Cryptographic Glossary
Search key terms, architectural definitions, and regulatory compliance standards powering modern post-quantum readiness engineering.
Shor’s Algorithm
A quantum computing algorithm, published by Peter Shor in 1994, capable of finding the prime factors of an integer in polynomial time using a sufficiently large, fault-tolerant quantum computer. Classical computers can only factor large integers in exponential time, which is what makes RSA secure today. Shor's Algorithm theoretically breaks that assumption, along with the discrete logarithm problem that Elliptic-Curve Cryptography (ECC) and Diffie-Hellman key exchange rely on. No quantum computer capable of running it at cryptographically relevant scale exists yet, but the "harvest now, decrypt later" threat model — where encrypted traffic is captured today and decrypted once such a machine exists — is why NIST and most large enterprises are migrating proactively rather than waiting.
ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism)
The official NIST post-quantum cryptography standard (FIPS 203) designated for general-purpose encryption and key establishment, replacing RSA and ECDH for that use case. It is built on the Module Learning With Errors (MLWE) lattice problem, a mathematical problem believed to remain hard to solve even for a quantum computer running Shor's Algorithm. In practice, ML-KEM is typically deployed in "hybrid" mode alongside a classical algorithm during the migration period, so a system stays secure even if a flaw is later found in the new standard.
CBOM vs SBOM
An SBOM (Software Bill of Materials) catalogs the open-source libraries, packages, and dependencies used in an application — it answers "what code is running." A CBOM (Cryptographic Bill of Materials) is a more specialized inventory: it catalogs every cryptographic algorithm, key length, certificate, and cipher suite actually in use across an architecture. Building a CBOM is usually the first practical step in a post-quantum migration, since you cannot replace algorithms you haven't inventoried — many organizations discover legacy RSA-1024 keys or deprecated cipher suites still active in forgotten services once they run this exercise.
SOC 2 Trust Services Criteria
A compliance framework defined by the AICPA (American Institute of Certified Public Accountants), built around five trust service principles: security, availability, processing integrity, confidentiality, and privacy. Unlike a fixed checklist, SOC 2 evaluates whether an organization's controls are designed and operating effectively over a review period (a Type II audit typically spans 3–12 months). For cloud-native teams, automating evidence collection — access logs, encryption configuration, key rotation records — is what makes continuous SOC 2 readiness realistic instead of a stressful annual scramble.
Crypto-Agility
The design capability of a software system to swap out underlying cryptographic algorithms, key lengths, or cipher suites without requiring a disruptive architectural overhaul. A crypto-agile system typically abstracts cryptographic operations behind a common interface, stores algorithm identifiers alongside encrypted data (rather than hardcoding an algorithm everywhere it's used), and supports running two algorithms side-by-side during a transition. It matters most right now because it determines how painful — or how routine — the shift to post-quantum algorithms will be for a given codebase.