Shor's algorithm breaks factoring and discrete logarithms, so RSA, finite-field DH, ECDH, ECDSA and EdDSA all fall to a cryptographically relevant quantum computer. Post-quantum schemes rest on problems with no known quantum shortcut: structured lattices (ML-KEM, ML-DSA, FN-DSA), hash functions (SLH-DSA, LMS, XMSS) and error-correcting codes (HQC, Classic McEliece). Symmetric ciphers and hashes are affected only by Grover's square-root speed-up, so AES-256, AES-128 and SHA-256 remain usable.
NIST published FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) on 13 August 2024; FN-DSA (FIPS 206, from Falcon) and HQC are still in draft. NIST IR 8547 (initial public draft) proposes deprecating 112-bit classical algorithms after 2030 and disallowing all quantum-vulnerable public-key algorithms after 2035; NSA's CNSA 2.0 sets earlier dates for national security systems.
Migration order in practice: hybrid key exchange first, because recorded traffic can be decrypted later (TLS X25519MLKEM768 and SSH mlkem768x25519-sha256 are already defaults), then signatures and PKI, where sizes and trust distribution are harder problems. The PQ algorithm zoo compares sizes and speeds.