It's well-known that Shor's algorithm can solve integer factorization, discrete logarithm and discrete log over elliptic curves in cubic time. This implies that cryptosystems like RSA, ElGamal, and Elliptic Curve Diffie-Hellman (ECDH) are vulnerable to quantum computers.
Are there any existing public-key cryptosystem that are NOT known to have a polynomial-time quantum attack?
This question was inspired by this blog post.