We learnt that quantum computers could break some of the security we use today. Read the this episode if you missed it.

This is no longer just a theoretical concern. At the 2025 G7 Summit, leaders warned that quantum technologies could threaten today’s data-protection systems and called for the timely adoption of quantum-resilient security.

So what should we replace our current cryptography with?

And more importantly: what makes the replacement harder to break?

Let us build the idea slowly.

When you open your bank’s website, your computer needs a way to exchange information safely. It also needs to check that it is talking to your bank.

To do this, it follows a set of security rules called cryptographic protocols. Some of the mathematics used for this could be broken by a powerful enough quantum computer.

So we need new methods. Ones that ordinary computers can use, but that even quantum computers would struggle to break.

That is what post-quantum cryptography, or PQC, aims to do.

Despite the name, there is nothing quantum about running it. It is designed for ordinary computers and the internet, so even powerful quantum computers cannot break their security.

There are several ways to do this. Let us learn one that is easier to grasp. But before that, let us understand the basics of cryptographic protocols.

You want to send a message to your bank. Someone might intercept it, so you need to make sure only the bank can read it.

Here is the idea:

So, our goal is to design a puzzle with two keys: one secret key that helps you find the treasure, and one public key that anyone can use to hide the treasure.

Without the secret key, solving the puzzle should be extremely hard, even for a quantum computer.

Imagine drawing a repeating pattern of dots arranged in evenly spaced rows and columns, as shown in the figure below.

That arrangement of dots is called a square lattice.

Now stand on one dot. You are allowed two moves:

You can repeat either move.

Look at the yellow dot below. How would you get there?

Three blue steps and five red steps. Easy. We can write that as (3, 5).

What about another dot? You just change the number of steps. With these two arrows, you can reach every dot on the floor.

These two unique arrows/directions are enough to reach any dot on the lattice. In mathematics, such a set of directions is called a basis. Each arrow is a basis vector. Here, the red arrow is one basis vector and the blue arrow is the other.

For now, just think of them as your two allowed moves.

Let us keep every dot in the lattice exactly where it is.

But this time, I give you different arrows.

Can you still reach the same yellow dot? How many blue and red arrows you need?

Try to work it out before watching the whole animation below.

You need nine blue arrows backwards and seven red arrows forwards.

Earlier, you could look at the dot and immediately say “three right, five up.” With these new arrows, the answer is less obvious.

Yet both pairs of arrows can reach exactly the same dots.

The first pair is often called a good basis. The arrows are short and point in clearly different directions.

The second is a bad basis. The arrows are longer and point almost the same way. You spend a lot of effort undoing part of one move with another.

Here is the wonderful part: we can use the good basis, bad basis, and the lattice to build a cryptographic protocol where:

Let us use the bank example. This is a simplified version of how it could work.

The bank shares its bad arrows with everyone. These are its public key. It keeps the good arrows secret. These are its private key.

Suppose your message has been turned into two numbers: 6 and 8.

(How any message is converted to a number is a different story and is explained here.)

Your computer takes six steps with the first bad arrow and eight with the second. It lands on a dot. Let us say it is (21, 13).

Then it moves a tiny distance away from that dot and sends this new position to the bank.

This is easy part. Your computer doesn’t have to solve anything.

Now the bank has to work backwards. Your computer sends it only the shifted position, say (21.2, 12.9).

The bank must answer: which lattice dot is closest to this position?

Its secret good arrows help it find that dot: (21, 13).

It then works out how many steps with the bad basis lead there: 6 blue steps and 8 red steps.

Those numbers were your message. The bank has recovered it.

Someone watching knows the bad arrows and the shifted position you sent. But they do not know the exact lattice dot you chose.

Two things make this hard:

So the whole trick is:

Sender:
3,5 → exact lattice point → add small noise

Bank:
noisy point → use secret good basis → exact lattice point → 3,5

Attacker:
noisy point + bad basis → cannot simply round back to 3,5

Easy to send. Easy to recover with the secret key. Hard without it.

The key idea is simple: some problems built around lattices like these are believed to remain extremely hard even for powerful quantum computers. That makes them useful for building a new generation of cryptography.

The goal is to gradually replace vulnerable public-key algorithms such as RSA and ECC with post-quantum cryptography (PQC).

And this is no longer just research. In 2024, NIST finalized its first three PQC standards, including the lattice-based ML-KEM and ML-DSA, and is now encouraging organizations to begin the transition.

You can follow the progress here: