> For the complete documentation index, see [llms.txt](https://cryptic-documentation.gitbook.io/cryptic-pq/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cryptic-documentation.gitbook.io/cryptic-pq/crytic-enterprise-whitepaper/1.-the-post-quantum-threat.md).

# 1. The Post-Quantum Threat

#### 1.1 The Problem

Quantum computers pose an existential threat to current public-key cryptography:

* **RSA**: Shor's algorithm can break RSA encryption in polynomial time
* **ECDSA**: Elliptic curve cryptography equally vulnerable
* **Current Infrastructure**: Estimated 75% of internet security relies on vulnerable algorithms
* **Harvest Now, Decrypt Later**: Adversaries are already capturing encrypted data for future decryption

**Timeline**: NIST estimates cryptographically relevant quantum computers within 10-15 years, but conservative security planning requires migration **now**.

#### 1.2 NIST Post-Quantum Standards (2024)

In August 2024, NIST published the first post-quantum cryptographic standards:

| Algorithm                  | Purpose              | Security Level | Key Size    |
| -------------------------- | -------------------- | -------------- | ----------- |
| **ML-KEM-768** (Kyber768)  | Key Encapsulation    | NIST Level 3   | 2,400 bytes |
| **ML-DSA-65** (Dilithium3) | Digital Signatures   | NIST Level 3   | 4,595 bytes |
| **SLH-DSA** (SPHINCS+)     | Stateless Signatures | NIST Level 3   | 49 KB       |

Cryptic implements **Dilithium3** and **Kyber768** as primary algorithms, with SPHINCS+ support planned.

#### 1.3 The Key Management Challenge

Migrating to post-quantum cryptography creates operational challenges:

1. **Key Size**: PQC keys are 10-100x larger than traditional keys
2. **Algorithm Complexity**: Requires specialized implementations
3. **Transition Period**: Must support hybrid classical/quantum-resistant schemes
4. **Key Lifecycle**: Generation, storage, rotation, and deletion at scale
5. **Compliance**: FIPS certification lags behind NIST standards

**Market Gap**: No production-ready, TEE-backed, post-quantum KMaaS exists today.