Post-Quantum Cryptography Glossary

A class of symmetric encryption algorithms that simultaneously provide confidentiality, integrity, and authenticity of encrypted data, plus integrity of additional unencrypted associated data (such as headers or metadata). AEAD eliminates the need to separately MAC-then-encrypt or encrypt-then-MAC, reducing implementation errors. AES-256-GCM and XChaCha20-Poly1305 are the two AEAD ciphers used in QNSQY.

Advanced Encryption Standard with 256-bit keys in Galois/Counter Mode. AES-256-GCM is a NIST-approved AEAD cipher providing authenticated encryption with high throughput, especially on processors with AES-NI hardware acceleration. It is the default symmetric cipher in QNSQY across all tiers. Even under Grover's algorithm, AES-256 retains approximately 128-bit effective security, making it quantum-resistant at the symmetric level. See AES-256-GCM Explained.

A memory-hard password hashing function defined in RFC 9106 that won the Password Hashing Competition in 2015. Argon2id combines data-dependent (Argon2d) and data-independent (Argon2i) memory access patterns to resist both GPU-accelerated brute force and side-channel attacks. QNSQY uses Argon2id for all password-based key derivation with configurable memory cost presets (128 MB, 256 MB, 512 MB). See Argon2id Explained.

A cryptographic system that uses a mathematically related key pair: a public key for encryption or verification, and a private key for decryption or signing. Also called public-key cryptography. Classical asymmetric algorithms like RSA and ECC are vulnerable to Shor's algorithm, which is why post-quantum replacements such as ML-KEM and ML-DSA have been standardized.

The process of verifying the identity of a user, device, or message origin. In cryptography, authentication can be achieved through digital signatures (verifying who signed data), message authentication codes (verifying data has not been altered), or AEAD ciphers (which authenticate ciphertext during decryption). QNSQY provides authentication via hybrid ML-DSA + Ed25519 signatures and AES-256-GCM authenticated encryption.

A cryptographic hash function based on the Bao tree structure and BLAKE2 design. BLAKE3 produces 256-bit output with extreme parallelism, making it one of the fastest hash functions available. It supports keyed hashing, key derivation, and extendable output. QNSQY uses BLAKE3 for file hashing, key derivation, and integrity verification across all tiers. See BLAKE3 Hashing.

An attack that systematically tries every possible key or password until the correct one is found. The security of a cipher is measured by the number of operations required for brute force: AES-256 requires 2²⁵⁶ operations classically, or approximately 2¹²⁸ under Grover's algorithm. QNSQY mitigates password brute force with Argon2id (memory-hard, GPU-resistant) and rate limiting with lockout after repeated failures.

A trusted entity that issues digital certificates binding a public key to an identity. CAs form the backbone of Public Key Infrastructure and enable trust on the internet (TLS/SSL). As quantum computers threaten the classical signature algorithms CAs rely on, the transition to post-quantum certificates using ML-DSA or SLH-DSA is a major infrastructure challenge.

The encrypted, unreadable form of data produced by an encryption algorithm. Ciphertext can only be transformed back into readable plaintext by someone possessing the correct decryption key. In QNSQY, ciphertext includes both the encrypted file content and authenticated metadata stored in the .qs file format.

Cryptographic algorithms designed to be secure against attacks from conventional (non-quantum) computers. This includes RSA, ECC, X25519, Ed25519, and AES-256-GCM. While symmetric classical algorithms like AES remain quantum-resistant (with doubled key sizes), asymmetric classical algorithms are broken by Shor's algorithm.

A family of cryptographic constructions based on the hardness of decoding random linear error-correcting codes. Code-based schemes offer an alternative mathematical foundation to lattice-based approaches for post-quantum security. HQC is a code-based KEM selected by NIST, providing algorithm diversity alongside the lattice-based ML-KEM.

A programming technique where the execution time of an operation does not depend on the values of secret data such as keys or passwords. Constant-time code prevents side-channel attacks that measure timing differences to extract secrets. QNSQY uses constant-time comparisons for all cryptographic operations including MAC verification, password checking, and key comparison.

