Every cryptographic key can in principle be recovered by an attacker with enough computing time. Key length sets how much time that is. For a well-designed algorithm, each extra bit of security doubles the work an attacker has to do, so the difference between 112-bit and 128-bit security is a factor of about 65,000 in attack cost.

The difficulty is that attack cost keeps falling. Computers get faster and cheaper, and researchers find better attacks on the underlying mathematics. A key that was comfortably out of reach when it was generated can drift within reach while the data it protects still matters. Choosing a key length is choosing how far ahead of that curve you want to stay.

Sources: NIST. See also: Key length.

It is a statement about probability under stated assumptions, not a guarantee. When an authority says a key size is acceptable through a given year, it means that under its current assumptions about attacker computing power, the growth of that power and progress in cryptanalysis, the expected cost of breaking the key stays above an acceptable threshold until then.

If the assumptions change, the date changes. That is why the figures are revised, why different authorities publish different numbers, and why this site records the edition and date of every figure it shows.

Sources: NIST, BSI.

A cryptoperiod is the span of time during which a specific key is authorized for use. NIST divides it into the originator-usage period, during which a key may be used to encrypt or sign, and the recipient-usage period, during which data protected with it may still be decrypted or verified. The second is usually longer, because data encrypted on the last day of use still has to be readable afterwards.

A cryptoperiod limits the damage if the assumptions behind a key turn out to be wrong. It caps how much data a single compromised key exposes, how long an attacker has to work on a key while it is still in use, and how long the key sits in systems and backups where it can leak for reasons that have nothing to do with mathematics.

The right cryptoperiod depends on the setting as much as the algorithm. Sensitive or high-volume data, keys held in software rather than hardware, and keys handled by many people or systems all argue for shorter periods. Shorter periods only help if the organization can actually rotate keys that often without outages, which is why automation matters.

Sources: NIST.

Enter the last year the data must stay secure, not the year the key stops being used. For confidentiality, that is the end of the recipient-usage period plus the time the data must remain secret. A key used for one year to encrypt records that must stay confidential for twenty years needs to be sized for twenty-one years.

For signatures, it is the last year anyone needs to rely on the signature being genuine. Signatures can often be renewed by re-signing or timestamping while the old algorithm is still trusted, so the horizon is usually shorter than for encryption.

See also: Key length.

They start from different assumptions and different missions. NIST sets minimums for US federal systems and moves in fixed steps of security strength. BSI and ANSSI build in more margin and set their own horizons. NSA's CNSA 2.0 protects national security systems and asks for the largest parameter sets.

None of them is wrong. The practical question is which of them applies to you, which is why the key length page puts your chosen rules first and shows the strictest figure among them.

Sources: NIST, BSI, ANSSI, NSA. See also: Key length.

Security strength is a way of comparing very different algorithms on one scale. An algorithm offers n bits of security when the best known attack takes about 2 to the power n operations, the same as trying every key of an ideal n-bit cipher.

This is why a 128-bit AES key, a 3072-bit RSA key and a 256-bit elliptic-curve key are treated as roughly equivalent. They have very different sizes, but NIST rates all three at about 128 bits of security because the best attacks against each take about the same effort.

Sources: NIST.

Symmetric cryptography, such as AES, uses the same secret key to encrypt and decrypt. It is fast and its key size maps directly onto its security, so a 128-bit key gives about 128 bits of security. The limitation is that both sides need the key before they can talk.

Public-key cryptography, such as RSA and elliptic curves, uses a key pair. The public half can be shared openly and the private half stays secret. It solves the problem of agreeing on keys with someone you have never met, and it makes digital signatures possible. Its keys are much larger for the same security because it rests on mathematical problems that have faster attacks than trying every key. Almost every secure connection uses public-key cryptography to agree on a symmetric key and then symmetric cryptography for the data itself.

RSA's security rests on factoring. The public key contains a large number, the modulus, made by multiplying two secret prime numbers together. Multiplying them is easy, but recovering the two primes from the product is extremely hard for large numbers, and anyone who can do it can derive the private key.

The modulus size, 2048 or 3072 bits, is what the key length tables mean by RSA key size. Factoring algorithms improve steadily, which is why RSA keys have to be much larger than symmetric keys for the same security. A 2048-bit modulus gives about 112 bits of security and a 3072-bit modulus about 128.

Sources: NIST. See also: Key length.

