Transitioning to Quantum-Safe Cryptography
Industry Network Technology Council (INTC) - 28 July 2026
VIDEO | AUDIO | RECAP EN / ES / FR | ARCHIVE | PERMALINK
Speakers: Dr. Vadim Lyubashevsky – IBM Research Zurich; Nalini Elkins – President, Industry Network Technology Council
Welcome and Introduction
Nalini Elkins introduced the Industry Network Technology Council (INTC) as a nonprofit organization dedicated to education on Internet standards and technologies affecting industry. She highlighted INTC’s partnership with the India Internet Engineering Society to expand participation in the IETF and reviewed the organization’s previous educational initiatives on IPv6, Internet security, and IETF work. She explained that the webinar built on earlier introductory sessions on post-quantum cryptography before introducing Dr. Vadim Lyubashevsky, noting his role as a co-author of the ML-KEM and ML-DSA algorithms selected by NIST for standardization.
Why Quantum Computing Changes Cryptography
Dr. Vadim Lyubashevsky began by defining cryptography as enabling secure communication in the presence of adversaries while emphasizing that conventional cryptographic security assumes only incremental increases in computing power. Classical cryptography can generally compensate for stronger computers simply by modestly increasing key sizes.
He explained that quantum computers fundamentally disrupt this assumption by violating the extended Church-Turing thesis. Rather than merely accelerating existing computations, they can solve certain mathematical problems exponentially faster than classical computers, rendering many longstanding public-key cryptographic assumptions invalid.
He distinguished between two major categories of cryptography:
Symmetric-key cryptography, such as AES and SHA-based systems, which largely survives the quantum transition with only moderate key-size adjustments.
Public-key cryptography, including RSA and elliptic curve systems, which depends on mathematical problems like integer factorization and discrete logarithms that quantum computers can efficiently solve using Shor’s algorithm.
The Urgency of the Transition
Dr. Vadim Lyubashevsky explained that organizations cannot wait until practical quantum computers exist because of “harvest now, decrypt later” attacks. Adversaries can capture encrypted communications today and store them until sufficiently powerful quantum computers become available to decrypt historical data.
He reviewed the development of the NIST Post-Quantum Cryptography competition, noting:
Research into quantum-resistant algorithms predated the competition by over a decade.
NIST launched its public competition in 2016–2017.
International researchers submitted algorithms for open evaluation.
ML-KEM became the selected encryption standard.
ML-DSA and SLH-DSA became standardized digital signature schemes in 2024.
Additional digital signature standards remain under development.
He observed that U.S. government migration deadlines have accelerated from 2035 to approximately 2030–2031 due to faster-than-expected progress in quantum computing research.
Preparing Before the “Panic Phase”
Dr. Vadim Lyubashevsky predicted that organizations are likely to underestimate the complexity of migration until regulatory deadlines approach. Although replacing cryptographic algorithms may appear straightforward, many deployed systems require substantial redesign to identify and replace deeply embedded legacy cryptography.
He argued that migration should not simply replace every classical algorithm immediately. Instead, organizations should distinguish between cryptographic functions that require immediate protection and those that can transition later.
He proposed a staged migration strategy:
Protect confidentiality immediately by replacing vulnerable encryption mechanisms.
Delay migration of authentication mechanisms where appropriate until quantum attacks become practical.
Design systems now so future upgrades become plug-and-play rather than requiring complete redesigns.
Build long-term architectures that anticipate eventual full quantum-safe deployment.
IBM’s Research and Advanced Cryptographic Systems
Dr. Vadim Lyubashevsky described IBM Research’s extensive involvement in quantum-safe cryptography, noting that IBM submitted three successful algorithms during the original NIST competition and continues developing additional digital signature candidates.
He emphasized that while standardized encryption and signatures are now largely solved problems, significantly greater challenges remain for advanced cryptographic systems involving:
Blind signatures
Anonymous credentials
Oblivious pseudorandom functions (OPRFs)
Complex privacy-preserving protocols
Unlike simple encryption, these systems rely on intricate algebraic relationships that cannot simply substitute quantum-safe primitives without major performance penalties. In many cases, entirely new protocol designs will be required rather than direct algorithm replacement.
Practical System Redesign
Dr. Vadim Lyubashevsky illustrated how even familiar infrastructure requires redesign during the quantum transition.
He explained that conventional certificate chains become impractical because individual quantum-safe signatures are several kilobytes in size. Rather than transmitting long chains of signatures, current proposals replace them with Merkle tree structures that dramatically reduce communication overhead.
He also described IBM’s collaboration with the Signal messaging project. While Signal already employs sophisticated cryptographic protocols, adapting them to post-quantum cryptography required redesigning key management and protocol interactions to reduce communication costs and preserve efficiency. These efforts may eventually influence broader standards beyond Signal itself.
Foundations of Lattice-Based Cryptography
Dr. Vadim Lyubashevsky devoted the technical portion of the presentation to explaining why lattice problems underpin most standardized post-quantum cryptography.
