The Vocabulary of Quantum Security

Ask a supplier list for “quantum-safe” proposals and the replies won’t describe one product category. Some will quote optical hardware with a distance limit measured in tens of kilometers. Others will quote software libraries implementing the three algorithm standards NIST published on August 13, 2024. Both groups answered honestly. The request was ambiguous, and the ambiguity produced a bid comparison between products that do different jobs.

Quantum security is not a standardized term. It took hold before the field settled its vocabulary, and it now covers at least three separate activities. The terms around it – quantum-resistant, quantum-safe, quantum readiness, quantum resilience, CRQC, Q-Day – are used precisely by standards bodies and loosely by almost everyone else. This post sets out what each one denotes, where usage splits by jurisdiction, and which word to write when precision has money attached to it.

Three Meanings in Circulation

Quantum technology used for security. Here the phrase points at hardware that exploits quantum mechanics to produce a security property. Quantum key distribution, or QKD, encodes key material in the states of individual photons, so any measurement by an interceptor disturbs those states and appears as errors at the receiving end. A quantum random number generator, or QRNG, draws entropy from a physical quantum process instead of from a deterministic algorithm seeded by system noise. In both cases the quantum part sits inside the defense.

Classical systems defended against quantum attack. The systems being protected here are ordinary ones: TLS sessions, code-signing pipelines, VPN concentrators, payment HSMs. The threat is a future quantum computer. The defense is new mathematics running on the classical hardware an organization already owns. This is post-quantum cryptography, and it is what most people intend when they say quantum security in a cybersecurity setting.

The security of quantum systems themselves. A quantum computer reachable over a cloud API is an internet-facing system with credentials, tenancy boundaries, and job queues. QKD equipment is optical hardware that can be attacked at the detector rather than at the protocol, and Lydersen et al.’s 2010 detector-blinding attacks against two commercial QKD systems demonstrated exactly that. ITU-T’s Y.3800-series recommendations address security requirements for QKD networks. This is real work, and it’s almost never what a vendor means by the phrase.

The second meaning dominates conversation and budget, because it is the one with a deadline. The first meaning dominates a smaller set of vendor catalogs. When the two collide inside one procurement document, the buyer ends up comparing a fiber link against a cryptographic library.

Post-Quantum Cryptography and Its Synonyms

Post-quantum cryptography (PQC) means public-key algorithms designed to resist attack by both classical and quantum computers, running on conventional hardware. The “post” refers to the era, not to the machine. Nothing in these algorithms requires a qubit to operate.

Three labels describe the same class of thing. NSA’s published FAQ on quantum computing states that quantum-resistant, quantum-safe, and post-quantum all denote algorithms that run on today’s computers and are believed to resist cryptanalysis by classical and quantum machines alike. We treat the three as interchangeable, and we pick one per document rather than rotating between them.

One label should be retired. Quantum-proof claims more than anyone can demonstrate. No PQC algorithm carries a security proof against quantum attack; each rests on a mathematical problem nobody currently knows how to solve efficiently. In July 2022, SIKE – a candidate that had reached the fourth round of NIST’s process – was broken by Castryck and Decru on a single classical processor core in roughly an hour, using no quantum resources whatsoever. Quantum-resistant is a statement about the current state of knowledge. Quantum-proof is a statement nobody is entitled to make.

What the standards actually contain

NIST opened its public call for post-quantum algorithms in 2016 and announced its first selections in July 2022. Three standards followed on August 13, 2024:

• FIPS 203, ML-KEM (formerly CRYSTALS-Kyber), a key-encapsulation mechanism for establishing shared secrets
• FIPS 204, ML-DSA (formerly CRYSTALS-Dilithium), the general-purpose digital signature standard
• FIPS 205, SLH-DSA (formerly SPHINCS+), a hash-based signature scheme with larger signatures and a different security assumption

A fourth signature scheme, FN-DSA (formerly FALCON), has been drafted but not finalized. NIST selected HQC in March 2025 as a backup key-establishment algorithm built on a different mathematical family, so that a break in lattice assumptions would not leave the standard portfolio without an option.

The algorithm names matter in procurement. A vendor claiming “NIST-approved post-quantum support” is making a claim about ML-KEM, ML-DSA, or SLH-DSA specifically, and the contract should say which.

Why the deadline is not the arrival of the machine

Peter Shor’s 1994 algorithm showed that a sufficiently capable quantum computer could factor large integers and compute discrete logarithms efficiently, which would break RSA, Diffie-Hellman, and elliptic-curve cryptography. No such machine exists.

