When NIST finalized its first post-quantum standards in August 2024, many organizations heard a simple instruction: the algorithms are chosen, so swap them in. It sounds sensible. It also skips a question cryptographers have been careful about for years, which is how much trust a new algorithm has actually earned.
What NIST actually standardized
NIST published three standards on August 13, 2024. FIPS 203 defines ML-KEM, which lets two systems agree a shared secret over an open network, the job RSA and elliptic curve key exchange do today. FIPS 204 defines ML-DSA, a digital signature scheme for proving who you are talking to. FIPS 205 defines SLH-DSA, a second signature scheme built on hash functions rather than the lattice mathematics behind the other two.
That last one is a deliberate backup. If lattice-based schemes ever turn out to have a weakness, a standardized signature scheme exists that does not depend on them. In plain terms: one standard for agreeing secrets, two for proving identity, with redundancy built into the signature side.
Why a straight swap is a bet
Replacing classical cryptography with a post-quantum algorithm alone means trusting that algorithm completely from the first day it carries real traffic. The NIST standards have been through years of public scrutiny, and that counts for a lot. But the field has already produced a cautionary tale.
SIKE, a key exchange scheme that reached the fourth round of NIST’s evaluation, was broken in 2022 by two researchers using an ordinary classical computer. Their paper reports breaking one parameter set in about ten minutes on a single core. No quantum computer was involved.
SIKE was not ML-KEM, and its failure says nothing about the strength of the NIST standards. The lesson is narrower. Confidence in newer mathematics builds with time, and implementations (the code, as distinct from the math) carry their own risk of bugs and side channels. A straight swap puts all of your protection on something that has had less scrutiny than RSA and elliptic curves have enjoyed.
How hybrid works
A hybrid scheme runs two key exchanges at the same time: an established classical one and a post-quantum one. The secrets that come out of each are combined into a single session key, so an attacker has to break both to read the traffic.
That gives you two protections that fail independently. If a quantum computer breaks the classical half, the post-quantum half still holds. If someone finds a flaw in the post-quantum half, the classical half still holds against every attacker that exists. With a straight swap, a flaw in the new algorithm leaves nothing behind it. Hybrid keeps the classical half as a backstop while the newer mathematics earns its track record.
This matters most for data in motion that someone is capturing in order to decrypt later. It has to withstand a future quantum computer and any future cryptanalysis of the new algorithms.
The costs are real. Hybrid handshakes are larger, there are more moving parts, and the implementation has to combine the two secrets correctly. These are engineering costs, and they are the reason hybrid is easier to get right when one managed layer does it than when every application team builds it separately.
Where the agencies disagree
Governments agree that post-quantum cryptography is needed. They differ on how long the classical half should stay. The NSA’s CNSA 2.0 guidance does not require hybrid and accepts standalone ML-KEM. Germany’s BSI and France’s ANSSI recommend hybrid, ANSSI strongly. The UK’s NCSC treats hybrid as an interim measure on the road to full post-quantum adoption, and its migration timelines guidance sets out the milestones.
The practical reading is that hybrid is permitted or recommended by all four, and that the classical half may eventually be retired. So the useful design question is not hybrid or pure. It is whether you can move from one to the other without rebuilding everything. That property has a name, crypto-agility: algorithms you can select, update or retire in place, without replacing equipment or interrupting the network.
Why the network layer is the practical place to start
Applications migrate on their own schedules, tied to vendor roadmaps, release cycles and testing. Many will land well after the compliance deadlines. Cryptography applied at the managed network layer closes part of that gap without waiting for them.
That is the approach behind Loxada Quantum Secure: NIST-standard post-quantum cryptography, deployed in a hybrid model at the managed network layer, with no changes to the applications, operating systems or security tools you already run. Because the cryptography is managed centrally and built to be crypto-agile, adding or retiring an algorithm, or shifting the balance between classical and post-quantum protection, is a managed change, not a hardware swap or a project for every application team.
What it does not do
Hybrid at the network layer protects the encrypted connection between a staff device and Loxada’s secure connectivity layer. It does not replace a cryptographic inventory, and it does not protect data at rest. Once traffic leaves Loxada’s secure connectivity layer for a destination on the public internet, that final leg depends on what the destination supports.
Real readiness still needs application-level work. What the network layer does is shrink the part of the problem that cannot wait for it.
Questions to ask any vendor
- Which NIST standards does the product implement, and at which parameter sets?
- Is it hybrid, and can algorithms be selected, added or retired in place, without replacing hardware or interrupting the network?
- Exactly which links and data does it cover, and what does it leave to you?
For the deadlines and the harvest now, decrypt later background, our post-quantum readiness guide covers the ground. To talk through where Loxada Quantum Secure fits your network, get in touch with the team.
