Glossary

Forward secrecy

A property of a protocol, not of an algorithm. Each session is keyed by ephemeral material that is discarded afterwards, so compromising the long-term identity key tomorrow does not retroactively open yesterday's traffic. It is what limits the blast radius of a key compromise — and what makes the harvest-now-decrypt-later threat about the exchange itself rather than about stolen certificates.

See alsoHarvest now, decrypt laterHybrid key exchange

Harvest now, decrypt later

An attack that costs nothing but storage. Traffic captured today cannot be read today, but it can be kept until a machine capable of running Shor's algorithm at scale exists, and read then. It is the reason post-quantum migration is urgent well before any such machine is built: the clock that matters is not when the hardware arrives, it is how long the data needs to stay secret. Anything with a secrecy lifetime longer than the gap is already exposed.

See alsoShor's algorithmForward secrecy

Hybrid key exchange

Both exchanges run, and the shared secret is derived from both outputs, so the session is secure if either one holds. This is how post-quantum cryptography is actually being deployed: the post-quantum schemes are young, and a hybrid removes the risk of betting a decade of traffic on a construction that turns out to have a classical weakness. The cost is that you pay for both handshakes.

See alsoKey encapsulation mechanismForward secrecy

Key encapsulation mechanism

A KEM is the modern shape of key agreement. Rather than two parties each contributing to a shared value, one side publishes an encapsulation key, the other generates a random secret, wraps it against that key, and sends back a ciphertext. Only the holder of the matching decapsulation key can unwrap it. The shape matters here because it is what lattice problems can be built into cleanly, and what Diffie–Hellman — the thing quantum computers break — is not.

See alsoLattice-based cryptographyHybrid key exchange

Lattice-based cryptography

A lattice is a regular grid of points stretching out in many dimensions. Some questions about such grids — find the point nearest this one, find the shortest non-zero vector — are easy to state and, in high dimensions, brutally hard to answer, with no known quantum shortcut. ML-KEM and ML-DSA both build on a structured variant called Module Learning With Errors. The sizes in this piece are the direct cost of that structure: security comes from many coordinates, and coordinates are bytes.

See alsoKey encapsulation mechanismML-KEM

ML-KEM

Module-Lattice-Based Key-Encapsulation Mechanism, standardised as FIPS 203 in August 2024. It comes in three parameter sets — ML-KEM-512, -768 and -1024 — trading size against security margin. ML-KEM-768 is the common choice for general traffic. It began life as CRYSTALS-Kyber and is still often called Kyber in code and papers written before the standard landed.

See alsoLattice-based cryptographyKey encapsulation mechanism

Shor's algorithm

Published by Peter Shor in 1994, it finds the period of a function using a quantum Fourier transform and, from that period, the factors of a large integer — or a discrete logarithm. That is the exact hard problem RSA, Diffie–Hellman and elliptic-curve cryptography rest on. It needs a large, error-corrected quantum computer, which does not exist yet; the algorithm is why the deadline is real regardless.

See alsoHarvest now, decrypt later

Terms are added as the writing needs them, not in advance. Browse the articles to see them in use.