The deadline is earlier than the machine for two reasons. The first is harvest now, decrypt later, usually abbreviated HNDL: an adversary records encrypted traffic today and stores it until decryption becomes possible. Any data whose confidentiality requirement outlives the arrival of a capable quantum computer is already exposed. The second is migration duration. Replacing public-key cryptography across an enterprise means finding it first, and most organizations don’t know where all of it is. That discovery work alone runs into years.

Symmetric cryptography is affected differently. Grover’s algorithm offers a quadratic speedup on unstructured search, which is often described as halving the effective strength of a symmetric key, so AES-256 retains a comfortable margin where AES-128 does not. The practical benefit is smaller still, because the search cannot be parallelized effectively. Symmetric algorithms and hash functions with adequate output lengths are not the migration problem. Public-key cryptography is.

What QKD Does and Does Not Do

QKD distributes symmetric key material between two endpoints. It doesn’t encrypt data, and it doesn’t produce digital signatures. The keys it delivers still feed a conventional symmetric algorithm, typically AES. Its security argument is information-theoretic rather than computational, and it holds only to the extent that the deployed equipment matches the model in the proof.

Three constraints shape where it fits.

Physical reach. QKD needs dedicated fiber or line-of-sight optics. Photon loss sets a practical limit, and extending beyond it currently requires trusted intermediate nodes, which reintroduce exactly the trust assumption the technology was chosen to remove.

Authentication. A QKD exchange requires an authenticated classical channel alongside the quantum one, otherwise an attacker in the middle establishes keys with each party separately. Authenticating that channel needs either a pre-shared symmetric key or a public-key signature. QKD therefore does not remove the need for quantum-resistant signatures. It assumes an authentication mechanism already exists.

Implementation assurance. The proof covers the protocol. It does not cover the detector, the source, or the firmware, and the published attack literature targets those components rather than the mathematics.

Positions differ by government. NSA does not approve QKD for U.S. national security systems and has set out its reasoning, which centers on special hardware, distance limits, the authentication dependency, and cost relative to algorithmic alternatives. The UK’s NCSC has been consistently cautious about reliance on QKD for government use. The European Union is funding EuroQCI as quantum communication infrastructure, and China operates the largest deployed QKD networks. ETSI maintains an Industry Specification Group for QKD, and ITU-T has published network recommendations for it.

For an enterprise buyer, the choice is not between QKD and PQC. PQC is required regardless, because it’s the only option that covers signatures, code signing, certificate hierarchies, and every link that terminates somewhere without dedicated fiber. QKD is an optional addition to a small number of point-to-point links with unusual confidentiality requirements.

Readiness and Resilience

These two describe organizational posture rather than technology, and they are frequently swapped.

Quantum readiness is the state of preparation. The joint CISA, NSA, and NIST factsheet published in August 2023 gives it operational content: establish a migration roadmap, build a cryptographic inventory, engage vendors about their PQC timelines, and prioritize which systems move first. In the United States, National Security Memorandum 10 of May 2022 required federal agencies to inventory cryptographic systems ahead of the standards being finalized. Readiness is measurable by artifact. An organization either has an inventory or does not.

Quantum resilience is the end state. A resilient system continues to protect confidentiality and integrity once a capable quantum computer exists, and it does so without a rebuild each time an algorithm changes. That second property is crypto-agility: the ability to replace a cryptographic primitive without re-architecting the application around it. Hard-coded algorithm identifiers, certificate profiles that assume a key size, and protocol implementations with no negotiation path are the specific things that make an estate non-agile.

The sequence is readiness first, resilience after. Readiness is the plan and the inventory. Resilience is what the estate looks like when the plan has been executed.

The UK’s NCSC attached dates to that sequence in its March 2025 guidance on timelines for migration to post-quantum cryptography, recommending that organizations complete discovery and define a migration plan by 2028, migrate their highest-priority systems by 2031, and complete migration by 2035. Whatever a given organization’s own dates are, this is the shape: discovery, prioritization, phased replacement.

