The Post-Quantum Field Guide

LaMarr LabsLaMarr Labs

Do Cryptographic Algorithms Last Forever

9 min read

up:: The Transition MOC

Do Cryptographic Algorithms Last Forever?

Every cipher humans have ever trusted has eventually been retired, and that’s the ordinary arc of a cryptographic algorithm rather than a failure of any particular one. A primitive gets standardized, the whole world leans on it, cryptanalysis and cheaper computing slowly catch up, and one day it moves to the shelf while something stronger takes its place. The algorithms change on a schedule measured in decades. The practice of replacing them is the part that stays.

That reframe matters right now, because the quantum transition tends to get told as a sudden emergency, a one-time scramble to swap RSA and elliptic-curve cryptography for something a quantum computer can’t touch. Set against the real history of the field, it looks like something calmer and more familiar. It’s the next scheduled replacement in a discipline that has always replaced its parts, and the organizations that treat it as a routine capability rather than a crisis are the ones that come through it well.

The shelf life is part of the design

Pick almost any primitive that ran the internet a generation ago, and you’ll find a retirement date attached to it today. Three of them tell the whole story.

The Data Encryption Standard is the cleanest example. NIST published DES in 1977 with a 56-bit key, and for two decades it was the U.S. government’s approved cipher and a global default. The key length was the weak point. In July 1998 the Electronic Frontier Foundation’s purpose-built machine recovered a DES key by brute force in 56 hours, proving that cheap hardware had outrun the key size.1 NIST formally withdrew DES in 2005 and pointed federal systems to the Advanced Encryption Standard that had replaced it.2 DES did its job for a generation and then aged out, exactly as a well-run standard is meant to.

SHA-1 followed the same path on the hashing side. NIST published it in 1995, and it became the default fingerprint under digital signatures, TLS certificates, and software integrity for roughly 20 years. Cryptographers found theoretical collisions in 2005, a Google and CWI Amsterdam team produced two real PDF files with an identical SHA-1 hash in 2017, and by 2020 a chosen-prefix collision, the kind that forges certificates, cost about $45,000 in rented computing time.3 NIST retired SHA-1 in December 2022 and set the end of 2030 as the date it becomes disallowed, with SHA-2 and SHA-3 as the replacements.4

MD5 aged out faster and harder. Ron Rivest designed it in 1991, and it spread everywhere a quick checksum or certificate hash was wanted. A team led by Xiaoyun Wang announced full MD5 collisions in 2004, taking about an hour of computation.5 Researchers turned that into a working forgery in 2008, building a rogue certificate-authority certificate that browsers would trust.6 By 2011 the IETF formally sunset MD5 for any use that depends on collision resistance.7

What the pattern actually teaches

Line those three up and the shape is impossible to miss. DES fell to hardware, SHA-1 and MD5 fell to mathematics, and every one of them was a government-blessed or industry-default standard that the whole world trusted right up until the morning it couldn’t. Every one of those breaks came from ordinary research and cheaper silicon, given enough time, with a quantum computer nowhere in the story.

So the failure lived somewhere other than the choice of algorithm. Each of those primitives was an excellent pick in its year. The systems that suffered were the ones that treated their algorithm as a permanent fixture, welded it into protocols, firmware, and file formats, and left themselves a rebuild instead of a swap when its day came. That’s why SHA-1 lingered for more than a decade after the first crack. Replacing it in one system was easy, and finding every certificate, script, and embedded device that still used it across a large estate was the slow and expensive part.

Built to be replaced: two habits that make it routine

If replacement is the permanent part of cryptography, then the healthy way to run a system is to plan for it on purpose, and two habits do most of the work.

The first is crypto-agility, the architectural property that lets you change an algorithm through configuration instead of a rebuild. An agile system treats the choice of primitive as a setting resolved in one place, so retiring a weak algorithm becomes a central change that propagates everywhere, rather than a hunt through thousands of applications that each named the algorithm directly. NIST now treats this as a named discipline, and its December 2025 white paper on cryptographic agility describes it as the capability to replace and adapt algorithms across protocols, software, hardware, and firmware while keeping systems running.8 Most of the estate that carried SHA-1 and DES for so long had none of this built in, which is precisely why the retirements dragged.

The second habit is keeping more than one bet, which is the defense against cryptographic monoculture. When an entire ecosystem rests on a single algorithm or a single family of math, one breakthrough can compromise all of it together, the way a field planted with a single crop variety loses everything to one blight. The answer is to keep independent options alive on unrelated hard problems, so a bad day for one leaves the others standing. NIST built exactly that into the post-quantum standards, keeping a code-based backup on different math from the lattice main line, so the encryption layer holds a second line of defense a lattice break can’t reach.

