Classical Cryptography vs Post-Quantum Cryptography
Post-quantum cryptography runs on today's computers but rests on mathematical problems that quantum algorithms are not known to solve efficiently. Here is how the two families compare in practice.
- Reading time
- 8 min read
- Last reviewed
- 1 Oct 2026
Same job, different foundations
Classical public-key cryptography (RSA, ECDSA, Ed25519, X25519) is built on integer factorisation and discrete logarithms. Post-quantum cryptography (PQC) targets the same jobs, signatures and key establishment, but builds them on problems such as finding short vectors in lattices or inverting hash functions, for which no efficient quantum algorithm is known.
An important clarification: post-quantum cryptography is ordinary software. It runs on classical hardware. It is not quantum cryptography, and it does not require quantum devices.
The standardised families
In August 2024 NIST published three standards after a public competition that began in 2016. ML-KEM (FIPS 203) is a key-encapsulation mechanism derived from CRYSTALS-Kyber. ML-DSA (FIPS 204) is a signature scheme derived from CRYSTALS-Dilithium. SLH-DSA (FIPS 205) is a stateless hash-based signature scheme derived from SPHINCS+. A fourth, FN-DSA based on Falcon, is in progress, and NIST has selected HQC as an additional KEM for standardisation.
- Lattice-based: ML-KEM and ML-DSA. Fast, moderate sizes, newer mathematics.
- Hash-based: SLH-DSA. Conservative security assumptions, large signatures, slower signing.
- Code-based: HQC. Selected as a backup KEM with different mathematical assumptions from ML-KEM.
What changes in practice
The most visible difference is size. An Ed25519 public key is 32 bytes and a signature is 64 bytes. ML-DSA-65 has a 1,952-byte public key and a 3,309-byte signature. SLH-DSA keeps keys tiny but produces signatures from roughly 8 KB to 50 KB depending on the parameter set.
Performance differs too. Lattice schemes are competitive with or faster than elliptic curves for signing and verification in optimised implementations. Hash-based signing is markedly slower. Both are workable for servers and desktops; constrained devices and bandwidth-limited protocols feel the sizes most.
The other change is maturity. Elliptic-curve cryptography has decades of deployment and analysis. The new standards were scrutinised intensely during the competition, but implementations, side-channel hardening and protocol integrations are younger. This is one reason hybrid deployments, which combine a classical and a post-quantum scheme, are common.
Hybrid approaches
A hybrid construction combines two algorithms so that security holds as long as either one does. For key exchange, X25519 combined with ML-KEM-768 is widely deployed in TLS today. For signatures, hybrids mean carrying two signatures, which doubles the cost but protects against an unexpected weakness in either scheme.
Hybrids are a migration tool, not necessarily a destination. They let systems gain post-quantum protection without betting everything on newer mathematics.
Practical implication
- Size budgets, not raw speed, are usually the first constraint when introducing PQC into transaction formats or network protocols.
- Prefer standardised parameter sets (for example ML-KEM-768, ML-DSA-65) unless a specific requirement justifies another.
- Consider hybrid constructions where the protocol allows, especially for key exchange.
Limitations
- Performance comparisons depend heavily on implementation quality and hardware. The Lattice playground only reports timings measured in its own environment.
- Standards continue to evolve. Parameter guidance and deprecation schedules should be checked against current NIST publications.
Sources
- [1]FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard (opens in a new tab) · NIST
- [2]FIPS 204: Module-Lattice-Based Digital Signature Standard (opens in a new tab) · NIST
- [3]FIPS 205: Stateless Hash-Based Digital Signature Standard (opens in a new tab) · NIST
- [4]NIST Post-Quantum Cryptography project (opens in a new tab) · NIST