CRQC and Q-Day

CRQC stands for cryptographically relevant quantum computer, a term introduced in U.S. government documents to mean a machine capable of breaking cryptography in actual deployment. It is not defined by a qubit count. The relevant variables are the number of logical qubits – error-corrected units assembled from many physical ones – the physical error rate, and the runtime the attacker can sustain. Published resource estimates are usually given in physical qubits under stated error-rate assumptions, and they have fallen substantially as error-correction techniques improved. Craig Gidney’s May 2025 estimate, published as arXiv preprint 2505.15917, put RSA-2048 within reach of fewer than a million noisy physical qubits running for under a week, against roughly twenty million in Gidney and Ekerå’s 2019 analysis. These are engineering projections rather than demonstrations, and the distinction between an announced qubit count and a demonstrated logical operation is where most public confusion begins.

Q-Day is informal shorthand for the day a CRQC can break currently deployed public-key cryptography. It appears in commentary and almost never in standards documents, which use CRQC instead.

Q-Day is sometimes described as the day an organization’s new quantum-resistant algorithms go live. That reverses the meaning: Q-Day is the attacker’s milestone, not the defender’s. A migration deadline is a date an organization chooses or a regulator imposes. Q-Day is a date nobody controls and nobody will announce in advance. Plans should reference the regulatory or contractual deadline, and reserve Q-Day for the threat event it names.

The Words Change by Jurisdiction

United States

Federal agencies and most of the academic literature use post-quantum cryptography, with quantum-resistant as the adjective. CRQC is a U.S. coinage. NSA’s Commercial National Security Algorithm Suite 2.0, published in 2022, sets the required algorithms and transition schedule for national security systems. U.S. policy emphasizes algorithmic migration and crypto-agility, and treats QKD as unsuitable for the systems it governs.

Europe

Quantum-safe gained early traction in Europe through ETSI, which has run quantum-safe cryptography workshops since 2013 and formed a dedicated working group. ENISA uses post-quantum cryptography in its reports and has recommended hybrid deployments, meaning a classical and a post-quantum algorithm run together so that a break in either one leaves the other standing. European documents keep QKD and PQC in separate categories rather than under a single label.

United Kingdom

NCSC has used quantum-safe in a broad sense that includes both QKD and algorithmic approaches, most visibly in its 2020 paper on quantum security technologies. In its migration guidance it uses post-quantum cryptography for the algorithms. Reading NCSC material, the useful habit is to check whether a given sentence is describing an outcome or a technology.

Elsewhere

Canada and Australia follow U.S. terminology closely. Chinese material uses quantum communication security and quantum cryptography predominantly for QKD, and reserves post-quantum for the algorithms, which reflects the balance of national investment. Japanese and Korean research programs cover both and generally use the English terms.

Underneath the vocabulary the technical consensus is stable. Every major jurisdiction is moving to quantum-resistant algorithms, and every one treats QKD as a specialized option rather than a general answer.

Writing It Precisely

When you mean	Write	Avoid
New algorithms that resist quantum attack	post-quantum cryptography, or quantum-resistant cryptography	quantum-proof, quantum encryption
A specific standardized algorithm	ML-KEM, ML-DSA, SLH-DSA	NIST-approved PQC
Physics-based key exchange	quantum key distribution, or QKD	quantum security, quantum cryptography
The state of being prepared to migrate	quantum readiness	quantum resilience
The end state after migration	quantum resilience	quantum readiness
A machine able to break deployed cryptography	cryptographically relevant quantum computer, or CRQC	quantum computer
The day such a machine exists	Q-Day	migration deadline
Your own migration deadline	the date, and who set it	Q-Day

Two habits carry most of the benefit. Fix one term per document and use it throughout, rather than rotating through synonyms for variety. And when a supplier, an auditor, or a board paper uses quantum security without qualification, ask which of the three meanings is intended before responding to it. The answer changes the scope, the budget line, and the department that owns the work.

Learning the Distinctions in Depth

Terminology is the surface of a larger problem. Behind each of these words sits a set of technical decisions – which algorithm for which protocol, how to structure a cryptographic inventory, how to sequence a migration across systems you don’t fully control – and getting the vocabulary right is the point at which those decisions become discussable.

Quantum Academy’s Post-Quantum Foundation program covers this ground in structured form: the threat model, the standardized algorithms and where each belongs, cryptographic discovery, and the migration planning sequence that readiness guidance assumes. It is built for security professionals who need working command of the material rather than a briefing, and it is the starting point for the rest of our post-quantum credentials. Details and enrollment are at quantumacademy.com/.

For migration methodology in depth, the Post-Quantum Cryptography Framework sets out the phased approach referenced above. For deeper technical treatment of the algorithms and the threat timeline, PostQuantum.com carries the long-form analysis.