Post-quantum cryptography

Where to read it

I wrote an article on post-quantum cryptography over at Cherith Analytics: Post-quantum cryptography for ministries with secrets. It is the second issue of the Field Notes series. What follows is the executive summary; the argument, the numbers, and the reasoning behind each algorithm choice are all in the article itself.

The argument

Organizations that hold long-lived secrets must migrate to post-quantum cryptography now.

Harvest now, decrypt later: A state-level adversary does not need a quantum computer today to defeat your encryption today. Traffic recorded now sits in an archive until the machine that breaks it exists, and then every message in the archive can be decrypted. The relevant question is therefore never “when will quantum computers arrive?” but “how long must this secret hold?” Secrets must remain confidential across the entire span of time in which plausible quantum computation becomes available. Data like a source’s identity requires a span measured in decades. I propose a thirty year planning horizon.¹

What the article covers

The piece walks through the five primitives every real system depends on—symmetric encryption, asymmetric encryption, key agreement, pseudorandom functions, and message authentication codes—and then documents the algorithm choices in Issachar, a post-quantum library built for exactly this threat model. The through-line is conservatism under uncertainty:

1. Three key encapsulation mechanisms, chosen by trust model: ML-KEM-1024 where speed matters and keys are ephemeral; FrodoKEM-1344-AES where unstructured lattices are worth the size penalty; and Classic McEliece-8192128f for static identity keys, because its security rests on coding theory rather than lattices and therefore fails independently of the others.
2. Two signature schemes: ML-DSA-87 by default, with SPHINCS+-SHA2-256f as the conservative alternative—larger signatures, but its security reduces entirely to SHA-256.
3. Level 5, everywhere, always: every algorithm is fixed at the highest NIST security level and none of it is configurable. Misconfiguration is a more likely failure mode than cryptanalysis, so there are no knobs to get wrong.

The diversity is deliberate. ML-KEM and ML-DSA became NIST standards in 2024 after about ten years of public review—a genuinely short cryptanalytic history next to RSA and the elliptic curves. They are almost certainly fine. This is an extremely paranoid “belt and suspenders” approach that (I hope) is one day proven to be totally excessive.