The study of breaking cryptographic systems by finding weaknesses in algorithms, protocols, or implementations. Cryptanalysis ranges from mathematical attacks (finding shortcuts faster than brute force) to implementation attacks (side-channel, fault injection). NIST's post-quantum standardization process subjected candidate algorithms to years of public cryptanalysis before selection.

The ability of a system to switch between cryptographic algorithms without significant redesign. Cryptographic agility is critical during the post-quantum transition: if a deployed algorithm is found to be weak, the system must be able to migrate to a replacement quickly. QNSQY supports 12+ algorithm families across multiple mathematical foundations (lattice, code-based, hash-based) to provide maximum agility.

The operation in a Key Encapsulation Mechanism where the recipient uses their private key to recover the shared secret from the ciphertext produced during encapsulation. In ML-KEM, decapsulation is the private-key operation that extracts the shared secret, which is then used to derive the symmetric encryption key.

The process of transforming ciphertext back into readable plaintext using a decryption key. In QNSQY, decryption involves decapsulating the KEM ciphertext to recover the shared secret, deriving the symmetric key via HKDF, and then decrypting the file content with AES-256-GCM. Decryption and verification are always free on all tiers.

A security strategy that layers multiple independent protective mechanisms so that the failure of any single layer does not compromise the system. In QNSQY, defense in depth is achieved through hybrid cryptography (combining post-quantum and classical algorithms), AEAD authenticated encryption, memory protection (mlock), seccomp sandboxing, and rate limiting.

A classical key exchange protocol that allows two parties to establish a shared secret over an insecure channel. The original DH protocol is based on the discrete logarithm problem, while elliptic curve variants like X25519 use ECDH. Both are vulnerable to Shor's algorithm, which is why post-quantum KEMs are replacing them.

A cryptographic primitive that provides authentication, integrity, and non-repudiation. The signer uses a private key to produce a signature; anyone with the corresponding public key can verify it. QNSQY uses hybrid signatures combining ML-DSA (post-quantum) with Ed25519 (classical) so the signature remains secure even if one algorithm is broken.

An elliptic curve digital signature algorithm using Curve25519, defined in RFC 8032. Ed25519 provides 128-bit classical security with fast, deterministic signing and compact 64-byte signatures. In QNSQY, Ed25519 serves as the classical component of hybrid signatures alongside ML-DSA. See X25519 and Ed25519 Explained.

A family of asymmetric cryptographic algorithms based on the algebraic structure of elliptic curves over finite fields. ECC provides equivalent security to RSA with much smaller key sizes. However, ECC is vulnerable to Shor's algorithm, which can solve the elliptic curve discrete logarithm problem efficiently on a quantum computer. X25519 and Ed25519 are ECC algorithms used as classical components in QNSQY's hybrid constructions.

The operation in a Key Encapsulation Mechanism where the sender uses the recipient's public key to generate a shared secret and a ciphertext. Only the recipient's private key can decapsulate the ciphertext to recover the shared secret. Encapsulation replaces the traditional key exchange handshake with a single-message operation.

The process of transforming readable plaintext into unreadable ciphertext using a cryptographic algorithm and key. Encryption can be symmetric (same key for encrypt and decrypt) or asymmetric (public key encrypts, private key decrypts). QNSQY combines both: a KEM establishes a shared secret, which derives a symmetric key for AES-256-GCM bulk encryption.

An open authentication standard developed by the FIDO Alliance that enables passwordless and multi-factor authentication using hardware security keys or platform authenticators. FIDO2 consists of WebAuthn (browser API) and CTAP2 (device protocol). Native FIDO2 / YubiKey authentication is a planned QNSQY feature and is not yet shipped. See YubiKey Integration.

The Federal Information Processing Standard published by NIST in August 2024 that specifies ML-KEM (Module-Lattice Key Encapsulation Mechanism). FIPS 203 defines three parameter sets: ML-KEM-512 (NIST Security Level 1), ML-KEM-768 (Level 3), and ML-KEM-1024 (Level 5). It is the primary standard for post-quantum key establishment. See NIST FIPS Guide.

The Federal Information Processing Standard published by NIST in August 2024 that specifies ML-DSA (Module-Lattice Digital Signature Algorithm). FIPS 204 defines three parameter sets: ML-DSA-44 (NIST Security Level 2), ML-DSA-65 (Level 3), and ML-DSA-87 (Level 5). It is the primary standard for post-quantum digital signatures. See NIST FIPS Guide.

