Talking About PQC Accurately

Most online security — the padlock in a browser, signed software updates, bank transfers — relies on mathematics that a large enough quantum computer could undo. No such computer exists yet. But data copied today could be read once one does, which is why people call the risk “harvest now, decrypt later”.

The replacements already exist. NIST published three post-quantum standards in August 2024: ML-KEM (FIPS 203) for setting up secure connections, and ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for digital signatures. The slow part now is fitting them into every product and system.

That is the whole story in three sentences: a real risk, a published fix, and years of work to apply it.

Every real date belongs to someone and applies to specific systems. Before you quote a date, say whose it is and what it covers.

A private company outside these scopes may have no legal deadline at all — but its customers may. Other countries set their own schedules; the Timeline lists them with their sources.

“Certified” is the word most often stretched. In the US and Canada, the FIPS 140-3 programme has three stages that are easy to confuse:

• Algorithm tested (CAVP certificate). One implementation of one algorithm passed its tests. It says nothing about the rest of the product.
• In process. The module appears on NIST’s Modules In Process list: validation has started, not finished.
• Validated (FIPS 140-3 certificate). The module passed. The certificate has a number anyone can look up, and it covers a specific version and configuration.

Other schemes — Common Criteria and the EU’s EUCC, for example — work differently, but the same rule applies: read what a certificate covers before you read its level. Post-quantum algorithms added in a later version are not covered by an older certificate.

This site’s product catalogue shows these same three stages, taken from the public records, for every product it lists.

A useful answer has three parts, each with something the listener can check:

1. What is protected today — which parts of the product, with which algorithms, from which version.
2. What is planned, and when — a public roadmap is stronger than a promise in a meeting.
3. The evidence — certificate numbers, a roadmap page, or a cryptography bill of materials (a list of the cryptography a product uses).

If part of the answer is “we don’t know yet”, say so. Customers comparing suppliers notice a confident answer that cannot be checked.

This site lists every product on the same terms, whoever makes it, and links each claim to its source. It is evidence you can point to — not a ranking.