The vocabulary used across the map, timeline, standards and technology records — defined the way the observatory uses it, with links to the records each term labels.
The NIST-standardised key-establishment algorithm (FIPS 203, derived from CRYSTALS-Kyber) that replaces classical key agreement such as ECDH for protecting confidentiality.
ML-KEM is the primitive behind hybrid TLS key exchange and most cloud key-establishment roadmaps. It protects data in transit today against harvest-now-decrypt-later collection.
The NIST-standardised signature algorithm (FIPS 204, derived from CRYSTALS-Dilithium) intended as the default post-quantum signature for certificates, code signing and token signing.
Signatures depend on surrounding formats — X.509, CMS, JOSE/COSE — so ML-DSA support in a library is not the same as support across a certificate chain.
The NIST-standardised hash-based signature scheme (FIPS 205, derived from SPHINCS+) that trades signature size and speed for very conservative security assumptions.
Often chosen for firmware signing and roots of trust, where longevity matters more than signature size.
A code-based key-encapsulation mechanism selected by NIST in March 2025 as a backup to ML-KEM, so that a future break of lattice mathematics would not leave key establishment without an option.
Running a classical algorithm (such as X25519) and a post-quantum one (such as ML-KEM) together, so the session stays secure unless both are broken.
Hybrid is the deployed default in most browsers and CDNs today, and is what most published migration guidance asks for first.
Cryptography that runs on ordinary computers but is designed to resist attack by a large quantum computer. It is not quantum cryptography or quantum key distribution.
The three US federal standards published on 13 August 2024 that define ML-KEM, ML-DSA and SLH-DSA. They are the reference point most national roadmaps cite.
The NSA's algorithm suite and timetable for US national security systems, which sets earlier deadlines than civilian federal guidance for categories such as firmware signing.
A quantum computer large and reliable enough to break deployed public-key cryptography such as RSA-2048 or ECC P-256. No published experiment has demonstrated one.
An error-corrected qubit assembled from many physical qubits. Attack estimates are counted in logical qubits, which is why raw physical-qubit counts overstate progress.
A single hardware qubit, noisy on its own. Current machines report thousands at most, while error correction can consume hundreds or thousands of them per logical qubit.
Running a computation reliably despite hardware errors, by correcting faster than they accumulate. It is the threshold that separates today's demonstrations from cryptanalysis.
The quantum algorithm that would break RSA and elliptic-curve cryptography by factoring integers and solving discrete logarithms efficiently — given a fault-tolerant machine at scale.
A quantum search algorithm that weakens symmetric cryptography and hashes far less dramatically than Shor's does public key. In practice it motivates AES-256 rather than replacement.
The ability to change cryptographic algorithms in a system without redesigning or replacing it — usually through configuration, negotiated protocols and abstracted key handling.
Regulators increasingly ask for agility as an outcome, because the current migration will not be the last one.
A machine-readable inventory of the algorithms, key sizes, certificates and libraries a system uses. It is the usual first deliverable in published migration mandates.
Capturing encrypted traffic today to decrypt it once a capable quantum computer exists. It is why data with a long confidentiality lifetime is migrated first, ahead of any hardware milestone.
A planning rule: if the years your data must stay secret plus the years your migration takes exceed the years until a capable quantum computer arrives, you are already late.
How CRQC labels the strength of a source, from A1 for a primary official document to E for an unverified claim. Every record on the site carries one.
Whether a document creates a legal obligation, sets a procurement baseline, or is only guidance. Deadlines from a mandate and dates in advice are never merged here.
A summary of publicly observable preparation for a jurisdiction. A high band does not mean safe; a low band may simply mean thin public documentation.
The real publication state of a source — draft, proposed, adopted, final, effective, superseded or withdrawn — kept separate from what the document proposes to do.
Definitions describe how CRQC labels evidence. For the rules behind bands, statuses and evidence classes, see the methodology.
