// GLOSSARY

Post-quantum glossary.

A plain-English reference defining the post-quantum cryptography terms security leaders actually encounter — from ML-KEM and hybrid key exchange to Harvest Now, Decrypt Later, CBOM and CNSA 2.0.

Attestation: A signed, dated record of a system’s measured cryptographic posture, used as evidence of post-quantum readiness for auditors and enterprise customers.
CNSA 2.0: The NSA’s Commercial National Security Algorithm Suite 2.0, which mandates post-quantum algorithms for U.S. national security systems on a 2030–2035 timeline. Requirements flow down to defense suppliers.
Crypto-agility: The property of being able to change cryptographic algorithms through configuration or a policy layer, without rewriting applications. It matters more than any single algorithm choice, because standards continue to move.
Cryptographic Bill of Materials (CBOM): A complete inventory of the cryptography an organisation uses — algorithms, key lengths, certificates, libraries and protocols, mapped to the systems that depend on them. The prerequisite for any migration.
Cryptographic drift: When a system that was quantum-safe silently stops being quantum-safe after a deploy, library downgrade or infrastructure change. Nothing visibly breaks, so drift is usually found only by continuous scanning.
Cryptographically Relevant Quantum Computer (CRQC): A quantum computer large and stable enough to run Shor’s algorithm against real-world key sizes. No CRQC is known to exist today, which is precisely why HNDL is the operative risk.
FN-DSA (FALCON): A lattice-based signature scheme with unusually compact signatures, published by NIST as draft FIPS 206. It suits bandwidth-constrained settings such as certificate chains.
Forward secrecy: A property ensuring that compromising a long-term key does not expose past sessions, because each session used an ephemeral key. Forward secrecy does not protect against HNDL if the ephemeral exchange itself is quantum-breakable.
Grover’s algorithm: A quantum search algorithm that gives a quadratic speed-up against symmetric ciphers and hashes. Its practical effect is modest: doubling key length restores the original security margin, so AES-256 remains sound.
Harvest Now, Decrypt Later (HNDL): An attack in which an adversary records encrypted traffic today and stores it until quantum computers can break the encryption. It makes the quantum threat a present-tense risk for any data with a multi-year secrecy requirement.
Hybrid key exchange: A key exchange that runs a classical algorithm and a post-quantum algorithm together and combines both results, so the session stays secure unless both are broken. X25519MLKEM768 is the common form on the web today.
Key encapsulation mechanism (KEM): A construction for securely establishing a shared secret over a public channel. A KEM encapsulates a random secret under a public key; only the private key holder can decapsulate it.
ML-DSA: Module-Lattice-Based Digital Signature Algorithm, standardised as NIST FIPS 204 and derived from CRYSTALS-Dilithium. It is the general-purpose quantum-safe replacement for RSA and ECDSA signatures.
ML-KEM: Module-Lattice-Based Key-Encapsulation Mechanism, standardised as NIST FIPS 203 and derived from CRYSTALS-Kyber. It is the quantum-safe replacement for RSA and Diffie-Hellman key exchange.
Post-quantum cryptography (PQC): Cryptography designed to stay secure against an adversary with a large-scale quantum computer. PQC replaces the RSA and elliptic-curve algorithms whose security rests on problems that Shor’s algorithm solves efficiently.
Quantum-safe TLS: A TLS configuration that negotiates a post-quantum or hybrid key-exchange group, so recorded sessions cannot be decrypted by a future quantum adversary.
Shor’s algorithm: A quantum algorithm that factors integers and computes discrete logarithms in polynomial time, which is what breaks RSA, Diffie-Hellman and elliptic-curve cryptography once a sufficiently large quantum computer exists.
SLH-DSA: Stateless Hash-Based Digital Signature Algorithm, standardised as NIST FIPS 205 and derived from SPHINCS+. Its security rests only on hash functions, making it the conservative choice for long-lived roots of trust such as firmware signing.
X25519MLKEM768: The hybrid TLS 1.3 key-exchange group combining classical X25519 with post-quantum ML-KEM-768. Negotiating this group is what earns an A grade on a Secuur readiness scan.
Zero Trust Architecture: A security model that removes implicit trust from the network perimeter and verifies every request on identity, device state and context, defined for U.S. federal use in NIST SP 800-207.

Grade my domain — free ↗ The NIST standards