Post-quantum encryption: the complete guide to protecting your databases (2026)

Post-quantum encryption (post-quantum cryptography, often shortened to PQC) means algorithms designed to resist quantum computers. They run on today's computers, with no special hardware. Their job: replace, or rather complement, the mechanisms that Shor's algorithm will be able to break.

This guide explains what is at risk, which standards to use, why you should act now, and how to concretely protect the data in a database.

What quantum computers actually threaten

Modern encryption combines two building blocks. A symmetric cipher such as AES encrypts the data. A public-key mechanism such as RSA or elliptic curves (ECDH, X25519) exchanges or protects the key used for encryption.

A large enough quantum computer would break the second block: RSA and elliptic curves rely on math problems (factoring, discrete logarithms) that Shor's algorithm solves efficiently. AES-256 stays strong. But once the attacker has the key, everything else falls.

Why act now: harvest now, decrypt later

Quantum computers able to break RSA don't exist yet. But encrypted data can be copied today, stored, and decrypted in a few years. Security agencies call this threat "harvest now, decrypt later".

So the question isn't "when will quantum arrive?" but "how long must my data stay secret?". Medical records, contracts, HR or banking data often have to stay confidential for 10 to 30 years. If that period, plus the time needed to migrate, goes beyond the arrival of quantum computers, the data is already exposed (that's Mosca's inequality, which our Lab computes for you).

The official deadlines

• August 2024: NIST publishes the first post-quantum standards, including FIPS 203 (ML-KEM).
• June 2025: the EU coordinated roadmap asks member states to start the transition by the end of 2026, protect high-risk use cases by the end of 2030, and migrate as much as possible by 2035.
• NIST plans to deprecate RSA and elliptic curves from 2030 and disallow them by 2035 for US federal systems.
• In France, ANSSI recommends a hybrid approach: combining a proven classical algorithm with a post-quantum one during the transition.

The standards to know

• ML-KEM (FIPS 203), derived from CRYSTALS-Kyber: post-quantum key encapsulation. It protects the keys. ML-KEM-768 is the most widely used level.
• ML-DSA (FIPS 204) and SLH-DSA (FIPS 205): post-quantum digital signatures.
• HQC: selected by NIST in 2025 as a backup key encapsulation algorithm, built on different mathematics.
• AES-256-GCM: still the right choice to encrypt the data itself.

Hybrid encryption: today's best practice

Post-quantum algorithms are recent. To lose nothing during the transition, they are combined with a classical algorithm: for instance X25519 and ML-KEM-768, whose two secrets are mixed by a key derivation function (HKDF). To recover the key, an attacker would have to break both. If a weakness were found in one, the other still protects the data.

It's the approach recommended by France's ANSSI and Germany's BSI, and the one browsers and major online services already deploy for their connections.

What about databases?

Connections (TLS) get upgraded by browsers and servers. Stored data, however, stays encrypted with yesterday's keys until someone acts: it's often the forgotten part. The most effective method is field-level encryption:

• only the sensitive columns are encrypted (e-mail, phone, IBAN, social security number…), with AES-256-GCM;
• the data key is itself protected by a hybrid X25519 + ML-KEM-768 key exchange;
• each value is bound to its table, column and row: copied elsewhere, it no longer decrypts;
• a fingerprint (blind index) still allows exact lookups, such as an e-mail at login, without decrypting;
• a stolen backup or direct SQL access only yields unreadable text.

Where to start: 5 steps

• 1. Inventory: where is your sensitive data, and which cryptography do you use today?
• 2. Classification: how long must each kind of data stay confidential?
• 3. Priorities: start with the data that must stay secret the longest.
• 4. Pilot: encrypt a first table, check the application still works, measure performance.
• 5. Rollout and agility: extend to other tables and keep the ability to change algorithms (key rotation).

Mistakes to avoid

• Inventing your own cryptography: only use standardized algorithms and recognized implementations.
• Waiting for quantum computers to arrive: data copied today will be decrypted tomorrow.
• Encrypting without a key backup plan: without the keys, the data is lost.
• Believing in "100% secure": post-quantum encryption protects stored data, not a compromised application server.

The best time to protect data from quantum computers is before anyone has copied it.

Want to know where you stand? Measure your exposure in the QuorVault Lab, or request a post-quantum diagnostic: inventory, sensitive data map and a written migration plan.