Dovre

Quantum

Encryption that outlasts quantum computers.

Quantum computers will one day solve problems that today's computers can't, including some of the maths that protects the internet. Here is what that means for encryption, and how Dovre prepares for it.

01The threat

What quantum computers change.

A quantum computer doesn't break all encryption. It breaks some kinds very well and barely dents others. The difference matters.

  1. 1.1

    Shor's algorithm

    Solves factoring and discrete logarithms efficiently. That breaks RSA, Diffie-Hellman and elliptic-curve cryptography, which protect key exchange and digital signatures across the internet.

    RSA · ECC
  2. 1.2

    Grover's algorithm

    Speeds up brute-force search, which roughly halves the strength of symmetric ciphers. AES-256 keeps about 128 bits of security, which is still far out of reach.

    AES
  3. 1.3

    Harvest now, decrypt later

    An attacker can record encrypted traffic today and decrypt it once a large quantum computer exists. Data that must stay secret for years is already at risk.

    HNDL
  4. 1.4

    Post-quantum cryptography

    New algorithms built on problems quantum computers aren't known to solve. NIST published the first standards in 2024: ML-KEM for key exchange, and ML-DSA and SLH-DSA for signatures.

    FIPS 203–205
  5. 1.5

    Quantum key distribution

    Uses physics instead of maths to share keys, but needs dedicated hardware and fibre. Post-quantum cryptography runs on ordinary networks, and is what most security agencies recommend.

    QKD

02Dovre

How Dovre uses it.

Every layer is chosen to hold up against a quantum attacker. The security page has the short version.

  • Stored dataEncrypted with AES-256, which Shor's algorithm doesn't affect.
  • Key hierarchyThe keys that encrypt your data are wrapped with AES-256 keys in a key management service, never with RSA or elliptic curves. Customer-managed keys work the same way.
  • ConnectionsTLS 1.3 with hybrid key exchange: classical X25519 combined with ML-KEM. Both would have to be broken to read the traffic.
  • SignaturesCertificates are still signed classically. Forging one needs a quantum computer at the moment of the attack, so stored data isn't at risk. We'll move to ML-DSA as browsers and certificate authorities support it.
AES-256at rest
ML-KEMin transit
FIPS 203NIST standard
128-bitquantum security

03Further reading

Learn more.

Want to go deeper? These pages explain quantum technology and quantum-safe encryption in more detail.

  • kvanteteknologi.comIndependent Norwegian information site on quantum technology, quantum security and European quantum initiatives. In Norwegian.
  • kvantekryptering.noAn introduction to quantum cryptography, quantum key distribution and post-quantum algorithms. In Norwegian.
  • NIST FIPS 203The ML-KEM standard for post-quantum key exchange, from the US National Institute of Standards and Technology.

Contact

Questions about how Dovre protects your data against future threats? We're happy to explain.

hello@dovre.io