The Federal Information Processing Standard published by NIST in August 2024 that specifies SLH-DSA (Stateless Hash-Based Digital Signature Algorithm). SLH-DSA provides signature security based entirely on hash functions with no lattice or number-theoretic assumptions, offering maximum algorithm diversity. It defines 12 parameter sets across three security levels and two optimization targets (fast vs. small).

The draft Federal Information Processing Standard from NIST that will specify FN-DSA (originally known as Falcon). FIPS 206 (draft) is not yet finalized. It defines two parameter sets: FN-DSA-512 (NIST Security Level 1) and FN-DSA-1024 (Level 5). FN-DSA offers the smallest combined signature + public key sizes among NIST PQC signature candidates but requires careful implementation of fast Fourier sampling over NTRU lattices.

Fast-Fourier Lattice-based Compact Signatures over NTRU. FN-DSA is a lattice-based digital signature algorithm selected by NIST, currently specified in the draft FIPS 206 (draft) standard (not yet finalized). It achieves compact signatures through Gaussian sampling over NTRU lattices using fast Fourier techniques. Available in QNSQY's Business tier. See FN-DSA (Falcon) Explained.

A property of key exchange protocols where the compromise of a long-term private key does not compromise past session keys. Each session generates ephemeral keys that are discarded after use, so recorded ciphertext from prior sessions remains secure even if the long-term key is later exposed. QNSQY achieves forward secrecy through ephemeral KEM key generation for each encryption operation.

A quantum algorithm discovered by Lov Grover in 1996 that provides a quadratic speedup for searching unsorted databases. In cryptography, Grover's algorithm effectively halves the security level of symmetric ciphers and hash functions: AES-256 drops from 256-bit to approximately 128-bit effective security, and AES-128 drops to approximately 64-bit. This is why post-quantum guidelines recommend AES-256 rather than AES-128. Unlike Shor's algorithm, Grover's does not break symmetric cryptography entirely.

A mathematical function that maps input data of arbitrary size to a fixed-size output (the hash or digest). Cryptographic hash functions must be pre-image resistant (hard to reverse), second pre-image resistant (hard to find another input with the same hash), and collision resistant (hard to find any two inputs with the same hash). QNSQY uses BLAKE3 and SHA-3 for hashing.

A family of digital signature schemes whose security relies solely on the properties of hash functions rather than number-theoretic or lattice assumptions. This makes them among the most conservative post-quantum choices since hash functions are well-understood. SLH-DSA (stateless, FIPS 205) and LMS (stateful, SP 800-208) are hash-based signature standards supported by QNSQY.

A threat model where adversaries intercept and store encrypted data today with the intent of decrypting it in the future when sufficiently powerful quantum computers become available. HNDL is the primary motivation for adopting post-quantum cryptography now, before quantum computers exist, because data with long-term sensitivity (medical records, state secrets, financial data) must be protected preemptively. See Harvest Now, Decrypt Later.

A key derivation function defined in RFC 5869 that uses HMAC to extract and expand keying material. HKDF operates in two stages: extract (condense a potentially non-uniform input into a pseudorandom key) and expand (derive one or more output keys from that pseudorandom key). QNSQY uses HKDF-SHA3-256 for deriving subkeys from the shared secret established by the KEM.

A code-based Key Encapsulation Mechanism selected by NIST on March 11, 2025 as the 5th post-quantum algorithm for standardization. HQC provides algorithm diversity as a non-lattice alternative to ML-KEM, basing its security on the hardness of decoding random quasi-cyclic codes. It defines three parameter sets: HQC-128, HQC-192, and HQC-256, corresponding to NIST Security Levels 1, 3, and 5. Available in QNSQY's Business tier. See HQC Explained.

A dedicated physical computing device that safeguards and manages cryptographic keys, performs encryption and signing operations, and provides tamper resistance. HSMs are used in high-security environments (banking, government, healthcare) to ensure private keys never exist in software-accessible memory. HSM integration for hardware-secured key wrapping (YubiKey / TPM / CloudHSM) is on the QNSQY roadmap (v7.3); it is not yet a shipped feature.

