Is there readily available encryption algorithms for current computers, that is safe from quantum computers? I know a bunch of currently popular encryption algorithms that are safe from current computers, but significantly weaker against a quantum computer. For example, Shor's algorithm to break RSA.

What algorithms can I use on my computer/phone today if I want my data to be secure 50-100 years from now, when (hopefully) quantum computers are basically commodity hardware? Partially ignoring the fact that we might get a break-through in cracking these algorithms 20 years from now. I'm sure there's been quite a lot of research into encryption algorithms for quantum computers. Having to implement the algorithm myself is not that much of a problem, as long as it's feasible to use for file or disk encryption on current hardware.


I am aware of this question: What kinds of encryption are not breakable via Quantum Computers?, but since it's been two years since that question and answer, I'm wondering if there's anything new.


1 Answer 1


The answers to the linked question give a very good overview of why quantum computers break modern encryption schemes (RSA and Elliptic Curve Cryptography (ECC)), but not how to mitigate against it.

Summary: expect it to take until ~2020 to work the kinks out of post-quantum algorithms - Use AES-256 for now!

As mentioned in Thomas Pornin's answer to the linked question, AES-256 gets a gold star for being quantum resistant. So, for the time being the best thing you can do is to encrypt your data with AES-256 and be really really careful with the key (keep it on a separate drive from the data, stored in a separate location, etc).

My personal opinion is that there's going to be a bit of a gap between when people stop trusting RSA and ECC and start trusting post-quantum encryption for long-term data storage. During that gap I suspect we're going to go back to physically mailing AES keys in tamper-proof envelopes.

I attended the recent PQCrypto2016 conference in February 2016, during which it was clear that this work is still in its infancy with a lot of basic mathematical research still to be done on post-quantum encryption. Post-quantum signatures are much more mature, but since your question is about encryption, I'll stick to that. At the conference, professor Steven Galbraith said that virtually every week a new weakness is found in one of the leading schemes, and a new variant is proposed to address this. So we want to give the mathematicians a few more years before we write any software that we trust.

The holy grail is to find a quantum-resistant encryption scheme that is a drop-in replacement for RSA, ECC, and the Diffie-Hellman key exchange. The problem with the current slew of proposed algorithms is that they are either very slow or have very large keys, very large cipher texts, or all three! (By "very large keys" I mean 4 - 10 megabytes, compared to a 2048 or 3072 bit RSA key, or a 233 or 283 bit ECC key).

NIST Competition

At the conference, NIST announced a competition for post-quantum crypto algorithms that will lead to new standards. Submissions were accepted Jan-Nov 2017, resulting in 60-70 entries.

These submissions from NIST must be accompanied by sample code in C, and must waive any patent or usage rights, so I imagine some of the open-source crypto libraries will start incorporating them pretty quickly as "experimental". At that point you should be able to protect your data with a quantum-safe algorithm - and don't worry, quantum computers aren't nearly mature enough for the NSA to have one, so your RSA-protected data is just fine for the time being.

That said, this probably won't quite satisfy your

I want my data to be secure 50-100 years from now

since these algorithms will go through rapid evolution as new weaknesses are found, and optimizations are invented, so data you encrypt with an experimental algorithm in 2018 will probably not be decryptable by whatever variant we end up standardizing at the end of all this research.

OpenSSL and Bouncy Castle today

According to the cipher lists for OpenSSL and Bouncy Castle, neither of them currently support any quantum-resistant ciphers. Bouncy Castle tends to be pretty quick to implement new things, so we may see them try some of the experimental algorithms from the NIST competition within the next 12 months.

  • 1
    OpenSSL ciphers lists only the suites for SSL and TLS (latter by IETF) implemented in libssl; libcrypto includes some additional algorithms not used in SSL/TLS, currently IINM Blowfish CAST(5) RC5 ciphers and MD2 MD4 MDC2 RIPEMD(1) Whirlpool and (soon 1.1.0) Blake hashes -- but no PQC. Commented Apr 30, 2016 at 8:45
  • 2
    @FilipHaglund I just saw some new information from NIST about timelines of the post-quantum competition, answer updated. Commented May 2, 2016 at 15:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .