Glossary.

The quantum threat

Post-quantum cryptography (PQC)#

Public-key cryptography designed to remain secure against an attacker with a quantum computer, while running on today’s classical hardware. The main families are lattice-based, hash-based, code-based and multivariate schemes. NIST published the first standards in 2024 (FIPS 203, 204 and 205).

Cryptographically relevant quantum computer (CRQC)#

A quantum computer large and reliable enough to run Shor’s algorithm against the key sizes used in practice. None exists today; migration plans are built around the uncertainty of when one will.

Shor’s algorithm#

A quantum algorithm (1994) that factors integers and computes discrete logarithms in polynomial time. It breaks RSA, finite-field Diffie-Hellman and elliptic-curve cryptography once a CRQC exists.

Grover’s algorithm#

A quantum search algorithm that gives at most a quadratic speed-up on brute-force key search. It weakens symmetric ciphers and hash functions only moderately; 256-bit keys keep a comfortable margin.

Harvest now, decrypt later (HNDL)#

Recording encrypted traffic today to decrypt it once a CRQC exists. It makes key exchange the urgent part of the migration for data that must stay confidential for years. See the FAQ.

Mosca’s inequality#

If data must stay confidential for x years, migration takes y years, and a CRQC arrives in z years, the data is exposed when x + y > z. Proposed by Michele Mosca to reason about when to start migrating.

Lattices and standards

Lattice-based cryptography#

Cryptography whose security rests on hard problems over lattices, such as Learning With Errors and the Shortest Vector Problem. ML-KEM and ML-DSA are lattice-based.

Learning With Errors (LWE)#

Recovering a secret vector s from noisy linear equations b = A·s + e mod q, where e is a small random error. Introduced by Oded Regev in 2005, with a quantum reduction from worst-case lattice problems. See machine learning against LWE.

Module Learning With Errors (MLWE)#

A structured variant of LWE over module lattices (vectors of polynomials), which gives smaller keys and faster operations. ML-KEM is built on MLWE; ML-DSA on MLWE and its signature counterpart, Module-SIS.

Shortest Vector Problem (SVP)#

Finding the shortest non-zero vector in a lattice. Its approximate versions underlie the hardness of lattice-based cryptography, and attacks on LWE reduce to solving them.

Lattice reduction and BKZ#

Algorithms that transform a lattice basis into one with shorter, more orthogonal vectors. BKZ (block Korkine-Zolotarev) is the standard tool; its block size largely determines the cost of attacks on LWE.

ML-KEM (FIPS 203)#

The NIST standard for post-quantum key encapsulation, derived from CRYSTALS-Kyber and based on MLWE. It comes in three parameter sets, ML-KEM-512, ML-KEM-768 and ML-KEM-1024; an ML-KEM-768 public key is 1,184 bytes and its ciphertext 1,088 bytes.

ML-DSA (FIPS 204)#

The NIST standard for post-quantum digital signatures, derived from CRYSTALS-Dilithium. An ML-DSA-65 public key is 1,952 bytes and a signature 3,309 bytes.

SLH-DSA (FIPS 205)#

A stateless hash-based signature standard derived from SPHINCS+. Its security rests only on hash functions, at the cost of large signatures; a conservative choice for long-lived trust anchors such as firmware signing.

Hybrid key exchange#

Combining a classical key exchange (such as X25519) with a post-quantum one (ML-KEM), so that the session stays secure if either holds. X25519MLKEM768 is already enabled by default in major web browsers and content-delivery networks.

Lattice Estimator#

An open-source tool that estimates the cost, in bits, of the best known attacks against LWE and related problems. Used to choose parameters, and in AgadesEvolve as the objective evaluator. See the FAQ.

Bits of security#

A scheme has λ bits of security if the best known attack costs about 2^λ operations. Claimed levels are estimates that move as attacks improve: an attack at 2¹¹⁵ against a scheme claimed at 2¹²⁸ is a result.

Migration

Cryptographic bill of materials (CBOM)#

An inventory of cryptographic assets (algorithms, keys, certificates, protocols, libraries) and of where each one is used. Supported by CycloneDX since version 1.6; the basis of any migration plan. See building a CBOM for a device fleet.

Crypto-agility#

The ability to replace algorithms, keys and parameters without redesigning or replacing the system; for device fleets, over the air.

Telecom and IoT

Secure element#

A tamper-resistant chip that stores keys and runs cryptographic operations in isolation from the host device. SIM cards (UICC and eUICC) are secure elements.

APDU#

Application protocol data unit: the command and response format, defined in ISO/IEC 7816-4, used between a device and a smart card or SIM.

SIM Toolkit (STK)#

A standard (ETSI TS 102 223, 3GPP TS 31.111) that lets applications on the SIM request services from the device, such as sending messages or displaying menus. It gives the SIM no access to the device’s memory or firmware. See what the SIM can and cannot see.

eUICC and remote SIM provisioning#

An eUICC is an embedded SIM that receives operator profiles remotely. Profile download relies on a GSMA public-key infrastructure with elliptic-curve certificates, which is quantum-vulnerable.

SUCI#

Subscription concealed identifier: the encrypted form of the subscriber’s permanent identifier in 5G, computed with elliptic-curve ECIES. It protects privacy today but relies on quantum-vulnerable cryptography.

AI for cryptanalysis

Evolutionary program synthesis#

Generating programs by iterated variation and selection: candidates are mutated or recombined, scored by a fitness function, and the best are kept. Recent systems use language models as the mutation operator. See the research note.

AlphaEvolve#

A Google DeepMind system (2025) that evolves programs with Gemini models as mutation operators and automated evaluators as fitness functions. It inspired the design of AgadesEvolve.

MAP-Elites#

A quality-diversity algorithm that keeps an archive of the best solution found for each cell of a descriptor space, rather than a single best solution. AgadesEvolve keeps its elites in such an archive.

SALSA attacks#

A line of machine-learning attacks on LWE, from 2022 (SALSA, PICANTE, VERDE, FRESCA), that train models to recover secrets from LWE samples. They work on sparse secrets and on parameters weaker than those of standardized schemes.