Both habits leave the individual algorithm exactly as strong as it was. What they change is what a break costs you, turning the eventual retirement of a primitive from an emergency into a scheduled piece of maintenance.

Quantum is that same lesson at full scale

The quantum threat is this same story told once more, at a larger scale. A quantum computer running Shor’s algorithm solves the two math problems that nearly all of today’s public-key cryptography depends on, which retires RSA, Diffie-Hellman, and elliptic-curve cryptography in a single stroke.9 It’s a deeper break than any of the classical ones, because it takes a whole mathematical foundation at once rather than one algorithm. The response is the one cryptography has always used: standardize the replacements, then move to them.

Two things make this round feel different, and both are real. The scope is larger, because Shor’s algorithm reaches an entire class of primitives at once. And the clock is stranger, because of harvest-now-decrypt-later, where an adversary records encrypted traffic today and opens it years later on the day the machine exists, so data with a long secrecy lifetime is exposed well before the computer arrives. That gives the migration genuine urgency, and it’s a difference of size and timing rather than of kind.

The framing that carries forward is the useful one. The quantum transition is the first real exercise of a muscle every system was always meant to have. Organizations that could swap DES for AES and SHA-1 for SHA-256 cleanly are running the same play again, and the ones that struggled last time are about to learn the lesson under a firmer deadline. Build the ability to replace cryptography once, properly, and it serves you for every primitive that ages out after this one, quantum or otherwise.

Where the Transition begins

Everything downstream of this page runs on that reframe. The transition is the work of replacing quantum-vulnerable cryptography across a live organization, and it has five faces: the new standards that say what to deploy, the discovery and inventory that find where your cryptography actually lives, the protocols where the new algorithms run, the quantum-native technologies people keep asking about, and the human and organizational work where programs either ship or stall.

Read the section as a permanent capability you’re finally building rather than a fire you’re putting out, and its whole character changes. Discovery stops being a chore and becomes the map you should always have kept. Agility is the property that makes this migration and the next one cheap. And naming a single owner is what turns a plan into motion. The algorithms will keep changing after quantum, the way they always have. What you’re really building here is the ability to change with them without it hurting.

Everything here is the map, given freely. When your team needs the quantum transition planned and run as the routine replacement it should be, sequenced against your own systems so a future break lands as maintenance instead of a crisis, that’s a working session with your team.

Last verified 2026-07-26 · Updated 2026-08-25 · Maintained by Addie LaMarr, LaMarr Labs.

Footnotes

  1. Electronic Frontier Foundation, “EFF DES Cracker Machine Brings Honesty to Crypto Debate,” press release, July 17, 1998. The purpose-built “Deep Crack” machine recovered a DES key by brute force in 56 hours. w2.eff.org ↩

  2. NIST, “NIST Withdraws Outdated Data Encryption Standard,” 2005; Federal Register, “Announcing Approval of the Withdrawal of FIPS 46-3 (DES), FIPS 74, and FIPS 81,” effective May 19, 2005. nist.gov, federalregister.gov ↩

  3. M. Stevens, E. Bursztein, P. Karpman, A. Albertini, Y. Markov, “The first collision for full SHA-1,” CRYPTO 2017, shattered.io; G. Leurent and T. Peyrin, “SHA-1 is a Shambles: First Chosen-Prefix Collision on SHA-1 and Application to the PGP Web of Trust,” USENIX Security 2020, sha-mbles.github.io. ↩

  4. NIST, “NIST Retires SHA-1 Cryptographic Algorithm,” December 15, 2022. nist.gov ↩

  5. X. Wang, D. Feng, X. Lai, H. Yu, “Collisions for Hash Functions MD4, MD5, HAVAL-128 and RIPEMD,” IACR ePrint 2004/199, August 2004. eprint.iacr.org ↩

  6. A. Sotirov, M. Stevens, J. Appelbaum, A. Lenstra, D. Molnar, D. A. Osvik, B. de Weger, “MD5 considered harmful today: Creating a rogue CA certificate,” 2008. win.tue.nl/hashclash ↩

  7. S. Turner and L. Chen, “Updated Security Considerations for the MD5 Message-Digest and the HMAC-MD5 Algorithms,” RFC 6151, IETF, March 2011. rfc-editor.org ↩

  8. NIST, “Considerations for Achieving Crypto Agility: Strategies and Practices,” Cybersecurity White Paper (CSWP) 39, finalized December 19, 2025. nist.gov ↩

  9. NIST IR 8547 ipd, “Transition to Post-Quantum Cryptography Standards,” November 2024. csrc.nist.gov ↩

Graph View

Backlinks