up:: For Press
A glossary of the terms you will meet
Each term carries 2 things: a definition, and a first-mention form you can paste into a paragraph without stopping the sentence to explain it.
The pairs that get confused with each other are flagged separately, because mixing them up produces most of the errors in coverage of this subject.
The short version:
- Post-quantum cryptography and quantum cryptography are unrelated technologies, and confusing them is the most frequent error.
- Shor’s algorithm breaks encryption. Grover’s algorithm only dents it.
- A qubit count says almost nothing without the error rate and whether the qubits are logical or physical.
- Key exchange and digital signatures are the 2 things that break, and they fail in opposite directions in time.
- Deprecated and disallowed are different regulatory states with different dates, and only 1 of them gets reported.
- The algorithms were renamed when they were standardized, so the old names date a piece.
What are the core terms?
The mechanism
| Term | Definition | First-mention form you can paste |
|---|---|---|
| Encryption | Scrambling information so only someone holding the right key can read it | ”encryption, the scrambling that makes data unreadable without the right key” |
| Symmetric encryption | One shared secret does both the scrambling and the unscrambling. Survives quantum computers. | ”symmetric encryption, where both sides hold the same secret key” |
| Public-key cryptography | Mathematics letting 2 strangers agree on a secret in the open and prove who sent a message. The half that breaks. | ”public-key cryptography, the mathematics that lets strangers establish a secret over an open connection” |
| Key pair | A matched public key, published to everyone, and a private key, kept secret | ”a key pair, one half published and one half kept secret” |
| Key exchange | Two sides agreeing on a shared secret over a connection anyone can watch | ”key exchange, the opening negotiation where 2 systems agree on a secret” |
| Session key | The short-lived key that actually encrypts one conversation | ”a session key, used for a single connection and then discarded” |
| Digital signature | Proof a message, certificate, or software update came from who it claims | ”a digital signature, the cryptographic proof of who sent something” |
| Hash | A one-way fingerprint of data. Survives quantum computers. | ”a hash, a one-way fingerprint that can verify data without revealing it” |
| Certificate | The file proving a website belongs to the organization it claims | ”a digital certificate, the credential proving a site is what it says” |
| Certificate authority (CA) | The organization that signs certificates and that browsers are configured to trust | ”a certificate authority, one of the organizations browsers trust to vouch for websites” |
| Public key infrastructure (PKI) | The whole system of certificates, authorities, and trust that makes online identity work | ”public key infrastructure, the trust system behind every padlock icon” |
| TLS | The protocol behind the padlock, protecting web traffic in transit | ”TLS, the protocol that encrypts web traffic” |
| Forward secrecy | Each connection uses a fresh temporary key, so stealing a long-term key later reveals nothing about past conversations. Doesn’t protect against this threat. | ”forward secrecy, which uses a fresh key for each session” |
The quantum side
| Term | Definition | First-mention form you can paste |
|---|---|---|
| Qubit | The basic unit of a quantum computer | ”a qubit, the quantum equivalent of a bit” |
| Physical qubit | An actual error-prone component in a machine. What announcements count. | ”physical qubits, the error-prone components a machine actually has” |
| Logical qubit | A stable unit built from many physical qubits correcting each other. What breaking encryption requires. | ”logical qubits, stable units assembled from many physical ones” |
| Superposition | A qubit holding a combination of states rather than a single value | ”superposition, where a qubit holds a combination of states” |
| Entanglement | Qubits whose states are linked, so measuring one constrains the other | ”entanglement, where qubits become linked” |
| Decoherence | A qubit losing its quantum state through contact with its environment. The core engineering problem. | ”decoherence, the tendency of qubits to lose their state” |
| Quantum error correction | Using many physical qubits to build a stable logical one | ”quantum error correction, which spends many physical qubits to build a reliable one” |
| NISQ | Today’s era of noisy machines too small for error correction | ”the current generation of noisy, intermediate-scale machines” |
| Quantum annealing | A different kind of quantum machine for optimization. Can’t run Shor’s algorithm. | ”quantum annealing, a different technology aimed at optimization problems” |
| Quantum advantage | A quantum computer outperforming any classical one on some task, usually a contrived one | ”quantum advantage, where a quantum machine beats classical computers at a specific task” |
| CRQC | The technical term for a machine big enough to break real encryption | ”a cryptographically relevant quantum computer, meaning one large enough to break today’s encryption” |
| Shor’s algorithm | The 1994 method that breaks public-key cryptography | ”Shor’s algorithm, the 1994 method that breaks today’s public-key encryption” |
| Grover’s algorithm | A general search speedup that roughly halves symmetric key strength | ”Grover’s algorithm, which weakens but doesn’t break symmetric encryption” |
Source: Peter W. Shor, SIAM J. Computing 26(5), 1997, arxiv.org; NIST, “Report on Post-Quantum Cryptography,” NISTIR 8105, csrc.nist.gov.
