (LLM, conf=0.88)
Experimental — accuracy not yet measuredThe quantum threat to current cryptography has been widely acknowledged since NIST and NSA 2016 reports.
“The quantum threat to current cryptography has been widely acknowledged since NIST25 and NSA26 2016 reports.”
From Quantum-resistance in blockchain networks (2023) · cites this paper as [25]
Shor's algorithm renders the discrete-logarithm and integer-factorization problems on which RSA, Diffie-Hellman, and elliptic-curve cryptography depend tractable in polynomial time on a sufficiently large fault-tolerant quantum computer.
“Shor's algorithm renders the discrete-logarithm and integer-factorization problems on which RSA, Diffie-Hellman, and ellipticcurve cryptography depend tractable in polynomial time on a sufficiently large fault-tolerant quantum computer [45].”
Classic encryption based on RSA algorithms is being challenged by increasingly powerful computers.
“To protect data security, the classic encryption based on RSA algorithms is being challenged by increasingly powerful computers [57].”
From What should 6G be? (2020) · cites this paper as [57]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer
Shor, P. W. (1997) · SIAM Journal on Computing · doi:10.1137/s0097539795293172 · Cited by 8,472 · see citing works
Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer
Shor, P. W. (1999) · SIAM Review · doi:10.1137/s0036144598347011 · Cited by 3,904 · see citing works
Superconducting quantum circuits at the surface code threshold for fault tolerance
Barends, R., Kelly, J., Megrant, A., Veitia, A., Sank, D., Jeffrey, E., White, T. C., Mutus, J., Fowler, A. G., Campbell, B., et al. (2014) · Nature · doi:10.1038/nature13171 · Cited by 1,733 · see citing works
Strengths and Weaknesses of Quantum Computing
Bennett, C. H., Bernstein, E., Brassard, G., & Vazirani, U. (1997) · SIAM Journal on Computing · doi:10.1137/s0097539796300933 · Cited by 1,470 · see citing works
Preskill, J. (1998) · Proceedings of the Royal Society of London. Series A: Mathematical, Physical and Engineering Sciences · doi:10.1098/rspa.1998.0167 · Cited by 994 · see citing works
Ryan-Anderson, C. (2013) · Cambridge University Press eBooks · doi:10.1017/cbo9781139034807 · Cited by 656 · see citing works
High-Fidelity Preparation, Gates, Memory, and Readout of a Trapped-Ion Quantum Bit
Harty, T. P., Allcock, D. T. C., Ballance, C. J., Guidoni, L., Janacek, H. A., Linke, N. M., Stacey, D. N., & Lucas, D. M. (2014) · Physical Review Letters · doi:10.1103/physrevlett.113.220501 · Cited by 632 · see citing works
Cybersecurity in an Era with Quantum Computers: Will We Be Ready?
Mosca, M. (2018) · IEEE Security & Privacy · doi:10.1109/msp.2018.3761723 · Cited by 581 · see citing works
Recommendation for Key Management Part 1: General
Barker, E. B. (2016) · doi:10.6028/nist.sp.800-57pt1r4 · Cited by 396 · see citing works
Adrian, D., Bhargavan, K., Durumeric, Z., Gaudry, P., Green, M., Halderman, J. A., Heninger, N., Springall, D., Thomé, E., Valenta, L., et al. (2015) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2810103.2813707 · Cited by 350 · see citing works
Brun, T. A. (2020) · doi:10.1093/acrefore/9780190871994.013.35 · Cited by 246 · see citing works
Digital signature standard (DSS)
National Institute of Standards and Technology (US) (2013) · doi:10.6028/nist.fips.186-4 · Cited by 246 · see citing works
Quantum distinguisher between the 3-round Feistel cipher and the random permutation
Kuwakado, H., & Morii, M. (2010) · IEEE International Symposium on Information Theory (ISIT) · doi:10.1109/isit.2010.5513654 · Cited by 221 · see citing works
Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths
Barker, E. B., & Roginsky, A. L. (2015) · doi:10.6028/nist.sp.800-131ar1 · Cited by 191 · see citing works
Practical Cryptanalysis of SFLASH
Dubois, V., Fouque, P.-A., Adi Shamir, Z., & Stern, J. (2007) · Springer eBooks · doi:10.1007/978-3-540-74143-5_1 · Cited by 179 · see citing works
Quantum resistant public key cryptography: a survey
Perlner, R. A., & Cooper, D. A. (2009) · Proceedings of the 8th Symposium on Identity and Trust on the Internet · doi:10.1145/1527017.1527028 · Cited by 137 · see citing works
Self-citationQuantum differential and linear cryptanalysis
Leurent, G., Kaplan, M. A., Leverrier, A., & Naya‐Plasencia, M. (2017) · HAL · Cited by 133 · see citing works
On the security of 1024-bit RSA and 160-bit elliptic curve cryptography
Bos, J. W., Kaihara, M. E., Kleinjung, T., et al. (2009) · Infoscience (Ecole Polytechnique Fédérale de Lausanne) · Cited by 69 · see citing works
Freestart Collision for Full SHA-1
Stevens, M., Karpman, P., & Peyrin, T. (2016) · Lecture notes in computer science · doi:10.1007/978-3-662-49890-3_18 · Cited by 62 · see citing works
Factoring Estimates for a 1024-Bit RSA Modulus
Lenstra, A. K., Tromer, E., Adi Shamir, Z., Kortsmit, W., Dodson, B., Hughes, J., & Leyland, P. C. (2003) · Lecture notes in computer science · doi:10.1007/978-3-540-40061-5_4 · Cited by 48 · see citing works
Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography
Barker, E. B., Chen, L., Roginsky, A. L., & Smid, M. E. (2013) · doi:10.6028/nist.sp.800-56ar2 · Cited by 44 · see citing works
Self-citationRecommendation for Pair-Wise Key-Establishment Schemes Using Integer Factorization Cryptography
Barker, E. B., Chen, L., & Moody, D. (2014) · doi:10.6028/nist.sp.800-56br1 · Cited by 26 · see citing works
Self-citationFreestart collision for full SHA-1
Stevens, M., Karpman, P., & Peyrin, T. (2015) · Centrum Wiskunde & Informatica (CWI), the national research institute for mathematics and computer science in the Netherlands · Cited by 6 · see citing works
Flagged first, then by citations
Research works printed but not linked: 1
- P. Campbell, M. Groves, D. Shepherd, Soliloquy: A Cautionary Tale, ETSI Workshop on Quantum-Safe Cryptography, 2014. https://docbox.etsi.org/workshop/2014/201410_CRYPTO/S07_Systems_and _Attacks/S07_Groves_Annex.pdf.
Cited by
Sorted by citations
Dang, S., Amin, O., Shihada, B., & Alouini, M.-S. (2020) · Nature Electronics · doi:10.1038/s41928-019-0355-6 · Cited by 1,790 · see citing works
CRYSTALS - Kyber: A CCA-Secure Module-Lattice-Based KEM
Bos, J., Ducas, L., Kiltz, E., Lepoint, T., Lyubashevsky, V., Schanck, J. M., Schwabe, P., Seiler, G., & Stehle, D. (2018) · 2018 IEEE European Symposium on Security and Privacy (EuroS&P) · doi:10.1109/eurosp.2018.00032 · Cited by 1,192 · see citing works
Status report on the first round of the NIST post-quantum cryptography standardization process
Alagic, G., Alperin-Sheriff, J., Apon, D., Cooper, D., Dang, Q., Liu, Y.-K., Miller, C., Moody, D., Peralta, R., Perlner, R., et al. (2019) · doi:10.6028/nist.ir.8240 · Cited by 364 · see citing works
Self-citationSurvey on Multi-Access Edge Computing Security and Privacy
Ranaweera, P., Jurcut, A. D., & Liyanage, M. (2021) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2021.3062546 · Cited by 356 · see citing works
Status report on the second round of the NIST post-quantum cryptography standardization process
