1. The Post-Quantum Threat

1.1 The Problem

Quantum computers pose an existential threat to current public-key cryptography:

• RSA: Shor's algorithm can break RSA encryption in polynomial time

• ECDSA: Elliptic curve cryptography equally vulnerable

• Current Infrastructure: Estimated 75% of internet security relies on vulnerable algorithms

• Harvest Now, Decrypt Later: Adversaries are already capturing encrypted data for future decryption

Timeline: NIST estimates cryptographically relevant quantum computers within 10-15 years, but conservative security planning requires migration now.

1.2 NIST Post-Quantum Standards (2024)

In August 2024, NIST published the first post-quantum cryptographic standards:

Algorithm	Purpose	Security Level	Key Size
ML-KEM-768 (Kyber768)	Key Encapsulation	NIST Level 3	2,400 bytes
ML-DSA-65 (Dilithium3)	Digital Signatures	NIST Level 3	4,595 bytes
SLH-DSA (SPHINCS+)	Stateless Signatures	NIST Level 3	49 KB

Cryptic implements Dilithium3 and Kyber768 as primary algorithms, with SPHINCS+ support planned.

1.3 The Key Management Challenge

Migrating to post-quantum cryptography creates operational challenges:

1. Key Size: PQC keys are 10-100x larger than traditional keys

2. Algorithm Complexity: Requires specialized implementations

3. Transition Period: Must support hybrid classical/quantum-resistant schemes

4. Key Lifecycle: Generation, storage, rotation, and deletion at scale

5. Compliance: FIPS certification lags behind NIST standards

Market Gap: No production-ready, TEE-backed, post-quantum KMaaS exists today.