Short answer
In one sentence
Encryption scrambles information, and someone without the secret key can’t read it.
The Canadian Centre for Cyber Security says: “Encryption encodes (or scrambles) information. Encryption protects the confidentiality of information by preventing unauthorized individuals from accessing it.”
You use it every day. The Centre lists online banking or shopping, email applications and secure instant messaging as examples. It also says that if a website address starts with HTTPS and shows a padlock, the communication with the website is encrypted.
More guides: what two-factor authentication is, and what ML-KEM is.
Two places
At rest and in transit
The Centre says encryption secures information “while it is in transit (e.g. connecting to a website) and while it is at rest (e.g. stored in encrypted databases)”.
In transit means the information is moving from one place to another. When you connect to your bank’s website, the Centre says, the data sent between your device and the website is encrypted.
At rest means the information is stored. The Centre’s example: “when information is stored in an encrypted database, it is stored in an unreadable format. Even if someone gains access to that database, there’s an additional layer of security for the stored information.”
End to end
End-to-end encryption
As the Centre describes it, end-to-end encryption means messages are encrypted from your device to the recipient’s device, so not even the messaging service provider can read them.
Quantum
Why quantum computers matter
The Centre says: “Quantum computing threatens to break much of the cryptography we currently use.” Quantum computers use quantum physics to process information, and the Centre says they “solve problems that are impractical to solve using current computing capabilities”.
NIST explains the link to encryption: “Encryption tools rely on complex math problems that conventional computers find difficult or impossible to solve. A sufficiently capable quantum computer, though, would be able to sift through a vast number of potential solutions to these problems very quickly, thereby defeating current encryption.”
That is about a future machine. The Centre says: “Existing quantum computers are not powerful enough to break cryptography.” It adds that “a sufficiently powerful device could be available as early as the 2030s”.
The Centre also names a threat that matters before then, “Harvest Now, Decrypt Later”: “Threat actors can store encrypted information now to decrypt in the future when a sufficiently powerful quantum computer exists.” It says encrypted information “with a long lifespan could be at risk”.
Standards
The new standards
The Centre defines post-quantum cryptography this way: “Post-quantum cryptography (PQC) refers to algorithms that are designed to be quantum-safe but that can be run on a conventional computer.” It says: “The U.S. National Institute of Standards and Technology (NIST) published its initial set of standards for PQC algorithms in August 2024.”
NIST’s news release of 13 August 2024 says it had “finalized its principal set of encryption algorithms designed to withstand cyberattacks from a quantum computer”. There are three standards. FIPS 203 is about a key-encapsulation mechanism, which NIST’s page for the standard says “can be used by two parties to establish a shared secret key over a public channel”. It is based on the CRYSTALS-Kyber algorithm, “which has been renamed ML-KEM, short for Module-Lattice-Based Key-Encapsulation Mechanism”. FIPS 204 and FIPS 205 are for digital signatures, which NIST describes as “used for identity authentication”.
Of ML-KEM, NIST’s page for FIPS 203 says: “At present, ML-KEM is believed to be secure, even against adversaries who possess a quantum computer.” For a plain-language guide, see what ML-KEM is.
Our turn
An example from our app
MELKEM Authenticator lets you create an encrypted export. An encrypted export uses AES-256-GCM. MELKEM Authenticator doesn’t use ML-KEM.