An approach that combines post-quantum and classical cryptographic algorithms in a single construction so that the system remains secure even if one algorithm family is broken. QNSQY always hybridizes: ML-KEM + X25519 for key exchange, ML-DSA + Ed25519 for signatures. An attacker must break both the post-quantum and classical components simultaneously. See Hybrid Encryption Explained.

A cryptographic function that derives one or more secret keys from a source of keying material such as a password, shared secret, or master key. KDFs ensure that derived keys are uniformly distributed and independent. QNSQY uses Argon2id for password-to-key derivation and HKDF-SHA3-256 for deriving subkeys from KEM shared secrets.

A public-key cryptographic primitive used to establish a shared secret between two parties. Unlike traditional key exchange, a KEM is a one-directional operation: the sender encapsulates a random secret using the recipient's public key, producing a ciphertext that only the recipient can decapsulate. ML-KEM (FIPS 203) and HQC are the post-quantum KEMs used in QNSQY. See ML-KEM Explained.

A protocol by which two parties establish a shared secret key over an insecure communication channel. Classical key exchange protocols include Diffie-Hellman and ECDH (X25519). In the post-quantum era, interactive key exchange is being replaced by Key Encapsulation Mechanisms that achieve the same goal with a single message rather than a multi-step handshake.

A matched set of two cryptographic keys used in asymmetric encryption: a public key (which can be shared openly) and a private key (which must be kept secret). The mathematical relationship between the keys allows data encrypted with the public key to be decrypted only with the private key, and signatures created with the private key to be verified with the public key. QNSQY generates hybrid key pairs containing both post-quantum and classical components.

A family of cryptographic constructions based on the computational hardness of problems involving mathematical lattices, such as Learning With Errors (LWE) and its module variant. Lattice problems are believed to be hard for both classical and quantum computers. Lattice-based cryptography forms the mathematical foundation for ML-KEM (FIPS 203), ML-DSA (FIPS 204), and FN-DSA (FIPS 206 (draft)).

A stateful hash-based signature scheme specified in NIST SP 800-208 and RFC 8554. LMS provides post-quantum signature security based entirely on hash functions. Unlike stateless schemes like SLH-DSA, LMS requires careful state management to prevent one-time key reuse. Its Hierarchical Signature System (HSS) extension supports large signing budgets. Available in QNSQY's Business tier. See LMS Stateful Signatures.

A computational problem that forms the theoretical foundation of most lattice-based cryptographic schemes. Given a system of approximate linear equations over a finite field (where each equation has a small random error term), the LWE problem asks to recover the secret vector. The module variant (Module-LWE) used in ML-KEM and ML-DSA provides a balance between security and efficiency by structuring the lattice as a module over a polynomial ring.

The primary post-quantum digital signature standard, published by NIST as FIPS 204 in August 2024. Previously known as CRYSTALS-Dilithium during the standardization process. ML-DSA is based on the hardness of the Module Learning With Errors problem over lattice structures. It defines three parameter sets: ML-DSA-44 (Level 2, free on all tiers), ML-DSA-65 (Level 3, free on Pro+), and ML-DSA-87 (Level 5). QNSQY always hybridizes ML-DSA with Ed25519. See ML-DSA vs SLH-DSA.

The primary post-quantum key encapsulation standard, published by NIST as FIPS 203 in August 2024. Previously known as CRYSTALS-Kyber during the standardization process. ML-KEM is based on the hardness of the Module Learning With Errors problem over lattice structures. It defines three parameter sets: ML-KEM-512 (Level 1, free on all tiers), ML-KEM-768 (Level 3, free on Pro+), and ML-KEM-1024 (Level 5). QNSQY always hybridizes ML-KEM with X25519. See ML-KEM Explained.

A POSIX system call that locks specified memory pages into RAM, preventing the operating system from swapping them to disk. In cryptographic applications, mlock() is critical for protecting sensitive material such as private keys and passwords: if locked memory pages were swapped to disk, an attacker with physical access could potentially recover secrets from the swap partition. QNSQY uses mlock() for all key material and provides a test-no-mlock feature flag for environments without elevated privileges.