Classic Diffie-Hellman and DSA work in a group of numbers modulo a large prime, and their security rests on the discrete logarithm problem, which is recovering an exponent from the result of repeated multiplication. Two sizes matter. The first is the size of the prime that defines the group, written first in the tables. The second is the size of the subgroup the computations actually use.

Each size defends against a different kind of attack. The best attacks on the whole group scale like factoring, so the group prime needs to be about as large as an RSA modulus. Generic attacks on the subgroup take roughly the square root of its size, so the subgroup needs about twice as many bits as the security target. That is why the tables show pairs such as 3072 and 256.

Sources: NIST, ANSSI. See also: Key length.

Elliptic-curve cryptography uses the discrete logarithm problem on the points of a curve instead of on numbers modulo a prime. No attack is known that exploits the structure of well-chosen curves the way factoring algorithms exploit RSA, so the best classical attacks are generic and take about the square root of the group size.

That means a curve needs about twice as many bits as the security target, so a 256-bit curve gives about 128 bits of security, compared with 3072 bits for RSA. The smaller keys and signatures are why elliptic curves took over most of the web. They are just as vulnerable to a quantum computer as RSA, however, because Shor's algorithm solves the elliptic-curve discrete logarithm too.

Sources: NIST. See also: Key length.

A hash function turns any input into a fixed-size fingerprint. The most demanding property is collision resistance, meaning nobody can find two different inputs with the same fingerprint. Because of the birthday effect, finding some collision takes only about the square root of the number of possible outputs, so a 256-bit hash gives about 128 bits of collision resistance.

Finding an input that matches a particular given fingerprint is much harder and takes about the full output size. Signatures and certificates depend on collision resistance, which is why the tables pair a 256-bit hash with 128-bit security.

Sources: BSI. See also: Key length.

A key encapsulation mechanism, or KEM, is how the new post-quantum algorithms establish a shared secret. One side publishes a public key. The other side uses it to generate a random secret together with a ciphertext that only the holder of the private key can open, and sends the ciphertext back. Both sides end up with the same secret, which then keys the symmetric encryption.

Diffie-Hellman reaches the same result differently, with both sides contributing a public value and combining it with their own private value. Protocols such as TLS 1.3 can carry either, which is why ML-KEM could be added to TLS as a new key exchange option without redesigning the protocol.

Sources: NIST.

They are families of post-quantum algorithms named after the mathematical problem their security rests on. None of these problems has a known efficient quantum attack.

Lattice-based algorithms rest on problems about finding short vectors in high-dimensional grids. ML-KEM for key establishment and ML-DSA for signatures are both lattice-based, fast and compact, which is why they are the main standards. FrodoKEM uses a less structured lattice, which is slower and larger but considered more conservative, and BSI and ANSSI both recommend it.

Hash-based signatures, such as SLH-DSA, LMS and XMSS, rest only on the security of hash functions, which is very well understood. Their signatures are large, so they suit uses such as firmware signing where size matters less than confidence.

Code-based algorithms rest on the difficulty of decoding error-correcting codes. Classic McEliece has decades of analysis behind it but public keys of hundreds of kilobytes or more. HQC was selected by NIST in 2025 as a backup key establishment standard based on a different problem from ML-KEM.

Sources: BSI, ANSSI. See also: Algorithm sizes.

LMS and XMSS build a signature key out of a large number of one-time keys, and each one may only ever be used once. The signer has to keep track of which have been used, which is the state. If the state is lost or copied, for example by restoring a backup or cloning a virtual machine, a one-time key can be reused and security fails.

That makes them unsuitable for general use but a good fit for tightly controlled signing, such as software and firmware updates signed from a hardware module. CNSA 2.0 requires them for exactly that. SLH-DSA is the stateless alternative, at the cost of larger signatures.

Sources: NSA.

NIST rates post-quantum parameter sets against the effort to break AES or SHA of a given size, rather than in bits. Category 1 is at least as hard to break as finding an AES-128 key, category 3 matches AES-192 and category 5 matches AES-256. Categories 2 and 4 are defined by collision search on SHA-256 and SHA-384.

The number in a parameter set name usually indicates its category. ML-KEM-512, 768 and 1024 are categories 1, 3 and 5, and ML-DSA-44, 65 and 87 are categories 2, 3 and 5. Authorities that want more margin, such as CNSA 2.0, require the category 5 sets.

