Quantum-Safe vs Quantum-Resistant vs Post-Quantum: What the Terms Mean
Three overlapping labels, how their scope changes with context, and why post-quantum cryptography differs from quantum cryptography.
3 overlapping terms · 1 common mix-up (post-quantum is not quantum cryptography) · which term to use when.
“Quantum-safe,” “quantum-resistant,” and “post-quantum” are often used interchangeably, and when the subject is classical cryptographic algorithms, they usually do point at the same thing. The trouble starts when the words stretch past that, or get confused with quantum cryptography. This guide defines each term, lays them side by side, says which to use, and clears up the mix-ups. For the technology itself, see the plain-English guide to post-quantum cryptography.
1. The one idea
When discussing classical cryptographic algorithms, “post-quantum,” “quantum-resistant,” and “quantum-safe” are often used as synonyms. NIST equates post-quantum and quantum-resistant cryptography, and other terminology documents recognize quantum-safe as well. In more general security discussions, though, “quantum-safe” can cover more, including suitable symmetric encryption or quantum key distribution.
A common source of confusion is mixing up post-quantum cryptography and quantum cryptography. PQC doesn’t require quantum hardware; it uses classical algorithms designed to resist quantum adversaries. Quantum cryptography uses quantum states or operations within the protocol (Section 5).
2. The three near-synonyms
- Post-quantum cryptography (PQC) is the precise term and the one the standards bodies use. NIST ran its standardization process under this name. These algorithms run on ordinary computers, not quantum hardware, and some approaches are decades old, from code-based cryptography (McEliece, 1978) to established hash-based signatures.
- Quantum-resistant points at the same algorithms and emphasizes the property: resistance is a security claim made under stated assumptions. The strength of the evidence behind it varies a great deal between an early proposal and a thoroughly reviewed, standardized scheme.
- Quantum-safe points at the same algorithms in most writing, but it stretches the most out of the three. In wider usage, such as ETSI’s, it can also cover suitable symmetric cryptography and physics-based key establishment, including QKD.
3. The terms side by side
| Term | What it refers to | Who uses it | Shade of meaning |
| Post-quantum cryptography (PQC) | Classical algorithms designed to resist both classical and quantum attacks | NIST, IETF, academia | Established technical term describing the intended security, including when a scheme is later broken |
| Quantum-resistant | The same algorithms | NIST, NSA, vendors | Emphasizes a security claim, not a proof of immunity |
| Quantum-safe | Often PQC; sometimes a broader category of quantum-resistant security approaches | ETSI, many vendors | Umbrella label whose scope depends on context |
| Quantum-secure | Security against quantum adversaries under stated assumptions and an attack model | Cryptographic researchers; also vendors | Legitimate terminology, but the claimed security property needs explanation |
| Quantum cryptography | Cryptographic protocols that use quantum states or operations | Quantum-information researchers, industry | A broader field that includes QKD |
| Quantum key distribution (QKD) | Establishing shared secret keys using quantum signals | Researchers, telecom operators, equipment vendors | One quantum-cryptographic application, distinct from PQC |
4. Which term to use
- Precision or standards work: per the relevant NIST standard, “post-quantum cryptography (PQC)” is the least ambiguous choice.
- Use among a general or crypto audience, about the algorithms: “quantum-resistant” or “quantum-safe” are fine and widely understood, used interchangeably with PQC.
- On absolute language: claims such as “unbreakable” or “immune to all quantum attacks” should be avoided. “Quantum-secure” is legitimate technical language, but the security assumptions and attack model should be explained when used. “Quantum-proof” should be used cautiously, because it can suggest a guarantee the evidence doesn’t establish.
RFC 9794, the IETF’s terminology document, recognizes all three names. It notes that some prefer “post-quantum” because an algorithm may keep that classification even after an attack defeats its intended security, whereas “quantum-resistant” or “quantum-safe” could then sound misleading. Others prefer those terms because they state the security goal explicitly. Using PQC in this guide is an editorial choice, not the only correct one.
5. The mix-ups worth clearing up
- Post-quantum cryptography is different from quantum cryptography. PQC uses classical computation to provide cryptographic functions designed to resist quantum attacks. Quantum cryptography uses quantum states or operations as part of its protocols. QKD is one example: it establishes shared secret keys using quantum signals and specialized equipment, and the wider field also includes quantum digital signatures and quantum secret sharing. QKD doesn’t replace public-key signatures and still requires authenticating the communicating parties, which the NSA identifies as something QKD doesn’t supply on its own.
- Quantum resistance is a security claim under stated assumptions. Some schemes have proofs connecting their security to mathematical problems believed to be hard for quantum computers. That doesn’t prove those problems will stay hard, or that every implementation is sound. The algorithm, its parameters, and its implementation all still need scrutiny. Candidates in NIST’s post-quantum standardization process, including Rainbow and SIKE, suffered classical attacks, so being designed to resist quantum attacks doesn’t by itself establish security against classical ones.
- “Post-quantum” doesn’t mean deployment waits for quantum computers. Migration can begin now. Malicious actors could capture encrypted information today to decrypt it later, whereas an exposed public signing key presents a different future risk: forgery, if the corresponding private key becomes recoverable and still authorizes actions.
- A product that calls itself “quantum-safe” is making a claim to verify, not stating a fact. This is most relevant for coins and wallets; which cryptocurrencies are quantum-resistant shows how to check a claim rather than take the label at face value.
6. Bottom line
For classical algorithms, the three should be used interchangeably in plain writing, “post-quantum cryptography” should be reached for when precision matters, and absolute language like “quantum-proof” and “unbreakable” should be kept out of it. Above all, post-quantum cryptography and quantum cryptography should be kept separate: one is classical algorithms that replace today’s vulnerable ones, the other uses quantum states or operations within the protocol. The labels are manageable once you know they’re mostly the same word wearing different coats, with a few that carry more scope than they look.
Sources
- NIST IR 8105, Report on Post-Quantum Cryptography (equates post-quantum and quantum-resistant): csrc.nist.gov
- NSA, Quantum Computing and Post-Quantum Cryptography FAQ (treats the terms as synonyms; QKD authentication limit): media.defense.gov
- IETF RFC 9794, Terminology for Post-Quantum Traditional Hybrid Schemes: rfc-editor.org
- ETSI, Quantum Safe Cryptography and Security white paper (broader use of “quantum-safe”): portal.etsi.org
- Boneh and Zhandry, Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World (use of “quantum-secure”): eprint.iacr.org
Keep going
New to this? Start with Post-Quantum Cryptography: A Plain-English Guide
Continue the series:
- What Is Quantum Key Distribution? The No-Math Version
- Which Cryptocurrencies Are Quantum-Resistant?
- NIST’s PQC Standards, Explained
Browse all post-quantum cryptography guides.
This article is educational and does not constitute security or investment advice.