The threat
| Term | Definition | First-mention form you can paste |
|---|---|---|
| Harvest now, decrypt later (HNDL) | Recording encrypted data today to read once a quantum computer exists | ”harvest now, decrypt later, where encrypted data is collected today and stored until it can be read” |
| Forge-later | Recovering a signing key once a machine exists, then forging credentials that verify as genuine | ”forgery of digital credentials, which becomes possible the day a capable machine exists” |
| Q-Day | Informal name for the day a quantum computer can break deployed encryption. A capability threshold rather than a date. | ”Q-Day, the informal name for whenever a quantum computer can break today’s encryption” |
| Secrecy lifetime | How long information stays sensitive. The variable that decides urgency. | ”secrecy lifetime, meaning how many years the information has to stay private” |
| Mosca’s theorem | The timing rule: if secrecy lifetime plus migration time exceeds time until the machine, you’re already late | ”the standard timing rule in the field, which compares how long data must stay secret plus how long migration takes against how long until the machine arrives” |
| Blast radius | How far a failure spreads from one compromised key | ”blast radius, meaning how many systems a single compromised key would affect” |
The replacement
| Term | Definition | First-mention form you can paste |
|---|---|---|
| Post-quantum cryptography (PQC) | The replacement encryption. Runs on ordinary computers. | ”post-quantum cryptography, new encryption designed to resist quantum computers and running on ordinary hardware” |
| Lattice-based cryptography | The mathematics behind the main replacement algorithms | ”lattice-based cryptography, the mathematics underneath the main replacements” |
| KEM | Key encapsulation mechanism, the modern form of key exchange | ”a key encapsulation mechanism, the modern form of key exchange” |
| Hybrid | Running an old and a new algorithm together so the connection holds if either survives | ”a hybrid approach, running the old and new encryption together” |
| Crypto-agility | Being able to swap algorithms without rebuilding the system | ”crypto-agility, the ability to change algorithms without re-engineering” |
The program and the policy
| Term | Definition | First-mention form you can paste |
|---|---|---|
| Cryptographic inventory | A list of everywhere an organization’s cryptography actually lives, at the algorithm level | ”a cryptographic inventory, a list of every place encryption is used across an organization” |
| CBOM | Cryptographic bill of materials, the machine-readable form of that inventory | ”a cryptographic bill of materials, a structured list of the encryption inside a system” |
| SBOM | Software bill of materials, the list of components inside a product | ”a software bill of materials, an ingredients list for software” |
| Migration | Replacing the encryption. Sounds like moving data, means changing the mathematics underneath. | ”migration, meaning replacing the underlying encryption” |
| FIPS | The U.S. federal standards series. FIPS 203, 204, and 205 are the post-quantum standards. | ”FIPS 203, the U.S. federal standard for the main replacement algorithm” |
| CNSA 2.0 | The NSA’s algorithm suite for national security systems, with its own deadlines | ”the NSA’s algorithm requirements for national security systems” |
| Deprecated | Still permitted, with the risk formally accepted. Applies after 2030 on the U.S. draft schedule. | ”deprecated, meaning still allowed but with the risk formally accepted” |
| Disallowed | Prohibited for the stated purpose. Applies after 2035 on the same draft schedule. | ”disallowed, meaning prohibited outright” |
| Air gap | A claim that a system isn’t connected to any network. Frequently asserted, rarely verified. | ”an air gap, meaning the system is claimed to have no network connection” |
Source: NIST IR 8547, initial public draft, csrc.nist.gov, for the deprecated and disallowed definitions and dates.