Sources: NSA, ANSSI.

They are the two quantum algorithms that matter for cryptography. Shor's algorithm solves factoring and discrete logarithms efficiently, which breaks RSA, Diffie-Hellman and elliptic curves completely rather than weakening them. No increase in key size fixes that, which is why those algorithms have to be replaced.

Grover's algorithm speeds up brute-force search, in theory halving the effective size of a symmetric key. In practice the attack has to run as one very long sequential computation and parallelises poorly, so the real reduction is much smaller. That is why symmetric keys and hash functions need little or no change.

See also: Quantum estimates.

Physical qubits are the actual hardware elements, and they make errors far too often to run a long computation directly. Error correction combines many physical qubits into one logical qubit that behaves reliably. The more physical qubits per logical qubit, measured by the code distance, the lower the error rate.

A cryptographically relevant attack needs on the order of a thousand or more logical qubits running reliably for hours or days. The estimates on this site count physical qubits, which is why they run from hundreds of thousands to millions, and why a device announced with a few dozen logical qubits at a small code distance is still a long way from that.

See also: Quantum estimates.

A cryptographically relevant quantum computer is one able to run Shor's algorithm at the scale needed to break keys in real use, such as RSA-2048 or a 256-bit elliptic curve. No such machine is known to exist.

Estimates of when one might exist vary widely, and for planning purposes the date matters less than two other numbers, which are how long your data must stay secret and how long your migration will take. If those two add up to more than the time until a CRQC exists, the data is at risk.

See also: Quantum estimates.

Because data can be recorded today and decrypted later. An attacker who captures encrypted traffic now and stores it only needs a capable quantum computer at some point before the data stops mattering. If records must stay confidential for ten years and a capable machine arrives in eight, they are already exposed, even though nothing can break them today.

Migration also takes years. Inventories, protocol changes, hardware refresh cycles and supplier updates mean that organizations starting when a machine is announced will be too late. The published estimates of what such a machine needs have fallen sharply, from about 20 million qubits in 2019 to under a million in 2025 on the same hardware assumptions, and further on other architectures.

Sources: Google Quantum AI, Gidney and Ekerå. See also: Quantum estimates.

Encrypted data can't be protected retroactively. If the key exchange behind a recorded session is broken later, the session is exposed, and nothing done afterwards changes that. A signature is different. It only needs to hold until it is replaced, and a forged signature is only useful while the old algorithm is still trusted.

That asymmetry is why US federal policy requires post-quantum key establishment for high value assets by the end of 2030 and signatures a year later, and why most national timelines follow the same order.

Sources: The White House. See also: Deadlines.

A hybrid scheme combines a classical algorithm such as ECDH with a post-quantum one such as ML-KEM, so that an attacker has to break both. The post-quantum algorithms are much newer and have had far less scrutiny. Hybrid protects against the possibility that one of them turns out to be weaker than expected, while still protecting against a quantum computer.

The most widely deployed example is X25519MLKEM768 in TLS 1.3, which runs an elliptic-curve Diffie-Hellman exchange and an ML-KEM encapsulation in the same handshake and combines both results into the session key. It is already the default in current browsers and major TLS libraries, and it accounts for most of the post-quantum traffic measured on the web.

BSI and ANSSI both require post-quantum key establishment to be used in hybrid form. ANSSI allows hash-based signatures such as SLH-DSA to be used alone, because their security rests on well-understood hash functions. NSA takes a different view and requires CNSA 2.0 algorithms on their own once the transition dates pass.

Sources: BSI, ANSSI, NSA, OpenSSL.

Much less. The quantum algorithm that breaks RSA and elliptic curves, Shor's algorithm, has no counterpart against symmetric ciphers and hash functions. The best known quantum attack on them, Grover's algorithm, gives a much smaller speed-up that is also hard to run in practice.

NIST continues to treat AES-128 as acceptable, while CNSA 2.0 requires AES-256 and SHA-384 or SHA-512 for national security systems. The large changes are all on the public-key side.

Sources: NIST, NSA.

Two things improve at once. Better algorithms reduce how many logical qubits and operations an attack needs, and better error correction reduces how many physical qubits each logical qubit costs. The 2019 to 2025 drop for RSA-2048 came entirely from those improvements on unchanged hardware assumptions.

