Marin Ivezic
Three vendor responses arrive in the same procurement file. One product is described as quantum-safe, the second as quantum-resistant, the third as post-quantum. Nothing in those three words tells you whether the three products differ. Since August 2024, when the U.S. National Institute of Standards and Technology (NIST) published its first three post-quantum standards, all three labels have pointed at the same body of algorithms – and they still carry three different implied levels of confidence.
What each word actually claims
Post-quantum cryptography (PQC) is the most precise of the three. It names a class of algorithms that run on ordinary computers and are designed to withstand attack by a quantum one. Two quantum attacks drive the design. Shor’s algorithm would break RSA, elliptic-curve cryptography (ECC), and Diffie-Hellman key exchange outright. Grover’s algorithm gives a smaller speedup against symmetric ciphers and hash functions, which is handled by using longer keys and larger digests. “Post-quantum” is a period label. It says when the algorithms are meant to work, not how well they work.
Quantum-resistant makes a claim about the algorithm itself: it withstands quantum attack. The word carries an honest hedge, because resistance is believed rather than proved, and belief gets revised. SIKE, one of the candidates in the NIST process, was broken in 2022 by an attack from Wouter Castryck and Thomas Decru that ran on a single classical machine in under an hour. No quantum computer was involved.
Quantum-safe makes the strongest-sounding claim, and it’s the one the underlying mathematics doesn’t support. No standardized PQC algorithm has an unconditional security proof. Each one rests on a problem nobody currently knows how to solve efficiently, by quantum means or otherwise. ETSI, the European Telecommunications Standards Institute, uses “quantum-safe” throughout its work, and it means by that word exactly what NIST means by “post-quantum”. The word is simply stronger than the guarantee behind it.
Working cryptographers treat all three as near-synonyms, and they are right to: the three words describe the same algorithms. The difference is one of tone, not of technology.
Which body uses which word
- NIST – “post-quantum cryptography”. The standards are FIPS 203 (ML-KEM, formerly CRYSTALS-Kyber), FIPS 204 (ML-DSA, formerly CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, formerly SPHINCS+).
- National Security Agency (NSA) – “quantum-resistant”, in CNSA 2.0, the Commercial National Security Algorithm Suite that sets migration deadlines for U.S. national security systems.
- ETSI – “quantum-safe”, across its technical reports and migration guidance.
- Internet Engineering Task Force (IETF) – “post-quantum” as the primary term in RFC 9794, which records the alternatives rather than ruling between them.
The practical rule we teach: use the vocabulary of the standard your obligation comes from. If a deadline reaches you through CNSA 2.0, write “quantum-resistant” in the compliance record. If you are documenting an implementation against a FIPS specification, write “post-quantum”. Consistency inside one document matters more to an auditor than picking the globally correct word, and there isn’t a globally correct word.
Where the ambiguity pays
Four patterns turn up often enough in vendor material to be worth naming.
The label covers one component. A product implements ML-KEM for Transport Layer Security (TLS) key exchange and ships as “quantum-safe”. Signatures still use ECDSA, the elliptic-curve signature scheme. The certificate chain still uses RSA. One migrated component, several unmigrated ones, and a single product-level adjective sitting on top of all of them.
The label attaches to an unexamined algorithm. A proprietary cipher is marketed as “quantum-resistant” without ever having been submitted to NIST, ETSI, or any public cryptanalysis. “Resistant” implies that competent people tried to break it and failed. An algorithm nobody outside the vendor has read has no such history.
The label attaches to something that isn’t an algorithm. “Post-quantum security platform” could mean PQC throughout the stack, one feature using one algorithm, or a roadmap commitment. The phrase doesn’t distinguish between the three.
The label predates the standard. “Quantum-safe since 2022” reads well until you check what was standardized in 2024. Parameter sets changed between the drafts and the final specifications, and one candidate family, SIKE, was broken outright. An early implementation might be a genuine head start. It might also be code that now needs rewriting.
None of this requires bad faith on the vendor’s part. It does mean the vocabulary is doing work for the seller that the buyer has to undo.
Three questions to ask a vendor
Which specific standardized algorithm is behind the label? All three words are fair descriptions of ML-KEM-768. None of them is a fair description of an unpublished cipher. The answer you want is a name and a parameter set, not a category.
Which components are migrated, and which are not? Ask for the inventory rather than the headline. A system is only as quantum-resistant as its weakest cryptographic component, and partial migration is the normal condition of almost every product on the market right now. That is fine, as long as it’s stated.
Final specification, or draft? Implementations built against pre-2024 drafts may not interoperate with FIPS 203, 204, and 205 as published. For a team tracking CNSA 2.0 dates, that difference becomes a schedule item rather than a technical footnote.
The standard we teach
Three habits:
- “Post-quantum” for the field, the standards, and the algorithms.
- “Quantum-resistant” for a property of a named algorithm.
- “Quantum-safe” when quoting a body that uses it, in that body’s own words.
And none of the three used as a product-level adjective without the component list underneath it. The label opens the conversation. The algorithm name, the parameter set, and the migration inventory finish it.
Where to build this
Precise vocabulary is the first thing a migration program needs, because inventory, procurement, and board reporting all break quietly when three teams use one word to mean three different things. Our Post-Quantum Foundation program covers the terminology, the NIST standards and what each one is for, and the questions above as a working procurement checklist. It is built for practitioners who will own, brief, or audit a migration rather than write the code for it. You can review the program at quantumacademy.com/.
For the migration methodology that sits behind those questions, see pqcframework.org. For deeper technical treatment of the standards themselves, PostQuantum.com goes further into the algorithms than a terminology guide can.