Which pairs get mixed up?
Eight, and the first is responsible for more errors than the rest combined.
- Post-quantum cryptography vs quantum cryptography. Post-quantum cryptography is new mathematics running on ordinary computers, and it’s what’s being deployed everywhere right now. Quantum cryptography, usually meaning quantum key distribution, uses physics and special hardware, exists in a handful of specialized deployments, and is rarely what a story is about. A sentence saying quantum cryptography will protect us from quantum computers has made this mistake.
- Shor’s vs Grover’s. Shor’s recovers a private key from a public one, which breaks public-key cryptography outright. Grover’s speeds up brute-force search, halving symmetric key strength, which larger keys absorb. Shor’s is the emergency and Grover’s is an adjustment.
- Symmetric vs public-key. Symmetric uses 1 shared secret and does the bulk scrambling, and it survives. Public-key solves the harder problem of strangers agreeing on a secret and proving identity, and it breaks. Nearly every accuracy error traces to blurring these.
- Physical vs logical qubits. Announcements quote physical. Breaking encryption needs logical. Each logical qubit takes many physical ones, so the gap between the 2 numbers is enormous.
- Deprecated vs disallowed. Deprecated after 2030 means permitted with accepted risk. Disallowed after 2035 means prohibited. Coverage usually reports only 2035, and 2030 is the date that starts changing procurement.
- Confidentiality vs trust. Confidentiality fails backward, since recorded data becomes readable. Trust fails forward, since signatures become forgeable from the day a machine exists. They need different priorities and different fixes.
- A quantum computer vs a quantum annealer. Annealers target optimization and can’t run Shor’s algorithm. A record announced for an annealer says nothing about encryption.
- The standards deadline vs Q-Day. 2030 and 2035 are retirement schedules for old algorithms. Neither is a prediction about when a machine arrives.
What do the algorithm names mean, and what were they called before?
| Standard name | What it does | Competition name | Status |
|---|---|---|---|
| ML-KEM (FIPS 203) | The main replacement for key exchange | CRYSTALS-Kyber | Finalized August 13, 2024 |
| ML-DSA (FIPS 204) | The main replacement for digital signatures | CRYSTALS-Dilithium | Finalized August 13, 2024 |
| SLH-DSA (FIPS 205) | A backup signature scheme built on hashing rather than lattices | SPHINCS+ | Finalized August 13, 2024 |
| FN-DSA (FIPS 206) | A compact signature scheme for where size is the binding constraint | FALCON | Selected and in development, not yet published |
| HQC | A backup key-establishment algorithm on different mathematics, as insurance | HQC | Selected March 2025 |
| RSA | One of the 2 systems being replaced | Named for its inventors | Being retired |
| ECC, ECDH, ECDSA | Elliptic-curve cryptography and its key-exchange and signature forms | The other system being replaced | Being retired |
| AES | The bulk encryption that survives, usually AES-128 or AES-256 | Rijndael | Retained, and required by CNSA 2.0 |
| X25519MLKEM768 | The hybrid combination browsers actually deploy, pairing an old and a new method | Deployed hybrid | Live in browsers |
Source: NIST, “NIST Releases First 3 Finalized Post-Quantum Encryption Standards,” August 13, 2024, nist.gov; NIST, HQC selection, March 2025, nist.gov.
