# What makes lattice-based cryptography quantum-resistant?

As opposed to RSA or elliptic curve cryptography?

Correction: Note that, as pointed out by @yyyyyyy in the comments, Shor's algorithm for DLP does not factor; neither is it based on finding the order of an element (which is usually known anyway in a DLP context). Both variants have in common that Shor finds the period lattice of a certain map, and while in the factoring context this period is indeed (the $$\mathbb{Z}$$-multiples of) the order of an element, the lattice is two-dimensional in the discrete-logarithm setting (and contains a vector of the form $$(𝑥,−1)$$ where $$𝑥$$ is the solution to the DLP instance).
• Shor's algorithm for DLP does not factor; neither is it based on finding the order of an element (which is usually known anyway in a DLP context). Both variants have in common that Shor finds the period lattice of a certain map, and while in the factoring context this period is indeed (the $\mathbb Z$-multiples of) the order of an element, the lattice is two-dimensional in the discrete-logarithm setting (and contains a vector of the form $(x,-1)$ where $x$ is the solution to the DLP instance). – yyyyyyy Jun 7 '19 at 0:34