Using simplified examples, he showed how adding small amounts of mathematical “noise” transforms a problem that is trivial to solve using linear algebra into one believed to be computationally infeasible for both classical and quantum computers.
He explained that:
ML-KEM and ML-DSA originate from IBM’s CRYSTALS-Kyber and CRYSTALS-Dilithium submissions.
Both rely primarily on polynomial arithmetic, hashing, and lattice-based mathematics.
Their implementations use only a small set of efficient operations.
Security increases by performing more of the same operations rather than introducing entirely different mathematics.
He further described how Number Theoretic Transforms (NTTs), closely related to Fast Fourier Transforms, make polynomial multiplication highly efficient and account for the surprisingly good computational performance of lattice-based cryptography.
Performance Tradeoffs
Dr. Vadim Lyubashevsky explained that post-quantum algorithms present an unusual performance profile.
Although public keys and ciphertexts are dramatically larger than traditional elliptic-curve systems, the computational cost is often comparable—or even lower—because the underlying mathematical operations are highly efficient.
He cautioned, however, that increased communication size creates practical deployment challenges:
TLS handshakes become significantly larger.
Certificate chains require redesign.
Network packet fragmentation becomes more common.
Complex privacy-preserving protocols become substantially more expensive in both bandwidth and computation.
Consequently, deployment decisions should balance computational efficiency against communication overhead rather than considering processing speed alone.
Discussion: Migration Priorities
Nalini Elkins asked whether post-quantum cryptography should be considered less efficient than classical cryptography.
Dr. Vadim Lyubashevsky clarified that the answer depends on what is measured. Pure cryptographic computations can actually be faster, but communication costs increase substantially due to larger keys and signatures. More advanced cryptographic constructions, however, generally experience significant increases in both computation and bandwidth requirements.
Discussion: Long-Term Digital Signatures
Nalini Elkins described her own measurements of ML-DSA implementation performance and asked about long-lived digital signatures used for contracts and financial systems.
Dr. Vadim Lyubashevsky replied that existing RSA-signed contracts ultimately become vulnerable once quantum computers can forge signatures. Long-lived digital documents therefore require migration to quantum-safe signatures well before practical quantum computers become available, making this an immediate planning issue rather than a future one.
Discussion: Quantum Computing as a Service
Nalini Elkins suggested that quantum computing resources might eventually be offered commercially, allowing attackers to purchase cryptanalytic capability.
Dr. Vadim Lyubashevsky acknowledged that providers may initially attempt to restrict misuse, but argued that organizations cannot assume adversaries—including nation states—will lack access. He concluded that defensive migration remains the only reliable strategy regardless of how quantum computing becomes commercially available.
Discussion: Zero-Knowledge Proofs
Nalini Elkins asked about zero-knowledge proofs in a quantum-safe environment.
Dr. Vadim Lyubashevsky explained that many modern hash-based zero-knowledge systems are already quantum resistant by design. Current research seeks to improve their efficiency using lattice-based techniques similar to ML-KEM and ML-DSA while preserving succinctness and verification speed. Although future proofs may be larger than today’s shortest classical constructions, practical quantum-safe alternatives already exist and continue to improve.
Discussion: Standards and Industry Collaboration
Nalini Elkins asked about IBM’s engagement with IETF activities, particularly around messaging protocols such as MLS.
Dr. Vadim Lyubashevsky explained that IBM researchers actively participate in IETF work, although his own focus remains algorithm design. He praised collaboration with Signal because its engineers possess strong cryptographic expertise, allowing protocol improvements to be developed efficiently before wider standardization.
Closing Remarks
Nalini Elkins concluded by emphasizing the importance of practical collaboration among industry, academia, and government as organizations prepare for post-quantum migration. She invited participants to engage with upcoming interoperability initiatives, including OpenSSL implementation work, ML-DSA certificate testing, and collaborative test environments intended to help organizations gain hands-on experience with quantum-safe technologies.
RESOURCES
INTC Quantum Series — the webinar series this session belongs to, with past talks and slides
Vadim Lyubashevsky — speaker’s page, including his tutorial on lattices and the new NIST standards
CRYSTALS — Cryptographic Suite for Algebraic Lattices, the Kyber and Dilithium submissions he co-authored
FIPS 203 (ML-KEM) — the encryption standard that came out of CRYSTALS-Kyber
FIPS 204 (ML-DSA) — the signature standard that came out of CRYSTALS-Dilithium
FIPS 205 (SLH-DSA) — the hash-based signature standard, third of the 2024 drafts
NIST Additional Digital Signature Schemes — the follow-on round he described as still years from finishing
Merkle Tree Certificates — the IETF draft replacing certificate chains to avoid stacked 3 KB signatures
IRTF Crypto Forum Research Group — the group Nalini Elkins invited him to connect with
StarkWare — the hash-based proof company he cited as quantum-safe by default