A mathematical structure used in ML-KEM and ML-DSA that organizes the lattice as a module over a polynomial ring (specifically, the ring of integers modulo a prime q, quotiented by a cyclotomic polynomial). Module lattices provide a favorable balance between security, performance, and key size compared to unstructured lattices or the more structured ring-based (ideal) lattices. The "ML" prefix in ML-KEM and ML-DSA stands for Module-Lattice.

A U.S. federal agency responsible for developing measurement standards, including cryptographic standards. NIST conducted an 8-year public competition (2016-2024) to select post-quantum cryptographic algorithms, resulting in the finalization of FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) in August 2024, with FIPS 206 (draft) (FN-DSA) still in draft. NIST also selected HQC in March 2025 for standardization. See NIST FIPS Guide.

A "number used once" in cryptographic protocols. A nonce ensures that the same plaintext encrypted with the same key produces different ciphertext each time, preventing replay attacks and maintaining semantic security. In AES-256-GCM, the nonce is 96 bits; in XChaCha20-Poly1305, the extended nonce is 192 bits, which is large enough to be generated randomly without significant collision risk.

The original, readable form of data before encryption or after decryption. Plaintext is the data that must be protected from unauthorized access. In QNSQY, plaintext includes the file content, and it never leaves the local machine: all encryption and decryption operations are performed locally.

Cryptographic algorithms designed to be secure against attacks by both classical and quantum computers. PQC encompasses multiple mathematical families: lattice-based (ML-KEM, ML-DSA, FN-DSA), code-based (HQC), and hash-based (SLH-DSA, LMS). NIST finalized the first three PQC standards in August 2024. PQC is distinct from quantum cryptography (which uses quantum physics, such as QKD): PQC runs on classical hardware. See What is Post-Quantum Cryptography?

A framework of policies, hardware, software, and procedures for creating, managing, distributing, and revoking digital certificates and key pairs. PKI relies on Certificate Authorities to establish trust hierarchies. The post-quantum transition requires migrating PKI systems to PQC algorithms, which is complicated by larger key sizes and signature sizes in algorithms like ML-DSA and SLH-DSA.

A computing device that uses quantum mechanical phenomena (superposition, entanglement, interference) to perform calculations. Quantum computers can solve certain mathematical problems exponentially faster than classical computers. Specifically, Shor's algorithm running on a sufficiently large quantum computer can break RSA, ECC, and Diffie-Hellman, while Grover's algorithm weakens symmetric ciphers. See Protect Data from Quantum Computers.

A method that uses quantum mechanical properties of photons to distribute encryption keys with information-theoretic security. Any attempt to intercept the quantum channel disturbs the photon states, alerting the communicating parties. QKD is fundamentally different from post-quantum cryptography: QKD requires specialized quantum hardware and fiber optic or free-space optical channels, while PQC runs on standard classical computers and networks. QNSQY uses PQC, not QKD.

The property of a cryptographic algorithm being secure against known quantum attacks. An algorithm is considered quantum-resistant if no known quantum algorithm (including Shor's and Grover's) can break it significantly faster than brute force. All NIST-standardized PQC algorithms have been evaluated for quantum resistance across multiple security levels. QNSQY's hybrid approach provides quantum resistance through the post-quantum component while maintaining classical security through the traditional component.

The milestone at which a quantum computer can perform a specific computation that is practically infeasible for any classical computer. Google claimed quantum supremacy in 2019 with its Sycamore processor. However, quantum supremacy for a contrived benchmark problem does not imply the ability to break cryptography: current quantum computers have far too few stable qubits to run Shor's algorithm against real-world key sizes. Estimates suggest cryptographically relevant quantum computers may be 10-20 years away.

One of the first practical public-key cryptographic algorithms, published in 1977. RSA's security is based on the difficulty of factoring the product of two large prime numbers. Shor's algorithm can factor integers in polynomial time on a quantum computer, breaking RSA entirely. This vulnerability is a primary driver for the transition to post-quantum cryptography. QNSQY does not use RSA.

