One could use Falcon-512 for establishing a private and public key for an asymmetric context. Whereas in a symmetric context, we could use firesaber/saber/variants in order to obtain a shared secret that can later be used in an AES-GCM context. My question is: what encryption algorithm do we use when we want to encrypt plaintext when using a public key instead of a shared key? What post-quantum encryption algorithms (i.e., a map from plaintext to ciphertext) exist that are compatible with asymmetric schemes such as falcon? If I were to try using the public key to encrypt data, using the private key to decrypt would fail if using a symmetric encryption algorithm such as AES-GCM
The NIST post-quantum schemes mainly consist of KEMs and signature schemes due to the fact that quantum computers don't break all existing cryptography.
As per Daniel Bernstein :
...there is no justification for the leap from “quantum computers destroy RSA and DSA and ECDSA” to “quantum computers destroy cryptography.”
As such, there is less desire to replace AES than there is to replace RSA/DSA/ECDSA, or whatever is broken by quantum computers.
Meanwhile DJB's tone suggests he doesn't think it's a priority:
Evidently these unnamed “experts” believe—and Magiq would like you to believe—that quantum computers will break AES, and dozens of other wellknown secret-key ciphers, and Merkle’s hash-tree signature system, and McEliece’s hidden-Goppa-code encryption system, and Patarin’s HFEv− signature system, and NTRU, and all of the other cryptographic systems discussed in this book. Time will tell whether this belief was justified!