On the renaming: the competition names were replaced by official standard names when NIST finalized them. Older articles and some vendor material still use Kyber, Dilithium, and FALCON, which usefully dates when something was written.
Which terms are synonyms, and which only look like it?
Effectively interchangeable: post-quantum cryptography, quantum-resistant cryptography, and quantum-safe cryptography all describe the same thing. “Post-quantum” is the term used in the standards and the official documents, so it’s the safest choice in a piece. “Quantum-safe” is more common in vendor material.
Not interchangeable, despite appearances:
- Quantum cryptography is a different technology, covered above.
- Quantum computing is the field. Quantum cryptanalysis is the specific application to breaking codes.
- Encryption and cryptography overlap, and cryptography is broader, including signatures and hashing that encrypt nothing.
- Key and password are different. Keys are generated and are typically far longer, and passwords are chosen by people.
- Breaking encryption covers 3 distinct events: recovering a key, forging a signature, and decrypting stored traffic. Worth naming which one is meant.
Which words are marketing rather than technical?
| The phrase | What’s going on |
|---|---|
| ”Military-grade encryption” | Not a technical term. Usually means AES, which is the surviving half anyway. Quote it, rather than repeating it as fact. |
| ”Unbreakable” or “unhackable” | Nobody serious uses either. Cryptography rests on problems believed too expensive to solve rather than proven impossible. |
| ”Quantum-safe” on a consumer product | No consumer product addresses this. Treat it as a claim. |
| ”256-bit encryption” | True and usually irrelevant, since it describes the half that survives. |
| ”Quantum-powered” security | Almost always marketing. Ask which specific algorithm and which published standard. |
| A countdown clock to Q-Day | Nobody can date it. A specific countdown is a sales device. |
Questions people ask
What’s the single most important distinction? Public-key cryptography breaks and symmetric encryption survives. Almost every error in coverage traces back to blurring those.
Should I write “post-quantum” or “quantum-safe”? Post-quantum, since it’s the term used in the standards and official documents. Quantum-safe means the same thing and reads as vendor language.
Is it Q-Day or Q Day? Both appear. It’s informal either way, and it names a capability threshold rather than a dated event.
How do I introduce ML-KEM to a reader? As “ML-KEM, the main replacement algorithm for key exchange, published by NIST in August 2024.” The expansion of the acronym rarely helps a general reader.
Which terms should never appear unattributed? “Military-grade,” “unbreakable,” “quantum-safe” applied to a product, and any specific Q-Day date. Each is a claim rather than a fact.
Do I need to explain what a lattice is? Almost never. That the replacement rests on different mathematics with no known efficient quantum attack is enough for any general or business piece.
Where do the official definitions live? In the FIPS standards themselves and in NIST’s reports, all freely available and indexed at The primary documents behind every claim.
Where is each term explained in full?
- Encryption, key exchange, signatures, certificates → What is encryption and What is technically happening to your data
- Qubits, logical vs physical, what a quantum computer is → What is a quantum computer
- Shor’s, Grover’s, CRQC, the timeline → When is this going to happen
- Harvest now decrypt later, secrecy lifetime → Is someone stealing my data right now
- ML-KEM, ML-DSA, the standards → What is actually happening
- Hybrid, X25519MLKEM768, what shipped → Did my phone already fix this
- Inventory, CBOM, crypto-agility → What should my doctor and bank be doing
- The estate-level and national-level mechanics → What is technically happening to our systems and What is technically happening to national systems
The full technical definitions written for security professionals start at Foundations MOC, with the algorithms at The New Standards MOC.
Where to go next
- What gets reported wrong covers the errors these mixups produce.
- Every figure and where it comes from carries every number with accurate phrasing.
- The primary documents behind every claim is the annotated source index.
- For Press returns to the index.
Last verified 2026-07-30 · Maintained by Addie LaMarr, LaMarr Labs.