In the summer of 2022, two researchers in Belgium broke one of the most promising new encryption methods in the world. It had survived years of review by cryptographers around the globe. It took them about 62 minutes, on a single core of a desktop processor released in 2013.

The method, called SIKE, was one of the last candidates still standing in a competition run out of the National Institute of Standards and Technology (NIST) in Gaithersburg, Maryland. Its collapse was a setback for its designers, but for the competition it was a sign that the process was working.

That process was led by Dustin Moody, a NIST mathematician who heads the agency's Post-Quantum Cryptography project. His team's job has been to answer a question that sounds like science fiction but is now a matter of federal policy: how do you protect the world's data from a computer that does not fully exist yet?

A job posting with his name on it

Moody did not set out to secure the internet. He was drawn to math, and in particular to elliptic curves, a family of equations studied by number theorists. "Elliptic curves were fascinating to me," he said on a 2021 episode of a cybersecurity podcast from the company Forcepoint. He was delighted to learn that this abstract math also had a practical use. Elliptic curves sit underneath much of the encryption that protects online banking and messaging.

He finished his PhD at the University of Washington in 2009, when academic jobs were scarce. Then he spotted a NIST posting for a cryptography specialist. As he recalled on the podcast, he thought, "they're looking for someone that's exactly like me." He got the job.

The quantum problem

Most of the internet's security relies on public-key cryptography, which lets two strangers set up a secret connection without meeting first. Its common forms, RSA and elliptic-curve cryptography, are built on math problems that ordinary computers cannot solve in any reasonable amount of time.

A large enough quantum computer could. Quantum computers use the strange rules of quantum physics to perform certain calculations far faster than classical machines, and one of those calculations is exactly the kind needed to break RSA and elliptic curves. One twist: the math Moody loved as a student is part of what quantum computers threaten.

"Quantum computers, let me be clear, don't break all the encryption algorithms that we have today," Moody said on a 2023 episode of the same podcast. Symmetric encryption, which scrambles the data itself, mostly just needs longer keys. The weak point is the public-key handshake that starts almost every secure connection.

No one knows when such a machine will arrive. Moody said in 2023 that estimates put it "probably a decade, 15 years, something like that" away. But there is a reason not to wait. An adversary can record encrypted traffic today and store it until a quantum computer can read it. For medical records, state secrets or anything else that has to stay private for decades, the threat has already started.

An open competition

In 2016, NIST asked cryptographers around the world to submit replacement algorithms built on math that quantum computers are not expected to crack. It received 82 submissions from 25 countries.

The competition worked by public attack. "We posted all of the specifications online," Moody said on the podcast. Researchers anywhere could try to break the entries, and every round removed the weakest. "We would kill off the ones that had been broken or attacked," he said. SIKE's fall in 2022 was the system doing what it was designed to do.

In August 2024, NIST published its first three finished standards. One, called ML-KEM, handles general encryption. The other two, ML-DSA and SLH-DSA, create digital signatures, which prove a message or software update really came from who it claims. In March 2025, NIST added a fifth algorithm, HQC, as a backup to ML-KEM. HQC is based on a different kind of math, so a single mathematical breakthrough could not take down both. "It's essential to have a fallback in case ML-KEM proves to be vulnerable," Moody said. NIST planned to release a draft HQC standard about a year after that announcement, with a final version expected in 2027.

The hard part is next

Picking the algorithms took eight years. Replacing the old ones may take longer. Encryption is built into web browsers, phones, banks, power grids, cars and medical devices, and much of it was never designed to be swapped out.

NIST has put dates on the transition. Under draft guidance released in late 2024, widely used versions of RSA and elliptic-curve cryptography would be deprecated by 2030 and fully disallowed for federal use by 2035, according to a summary from the security firm Sectigo. In 2023, Moody said the hope was for as many federal government systems as possible to migrate by 2035.

That is why, when the first standards came out in 2024, Moody's message was about urgency more than math. "We encourage system administrators to start integrating them into their systems immediately," he said. "There is no need to wait for future standards. Go ahead and start using these three."