Glossary
Post-quantum vocabulary, defined.
44 terms across post-quantum cryptography, quantum computing, blockchain and migration planning. Each one has its own page.
- Address reuse
- Receiving funds repeatedly at an address that has already spent. Because the first spend publishes the public key, every later balance at that address sits behind an already-exposed key.
- AESAdvanced Encryption Standard
- The standard symmetric block cipher used for bulk encryption. AES is not broken by quantum computers: Grover's algorithm gives only a square-root speedup, so AES-256 remains secure and AES-128 remains adequate for most uses.
- BIP-360P2QRH
- A Bitcoin Improvement Proposal defining a quantum-resistant output type, sometimes called Pay to Quantum Resistant Hash. It is a proposal under discussion, not an activated consensus rule.
- CNSA 2.0Commercial National Security Algorithm Suite 2.0
- The NSA's post-quantum algorithm suite and transition timeline for US national-security systems, built around ML-KEM and ML-DSA. Its dates are widely used as a pacing signal even by organisations it does not bind.
- Cryptographic agilitycrypto-agility
- The ability to change cryptographic algorithms, parameters or libraries without redesigning the systems that depend on them. Agility is what turns the next migration from a rewrite into a configuration change.
- Cryptographically relevant quantum computerCRQC
- A hypothetical quantum computer large and stable enough to break deployed public-key cryptography — meaning millions of physical qubits supporting thousands of stable logical qubits. No such machine exists publicly today.
- Cryptography inventoryCBOM
- A structured record of every algorithm, key, certificate, protocol, library and vendor dependency in an organisation. It is the mandatory first step of a post-quantum migration, because you cannot replace what you cannot enumerate.
- Digital signature
- A value that proves a message was produced by the holder of a particular private key and has not been altered since. Signatures provide authenticity and integrity, not confidentiality.
- ECDSAElliptic Curve Digital Signature Algorithm
- The signature scheme used by Bitcoin, Ethereum and most blockchains, based on elliptic curves such as secp256k1. It is not post-quantum: Shor's algorithm would recover the private key from an exposed public key.
- Ed25519
- A fast elliptic-curve signature scheme used by Solana, IOTA and many modern systems. Like ECDSA it is classical, so it offers no protection against a cryptographically relevant quantum computer.
- FIPS 203, 204 and 205
- The three post-quantum standards NIST finalised in August 2024: FIPS 203 (ML-KEM) for key establishment, FIPS 204 (ML-DSA) for general-purpose signatures, and FIPS 205 (SLH-DSA) for hash-based signatures.
- FN-DSAFalcon, expected FIPS 206
- A lattice-based post-quantum signature scheme selected by NIST for standardisation, valued for signatures substantially smaller than ML-DSA. Implementation is harder because it relies on floating-point Gaussian sampling.
- Grover's algorithm
- A quantum search algorithm that finds an item in an unstructured set of N in roughly √N steps. Against symmetric cryptography this halves effective key strength — a nuisance answered by doubling key sizes, not a break.
- Harvest now, decrypt laterHNDL
- The practice of recording encrypted traffic today in order to decrypt it once a quantum computer becomes available. It is the one quantum risk already in progress, and it makes long-life confidential data the first migration priority.
- Hash-based signature
- A signature scheme built only from hash functions, with no number-theoretic or lattice assumptions. Security reduces to the collision and preimage resistance of the hash, which is unusually well understood.
- Hybrid cryptography
- Combining a classical algorithm with a post-quantum one so the result stays secure as long as either component holds. It hedges against both a future quantum attack and an undiscovered flaw in the newer post-quantum scheme.
- Key encapsulation mechanismKEM
- A construction for securely establishing a shared symmetric key: the sender encapsulates a random secret under the recipient's public key, and the recipient decapsulates it with their private key. Both then hold the same secret.
- Logical qubit
- An error-corrected qubit assembled from many noisy physical qubits. Logical qubits are the meaningful unit for cryptographic threat estimates, and current ratios run from hundreds to thousands of physical qubits per logical one.
- ML-DSAFIPS 204, formerly CRYSTALS-Dilithium
- The NIST-standardised lattice-based digital signature algorithm, intended as the general-purpose post-quantum replacement for RSA-PSS and ECDSA. Signatures are larger than ECDSA but performance is practical for most uses.
- ML-KEMFIPS 203, formerly CRYSTALS-Kyber
- The NIST-standardised post-quantum key encapsulation mechanism, used to establish a shared secret over an untrusted network. It is the replacement for RSA key transport and elliptic-curve Diffie-Hellman.
- Mosca's theorem
- A planning rule stating that you have a problem if the time your data must stay secret, plus the time your migration takes, exceeds the time until a cryptographically relevant quantum computer arrives.
- NIST IR 8547
- NIST's report on transitioning to post-quantum standards, which proposes deprecating RSA-2048 and ECDSA-P256 by 2030 and disallowing them by 2035. It is the clearest published deadline for retiring classical public-key cryptography.
- P2PKPay to Public Key
- The earliest Bitcoin output type, which places the raw public key directly in the script. P2PK outputs expose their public key from the moment they are funded, making them the most quantum-exposed coins on the network.