The Secure Hash Algorithm 3 family, standardized by NIST in FIPS 202 (2015). Based on the Keccak sponge construction, SHA-3 is structurally independent from SHA-2, providing algorithm diversity for hashing. SHA-3 includes fixed-output functions (SHA3-224/256/384/512) and extendable-output functions (SHAKE128/256). QNSQY uses SHA3-256 for HKDF key derivation and as an alternative to BLAKE3 for file hashing.

A threshold cryptography scheme invented by Adi Shamir in 1979 that splits a secret into N shares such that any M shares (the threshold) can reconstruct the original secret, but M-1 or fewer shares reveal no information about the secret. This is achieved using polynomial interpolation over a finite field. QNSQY uses Shamir's scheme for secret splitting (qnsqy split) and threshold encryption in the Business tier. See Shamir Secret Sharing.

A quantum algorithm discovered by Peter Shor in 1994 that can efficiently factor large integers and compute discrete logarithms on a quantum computer. Shor's algorithm breaks RSA (integer factoring), ECC (elliptic curve discrete log), and Diffie-Hellman (discrete log) in polynomial time. This is the fundamental reason the world is transitioning to post-quantum cryptography: Shor's algorithm renders all widely-deployed asymmetric cryptography insecure once sufficiently large quantum computers are built.

An attack that exploits information leaked through the physical implementation of a cryptographic system rather than through mathematical weaknesses. Side channels include timing (how long operations take), power consumption, electromagnetic emissions, cache access patterns, and acoustic emanations. Defenses include constant-time operations, memory protection (mlock), and blinding techniques. QNSQY uses constant-time comparisons for all security-sensitive operations.

A post-quantum digital signature standard published by NIST as FIPS 205 in August 2024. Previously known as SPHINCS+ during the standardization process. SLH-DSA is a hash-based signature scheme whose security relies solely on hash functions with no lattice or number-theoretic assumptions, making it the most conservative PQC signature choice. It defines 12 parameter sets across three security levels and two optimization targets (fast signing vs. small signatures). Available on Pro+ tiers. See ML-DSA vs SLH-DSA.

A cryptographic system where the same secret key is used for both encryption and decryption. Symmetric ciphers are orders of magnitude faster than asymmetric algorithms and are used for bulk data encryption. AES-256-GCM and XChaCha20-Poly1305 are the symmetric AEAD ciphers in QNSQY. Symmetric algorithms are not directly broken by Shor's algorithm, though Grover's algorithm halves their effective security level.

A cryptographic approach where a secret or operation is divided among multiple parties such that a minimum number (the threshold) must cooperate to perform the operation. No single party can act alone. Shamir Secret Sharing is the foundational threshold scheme. QNSQY's Business tier supports M-of-N threshold encryption (qnsqy threshold-encrypt) and secret splitting (qnsqy split) for organizational key management and disaster recovery.

An elliptic curve Diffie-Hellman key exchange function using Curve25519, defined in RFC 7748. X25519 provides 128-bit classical security with excellent performance and a simple, misuse-resistant API. In QNSQY, X25519 serves as the classical component of hybrid key exchange alongside ML-KEM. Both shared secrets are combined via HKDF to derive the final symmetric key. See X25519 and Ed25519 Explained.

An AEAD cipher combining the XChaCha20 stream cipher with the Poly1305 message authenticator. XChaCha20-Poly1305 provides 256-bit security with a 192-bit nonce, which is large enough to be generated randomly without significant collision risk. It offers an alternative to AES-256-GCM when hardware AES acceleration is unavailable, since ChaCha20 is fast in pure software. Available on every tier in QNSQY.

A cryptographic protocol in which one party (the prover) can convince another party (the verifier) that a statement is true without revealing any information beyond the truth of that statement. For example, proving knowledge of a password without transmitting the password itself. Zero-knowledge proofs have applications in authentication, privacy-preserving computation, and blockchain systems. Post-quantum zero-knowledge constructions are an active area of research.

The practice of overwriting sensitive cryptographic material in memory with zeros (or other patterns) immediately after use and before deallocation. Zeroization prevents side-channel attacks and forensic recovery of secrets from memory dumps, core dumps, or swap space. QNSQY zeroizes all private keys, passwords, and intermediate key material on drop using the Rust zeroize crate with compiler-fence barriers to prevent optimization away of the overwrite.