The 2026 estimates go further by assuming different hardware, such as neutral atoms or error-correcting codes that need richer connectivity. They are not directly comparable with the earlier series, which is why the chart only joins estimates made under the same hardware model, and why the runtime matters as much as the qubit count.

Sources: Google Quantum AI, Gidney and Ekerå. See also: Quantum estimates.

Usually more than one. A company can be bound by its national government, its sector regulator, the jurisdictions of its customers and the requirements of the standards it certifies against. The practical answer is to plan against the earliest deadline among those that actually apply to your systems, which the transition page shows once you select your jurisdictions.

Read the scope carefully. Many dates apply only to government systems, high-value assets or critical infrastructure, and a date that does not bind you directly may still reach you through procurement requirements.

See also: Deadlines.

A mandatory requirement binds its scope through law, regulation or procurement, and failing it has consequences. Guidance is advice from an authority without direct enforcement, although regulators and auditors often treat it as the expected standard. A stated target is a goal a government has announced without a mechanism to enforce it.

The classification follows the one the Hong Kong Monetary Authority used in its comparison of national programmes, and it is shown next to every jurisdiction on the timeline.

Sources: Hong Kong Monetary Authority. See also: Deadlines.

China is standardising its own post-quantum algorithms rather than adopting the NIST set, as it did with SM2, SM3 and SM4. Its programme published round 1 candidates in September 2026, with 84 public-key and 35 hash algorithms, and no migration deadline yet.

For organizations operating in China, that means a second set of algorithms on a different schedule, and parameter choices that will not map directly onto ML-KEM and ML-DSA.

Sources: Institute of Commercial Cryptography Standards, China, Institute of Commercial Cryptography Standards, China. See also: Deadlines.

Crypto agility is the ability to change algorithms, key sizes or protocols without redesigning the systems that use them. It matters because every recommendation on this site will change again. A system that can swap algorithms by configuration can follow the next revision. A system with algorithms fixed in hardware, firmware or data formats has to be rebuilt.

Regulators have started to require it directly. DORA requires financial entities to have provisions for updating cryptographic technology as cryptanalysis develops, NIS2's implementing regulation expects it in the cryptographic policy, and PCI DSS requires a documented plan to respond to anticipated changes in cryptographic vulnerabilities.

See also: Other requirements.

Because you can't migrate what you can't find. Cryptography is embedded in applications, libraries, devices, certificates and third-party services, and most organizations don't know where all of it is. An inventory records which algorithms, key sizes, protocols and certificates are used where, and for what.

PCI DSS has required an inventory of cipher suites and protocols since March 2025, US federal agencies have maintained inventories of quantum-vulnerable systems since 2022, and most national migration plans make an inventory the first milestone.

See also: Other requirements.

Shorter validity limits how long a mis-issued or compromised certificate stays useful, and it forces automation. Once renewal is automatic, changing key types or algorithms becomes a configuration change that propagates within one certificate lifetime, which is the web PKI's form of crypto agility.

Maximum validity for publicly trusted TLS certificates fell to 200 days in March 2026 and will fall to 100 days in March 2027 and 47 days in March 2029.

See also: Other requirements.

FIPS 140 is the US standard for cryptographic modules, the hardware or software that actually implements the algorithms. NIST's Cryptographic Module Validation Program tests modules against it and publishes certificates. FedRAMP, CMMC and federal systems require validated modules, not just approved algorithms, because a correct algorithm can still be implemented badly.

The standard is in transition. All FIPS 140-2 certificates moved to historical status on 21 September 2026, so new federal procurements depend on FIPS 140-3 certificates, and many modules are still waiting in the validation queue. Post-quantum algorithms follow the same path, since they can only be used in these regimes once validated modules implementing them exist.

Sources: FedRAMP. See also: Other requirements.

Every figure links to the document it comes from, and every source is marked by how it was checked. Primary means the cited section of the document itself was read. Secondary means the entry rests on reporting about the document and still needs checking.

The distinction matters. Checking against primary documents has already corrected errors that were repeated across widely cited summaries, including the number of the US executive order and what BSI actually requires for hybrid key establishment. Surveys and trackers from firms that sell post-quantum products are treated as leads, not evidence.

See also: Sources.

New findings and rules go into the developments log first, with their source, and are folded into the tables and charts once they have been checked. Every section shows the date it was last reviewed. The data is published as open JSON under CC BY 4.0 so that anyone can check it, build on it or send corrections.

See also: Developments log.