In plain language

Post-quantum cryptography, simply explained

No technical knowledge needed. If you understand locks and keys, you can understand this.

First, what is "cryptography"?

Cryptography is the maths that keeps digital information secret and trustworthy. It is a kind of digital lock.

Every time you use online banking, pay by card or send a message, invisible locks scramble your information so only the right person can read it. Digital locks also act as signatures, proving that a payment instruction really came from you and was not changed along the way.

So what is the problem?

Scientists are building a new kind of computer, called a quantum computer. Once they are powerful enough, they will be able to open the digital locks that almost everyone uses today, like a master key that fits every door.

Nobody knows exactly when that will happen. It might be years away. But there are two reasons banks cannot wait.

Thieves are copying locked letters today. Someone can record scrambled information now, put it in a drawer, and open it once they have the master key. Bank records that must stay private for ten years or more are already at risk.
Changing the locks takes a very long time. A big international bank has millions of these locks, in thousands of computer systems, in dozens of countries. Changing them all can take ten years.

Is there a fix?

Yes. Experts have designed new locks that quantum computers cannot open. They are called post-quantum cryptography, which simply means "locks for after quantum computers arrive". The new designs were officially published in 2024 and are already built into many everyday products.

The job now is to change the old locks for the new ones. Regulators, the government bodies that supervise banks, in Japan, Europe, the United States, the United Kingdom, Singapore, Australia and elsewhere, are now asking banks to show that they are doing exactly that, mostly with a target of the early-to-mid 2030s.

The expensive way and the sensible way

Picture a bank as a huge company with thousands of buildings around the world, each full of doors.

The expensive way

Hire people to walk every building with a clipboard, counting locks by hand. Do it again for each country's inspector. Then rip out every lock on the same day, even on doors due to be replaced next year anyway.

The sensible way

Use a machine that finds every lock automatically and keeps the list up to date. Change the most important locks first. Change the rest when doors are being replaced anyway. Run a central key office so future changes are quick.

The sensible way, step by step

Find every lock. Special software searches all the bank's systems and makes a list of every digital lock: where it is, what kind it is and what it protects. It keeps the list up to date by itself. You cannot change locks you do not know about, and regulators ask for this list first.
Change the most important locks first. Locks guarding secrets that must stay private for many years, and the "master signatures" that everything else relies on, go to the front of the queue.
Change the rest when you would anyway. Computers and equipment are replaced every few years. If every new purchase must come with the new locks, much of the work happens for no extra cost.
Put a new outer door on what you cannot change. Some very old systems are hard to touch. Instead of rebuilding them, put a quantum-safe outer layer around the information going in and out.
Run a central key office. A second piece of software looks after all the keys from start to finish: making them, replacing them on time and retiring old ones. Next time locks need changing, it is a simple instruction, not a ten-year project.

In one sentence: let machines find every lock, change the important ones first, change the rest when you are replacing things anyway, and keep a central key office so you never have to start from scratch again.

Why is this the cheap way to satisfy regulators?

One list serves every country. Regulators in different countries ask for similar things. One automatic, always-current list can answer all of them, instead of a separate effort for each.
No paying twice. Equipment is replaced when it was due anyway, not early.
Suppliers do part of the work. Requiring the new locks in contracts means product makers build them in, sharing the cost across all their customers.
The proof creates itself. Because the software keeps records automatically, showing progress to inspectors takes days, not weeks.
The key office pays for itself. It also prevents the embarrassing outages that happen when digital keys expire unnoticed, a problem banks already have today.

The words, in one place

Cryptography: The maths behind digital locks and signatures.
Quantum computer: A new type of computer that, once powerful enough, could open today's digital locks.
Post-quantum cryptography: New digital locks designed so that quantum computers cannot open them.
Inventory: The list of every digital lock a company uses and what each one protects.
Lifecycle management: Looking after digital keys from start to finish: making, renewing, replacing and retiring them.
Regulator: The government body that supervises banks and checks they follow the rules.

Want the full detail? Read the in-depth version.