# What asymmetric encryption to use that is safe against quantum computers?

i am currently searching for a post-quantum, asymmetric encryption since I need to keep a few files safe for the next decades.
AES 256 is what I am using currently, but I would like to leverage the additional safety of a asymmetric encryption (like encrypting something on a server I don't trust to 100% / storing the private key air-gaped etc. ).

I am aware that nobody can see into the future, but one can do its best now.
Sadly I came to no good conclusion while googling it, and searching on SE.

Extra points if it's available in gpg.

• Standard is not finished, however you may choose one of them NIST PQ. I don't see a reason additional encryption with public keys while AES-256 is secure against the Post Quantum adversaries, Besides the speed will be issue for you, too. Sep 23 at 8:22

## 1 Answer

As @kelalaka already mentioned, standardization is not finished yet. There are candidates for PQ-crypto, but they are still analyzed and revisited. Here you can find the current finalists and alternatives. (Note: Sike is not considered an alternative by most cryptographers I know, because of this paper).

But the main reason I make this answer: I think you got a misconception. In general you don't want to use asymmetric cryptography for encryption. The reason for this is, that is not efficient. Symmetric applications (like AES) are more suitable for encryption.

Therefore most applications use hybrid encryption schemes. Simply said, asymmetric crypto is used for the key exchange and then symmetric crypto is used to encrypt the data. This is more efficient, especially if you want to handle large amounts of data.

The good thing here is, that symmetric crypto can be assumed to be PQ-secure to some extend. Although there is a PQ-attack against symmetric crypto, the Grover algorithm, symmetric crypto is not broken in the same way as asymmetric crypto is. Grover's algorithm can be seen as an attack, with runtime $$\mathcal O(\sqrt{n})$$, where $$n$$ is the security parameter. For your application (AES-256) that means, if someone could run Grover's algorithm, your assumed bit security drops from ~256 to ~128. This is still assumed to be secure for normal people.

From your description, I don't see a problem with only using AES and already being "PQ-secure" to some extent. I see more of a problem in finding a (commercial and untrusted) server that already uses PQ algorithms today.