Moody, D., Alagic, G., Apon, D. C., Cooper, D. A., Dang, Q. H., Kelsey, J. M., Liu, Y.-K., Miller, C. A., Peralta, R. C., Perlner, R. A., et al. (2020) · doi:10.6028/nist.ir.8309 · Cited by 296 · see citing works
Self-citationStatus report on the third round of the NIST Post-Quantum Cryptography Standardization process
Alagic, G., Apon, D., Cooper, D., Dang, Q., Dang, T., Kelsey, J., Lichtinger, J., Liu, Y.-K., Miller, C., Moody, D., et al. (2022) · doi:10.6028/nist.ir.8413-upd1 · Cited by 301 · see citing works
Self-citationStatus report on the fourth round of the NIST post-quantum cryptography standardization process
Alagic, G., Bros, M., Ciadoux, P., Cooper, D., Dang, Q., Dang, T., Kelsey, J., Lichtinger, J., Liu, Y.-K., Miller, C., et al. (2025) · doi:10.6028/nist.ir.8545 · Cited by 128 · see citing works
Self-citationQuantum-resistance in blockchain networks
Allende, M., León, D. L., Cerón, S., Pareja, A., Pacheco, E., Leal, A., Da Silva, M., Pardo, A., Jones, D., Worrall, D. J., et al. (2023) · Scientific Reports · doi:10.1038/s41598-023-32701-6 · Cited by 109 · see citing works
“in conjunction with expected near-to-mid future scalability and robust developments have attracted the attention of international standards agencies in cyber security and cryptography, including NIST [22], NSA [23], and ETSI [24]. They have made critical warnings that running some quantum algorithms on full-scale quan…”
BackgroundPost Quantum Cryptography: A Review of Techniques, Challenges and Standardizations
Bavdekar, R., Jayant Chopde, E., Agrawal, A., Bhatia, A., & Tiwari, K. (2023) · 2023 International Conference on Information Networking (ICOIN) · doi:10.1109/icoin56518.2023.10048976 · Cited by 108 · see citing works
Szymanski, T. H. (2022) · IEEE Access · doi:10.1109/access.2022.3169137 · Cited by 59 · see citing works
Keyed Hash Function Using Hyper Chaotic System with Time-Varying Parameters Perturbation
Liu, H., Kadir, A., & Liu, J. (2019) · IEEE Access · doi:10.1109/access.2019.2896661 · Cited by 47 · see citing works
FIDO2, CTAP 2.1, and WebAuthn 2: Provable Security and Post-Quantum Instantiation
Bindel, N., Cremers, C., & Zhao, M. (2023) · 2023 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp46215.2023.10179454 · Cited by 30 · see citing works
Barker, W., Polk, W., & Souppaya, M. (2021) · doi:10.6028/nist.cswp.15 · Cited by 24 · see citing works
Qadri, S. M. (2026) · Frontiers in Computer Science and Artificial Intelligence · doi:10.32996/fcsai.2026.5.9.2
“Joseph et al. [43] in Nature (2022) address PQC transition at the organizational level, and the broader transition literature includes Mosca's framing of the harvest-now-decrypt-later adversary [44] and the foundational NIST report on post-quantum cryptography [45].”
- Authors
- Chen, L., Jordan, S., Liu, Y.-K., Moody, D., Peralta, R., Perlner, R., & Smith-Tone, D.
- Published
- 2016-04
- OpenAlex
- W2895182117
- Cited by
- 1,034
- References
- 23
- Citations by year
- 2026: 156 · 2025: 170 · 2024: 105 · 2023: 94 · 2022: 101 · 2021: 107 · 2020: 110 · 2019: 81 · 2018: 52 · 2017: 37 · 2016: 21
- Type
- report
- Language
- en
- Open access
- gold
- doi.org
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptography and Data Security
- Physical Sciences › Computer Science › Information Systems › Cryptography and Residue Arithmetic
- Physical Sciences › Computer Science › Artificial Intelligence › Quantum Information and Cryptography
- Keywords
- post-quantum cryptography, quantum computing threats, cryptographic standards, public-key cryptography, NIST standardization
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
