Glossary
Every term used across the curriculum, defined the way the lessons use it.
CBOM
Cryptographic bill of materials — an inventory of every place an organisation uses cryptography, with enough context (data lifetime, migration complexity, owner) to prioritise migration.
CNSA 2.0
NSA’s Commercial National Security Algorithm Suite 2.0. Mandates ML-KEM-1024 and ML-DSA-87 specifically for national security systems, with a 2027 deadline for new systems — stricter than common category-3 defaults.
CRQC
Cryptographically relevant quantum computer — one large and reliable enough to break deployed public-key cryptography. None exists publicly.
Declared capability
Evidence that software says it supports an algorithm — a version string or supported-groups list. Weaker than negotiated evidence, because policy or a middlebox can prevent it being used.
Decoy state
A BB84 variant where Alice randomly varies pulse intensity. Comparing yields across intensities reveals photon-number-splitting attacks that produce no error-rate elevation.
Detector blinding
Bright light forces avalanche photodiodes out of single-photon mode, letting an attacker dictate detection events and recover the key without raising the error rate. Caught by optical power monitoring, not by QBER.
ECDLP
Elliptic-curve discrete logarithm problem. Underpins ECDH and ECDSA. Roughly 100× cheaper to attack with Shor than RSA-2048 factoring, and substantially precomputable.
FIPS 203
ML-KEM (formerly CRYSTALS-Kyber). Key encapsulation, finalised August 2024. Replaces RSA key transport and ECDH.
FIPS 204
ML-DSA (formerly CRYSTALS-Dilithium). Lattice-based digital signatures, finalised August 2024. The general-purpose signature replacement.
FIPS 205
SLH-DSA (formerly SPHINCS+). Hash-based signatures, finalised August 2024. Slower and larger than ML-DSA, but rests on no new mathematical assumption.
FIPS 206
FN-DSA, based on Falcon. A compact lattice signature standard that NIST has not yet published in draft as of mid-2026. Claims of compliance with it are a red flag.
Forward secrecy
A property whereby compromise of a long-term key does not expose past sessions. It does not protect against a broken hardness assumption — the ephemeral public values were transmitted in the clear and are recoverable by Shor.
Grover’s algorithm
A quantum search algorithm giving a quadratic speedup over brute force. Halves the effective bit strength of symmetric keys, so AES-256 retains roughly 128 bits and remains adequate.
HNDL
Harvest now, decrypt later. Recording encrypted traffic today to decrypt once a quantum computer exists. Requires no quantum technology at the harvest stage — only storage and patience.
HQC
A code-based key encapsulation mechanism selected by NIST in March 2025 as a backup to ML-KEM on a different mathematical foundation. No FIPS number assigned yet.
Hybrid
Combining a classical and a post-quantum algorithm so the result is secure if either component holds. Standard practice for key establishment; less common for signatures.
Logical qubit
An error-corrected qubit built from many physical qubits. Depending on the code and error rate, one logical qubit can cost hundreds to thousands of physical qubits.
MDI-QKD
Measurement-device-independent QKD. A protocol family that removes all detector side channels by moving measurement to an untrusted third party. The main countermeasure for detector attacks.
ML-KEM
Module-Lattice Key Encapsulation Mechanism, standardised as FIPS 203. ML-KEM-768 is the common category-3 parameter set with a 1,184-byte public key.
Mosca’s inequality
X + Y > Z, where X is data confidentiality lifetime, Y is migration duration and Z is time until a quantum computer exists. If it holds, you are already exposed.
Negotiated evidence
Proof that a real handshake actually completed using a post-quantum group. Much stronger than declared capability, because it reflects what happens rather than what is advertised.
NISQ
Noisy Intermediate-Scale Quantum. The current era: tens to hundreds of qubits, no error correction, noise accumulating faster than most useful algorithms finish.
Photon-number splitting
An attack exploiting multi-photon pulses from attenuated lasers. The attacker keeps one photon and forwards the rest, learning key bits without adding any error. Countered by decoy states.
QBER
Quantum bit error rate — the fraction of mismatched bits in a publicly compared sample. Above roughly 11% (protocol-dependent, derived from where the secure-key fraction reaches zero) the protocol aborts.
QKD
Quantum key distribution. Uses quantum states to agree a key such that eavesdropping is detectable. Requires dedicated optical hardware and secures only a point-to-point link between fixed endpoints.
Shor’s algorithm
A quantum algorithm solving integer factoring and discrete logarithm in polynomial time, breaking RSA, Diffie-Hellman and all elliptic-curve schemes. No key size restores security.
Sifting
The stage where Alice and Bob discard every pulse where their measurement bases differed. In BB84 roughly half the pulses survive.
SLH-DSA
Stateless hash-based signatures, standardised as FIPS 205. Security rests only on hash function soundness, making it a hedge against a future break of lattice assumptions.
T1 / T2
Coherence times. T1 is energy relaxation, T2 is dephasing. On Origin Wukong-180, T1 is around 40 microseconds and T2-echo around 20 microseconds.
Trojan horse attack
Injecting light into Alice’s or Bob’s apparatus and reading the back-reflection to learn encoding settings. Countered by optical isolators and watchdog detectors.