Self-Assessment Quiz: Quantum Cryptography and Post-Quantum Security

Twenty questions on the quantum threat, NIST standards, migration, and the difference between PQC and QKD. Aim for 16+.

Question 1

Shor's algorithm breaks:

A) RSA, Diffie–Hellman, and elliptic-curve cryptography B) AES only C) SHA-256 D) All cryptography

Question 2

Grover's algorithm affects symmetric cryptography by:

A) Halving the effective key length B) Breaking it entirely C) Not at all D) Tripling security

Question 3

The recommended response for symmetric crypto is:

A) Use AES-256 instead of AES-128 B) Abandon AES C) Nothing is needed D) Switch to RSA

Question 4

NIST published its first post-quantum standards in:

A) August 2024 B) 2016 C) 2022 D) 2030

Question 5

FIPS 203 specifies:

A) ML-KEM (from CRYSTALS-Kyber), a key-encapsulation mechanism B) A signature scheme C) A hash function D) A block cipher

Question 6

FIPS 204 and 205 specify:

A) ML-DSA and SLH-DSA — two digital signature schemes B) Two KEMs C) Hash functions D) Nothing

Question 7

FALCON (FN-DSA) is:

A) Selected but published separately as FIPS 206, still in development B) A finalized standard C) Rejected D) A KEM

Question 8

HQC was selected in March 2025 as:

A) A backup KEM based on a different (code-based) hardness assumption B) A signature scheme C) The primary KEM D) A hash function

Question 9

Selecting HQC alongside ML-KEM hedges against:

A) A breakthrough against lattice problems B) Implementation bugs C) Slow performance D) Patent issues

Question 10

"Harvest now, decrypt later" means:

A) Recording encrypted traffic today to decrypt when quantum computers mature B) A caching optimization C) A key-rotation policy D) A QKD protocol

Question 11

Mosca's inequality warns you are already too late if:

A) $T_{\text{data}} + T_{\text{migrate}} > T_{\text{CRQC}}$ B) $T_{\text{data}} < T_{\text{migrate}}$ C) $T_{\text{CRQC}} = 0$ D) Migration is complete

Question 12

Hybrid deployment means:

A) Running classical and post-quantum algorithms together so breaking one is insufficient B) Using two quantum computers C) Half-encrypted data D) QKD plus PQC

Question 13

Lattice-based cryptography rests on problems such as:

A) Learning With Errors and the Shortest Vector Problem B) Integer factoring C) Discrete logarithms D) Graph colouring

Question 14

SIKE, an isogeny-based candidate, was:

A) Broken classically in 2022, on a laptop, during the competition B) Standardized C) Never submitted D) Broken by a quantum computer

Question 15

QKD differs from PQC in that it:

A) Requires dedicated quantum channels and addresses only key exchange B) Is software-only C) Provides signatures D) Works over the public internet

Question 16

True or false: Post-quantum cryptography requires quantum computers to run.

Question 17

True or false: PQC key and signature sizes are comparable to RSA and ECC.

Question 18

True or false: Organizations should wait for cryptographically relevant quantum computers before migrating.

Question 19

Short answer. Explain why doubling RSA key size does not defend against Shor while doubling AES key size does defend against Grover.

Question 20

Short answer. Your organization has ten years of sensitive data retention and a five-year migration timeline. Should you act now?

Answer Key

Q Ans Note
1 A All deployed public-key primitives based on factoring or discrete log.
2 A $\sqrt{2^n} = 2^{n/2}$.
3 A Doubling the key restores the original margin at negligible cost.
4 A Final standards effective 2024-08-14.
5 A Module-Lattice-Based Key-Encapsulation Mechanism.
6 A Module-Lattice-Based and Stateless Hash-Based Digital Signature Algorithms.
7 A Selected in 2022; its FIPS is still in development, so calling it "standardized" is premature.
8 A Code-based, providing algorithmic diversity.
9 A ML-KEM and FALCON are both lattice-based, so a lattice break would take out the primary KEM and a signature scheme at once.
10 A Which is why the threat is present-tense for long-lived secrets.
11 A Data lifetime plus migration time exceeding the machine's arrival.
12 A Standard practice during transition, since PQC schemes are comparatively young.
13 A Believed hard for both classical and quantum computers.
14 A A cautionary tale about young assumptions — broken by classical mathematics, not quantum.
15 A QKD is hardware, point-to-point, and key-exchange-only (Ch. 10's procurement case study).
16 False PQC is classical software running on ordinary computers; only the threat is quantum.
17 False ML-KEM public keys are ~1,184 bytes against 64 for ECC-P256, and SLH-DSA signatures run to tens of kilobytes. This affects TLS handshake sizes, certificate chains, and constrained devices — a real engineering cost.
18 False Harvest-now-decrypt-later means data recorded today is already exposed, and migration takes years. Waiting guarantees being late for any long-lived secret.
19 — Grover gives a quadratic speedup, so $n$ bits of key give $n/2$ bits of quantum security; doubling $n$ restores the original margin, and BBBV proves no better quantum attack exists. Shor is polynomial in the key size: doubling an RSA modulus increases the attacker's cost polynomially while increasing the defender's cost substantially (RSA operations scale badly with key size). The exponents are simply on the wrong side — you cannot outrun a polynomial-time attack by making the problem polynomially bigger.
20 — Yes, immediately. Mosca: $T_{\text{data}} + T_{\text{migrate}} = 10 + 5 = 15$ years. Any credible estimate of $T_{\text{CRQC}}$ has meaningful probability mass inside 15 years, so the inequality is violated. Data encrypted today under RSA/ECC and recorded by an adversary is exposed. Start with a cryptographic inventory, prioritize by data lifetime, deploy hybrid ML-KEM for long-lived key exchange, and plan signature migration to ML-DSA.