- P2PKHPay to Public Key Hash
- The legacy Bitcoin address type beginning with 1, which locks funds to the hash of a public key rather than the key itself. An unspent P2PKH output does not reveal its public key.
- Post-quantum cryptographyPQC
- Cryptographic algorithms designed to resist attacks by both classical and quantum computers. PQC runs on ordinary hardware today — it is not quantum technology, it is classical maths chosen because no efficient quantum attack against it is known.
- Proof-of-work
- A consensus mechanism where miners expend computation to add blocks. Quantum computers threaten blockchain signatures rather than proof-of-work — Grover's algorithm offers only a modest mining advantage, not a break.
- Public-key cryptographyasymmetric cryptography
- Cryptography using a mathematically linked key pair: a public key that can be shared, and a private key that must not be. It is the part of modern cryptography that quantum computers threaten most directly.
- Public-key exposure
- Whether an address's full public key is visible on-chain. Exposure matters because quantum risk to a wallet begins only once the public key is published — before that, an attacker sees just a hash.
- Q-Day
- Informal shorthand for the day a cryptographically relevant quantum computer becomes available. It is a planning device rather than a forecast — the useful question is whether your migration finishes before it, not when it lands.
- Quantum entanglement
- A correlation between quantum systems such that the state of one cannot be described independently of the other, regardless of distance. It is a resource for quantum algorithms and for quantum key distribution.
- Quantum error correction
- Techniques that protect quantum information from noise by spreading one logical qubit across many physical ones. It is the central engineering obstacle between today's machines and a cryptographically relevant one.
- Quantum key distributionQKD
- A method of exchanging keys using quantum physics, where eavesdropping disturbs the transmission detectably. QKD needs dedicated hardware and links, and is not a substitute for post-quantum cryptography — the NSA does not recommend it for national-security systems.
- Qubit
- The basic unit of quantum information, able to hold a superposition of 0 and 1 rather than one definite value. Physical qubits are noisy; useful computation needs many of them combined into error-corrected logical qubits.
- SegWitSegregated Witness
- A Bitcoin upgrade that moves signature data outside the transaction body, enabling lower fees and address types beginning with bc1q. From a quantum standpoint SegWit behaves like P2PKH — the public key appears on first spend.
- SHA-256
- A 256-bit cryptographic hash function used for integrity, commitments and Bitcoin's proof-of-work. Like AES, it is weakened but not broken by quantum computing — Grover's algorithm reduces collision-finding effort quadratically, which larger outputs absorb.
- Shor's algorithm
- A quantum algorithm that factors large integers and computes discrete logarithms in polynomial time. It is the specific reason RSA, Diffie-Hellman and elliptic-curve cryptography would fail against a sufficiently large quantum computer.
- SLH-DSAFIPS 205, formerly SPHINCS+
- A stateless hash-based post-quantum signature scheme whose security depends only on the strength of its underlying hash function. Signatures are large and slow, but the security assumptions are the most conservative of the NIST signature standards.
- Soft fork
- A backwards-compatible consensus change where upgraded nodes enforce stricter rules and old nodes still accept the chain. A post-quantum signature scheme would most plausibly reach Bitcoin as a soft fork.
- Stateful signature
- A hash-based signature scheme that must track which one-time keys it has already used. Reusing a key catastrophically leaks the private key, which makes backups, replication and failover genuinely dangerous.
- Superposition
- The property that lets a quantum system hold a combination of states at once. Superposition alone does not make quantum computers fast — the speedups come from interference that amplifies correct answers.
- Symmetric cryptography
- Cryptography where the same secret key both encrypts and decrypts. It is far less affected by quantum computing than public-key cryptography — Grover's algorithm only halves the effective key strength.
- Taproot
- A Bitcoin upgrade introducing bc1p addresses and Schnorr signatures. Taproot key-path spends place a public key in the output, so a funded Taproot address exposes a key earlier than a comparable P2PKH address.
- TLSTransport Layer Security
- The protocol securing most internet traffic. TLS is the furthest-advanced post-quantum migration in practice: hybrid key exchange combining X25519 with ML-KEM-768 is already enabled by default across major browsers and CDNs.
- UTXOUnspent Transaction Output
- A discrete chunk of spendable bitcoin. Bitcoin balances are the sum of a wallet's UTXOs, and quantum exposure is a property of individual UTXOs rather than of a wallet as a whole.
44 of 44 terms
FAQ
Frequently asked questions
What does PQC stand for?
PQC stands for post-quantum cryptography — classical algorithms (running on ordinary computers) designed to remain secure against attackers with a large quantum computer. NIST standardized the first PQC algorithms (ML-KEM, ML-DSA, SLH-DSA) in 2024.
What is the difference between quantum cryptography and post-quantum cryptography?
Quantum cryptography (e.g., QKD, quantum key distribution) uses quantum physics to secure communications and requires specialized hardware. Post-quantum cryptography runs on classical computers and is drop-in-replaceable for RSA and ECC. The two are distinct fields.
What is crypto-agility?
Crypto-agility is the ability to change cryptographic algorithms, key sizes, or parameters in a system without rewriting the application. It is the prerequisite for a smooth PQC migration and is a top recommendation from NIST NCCoE.