Standardization bodies such as NIST and ISO are in the process of publishing new PQC standards, to complement and eventually replace the older, quantum vulnerable standards for key exchange and digital signatures. Together with the existing standards for symmetric cryptography and hash functions, they are the workhorses that protect confidentiality, integrity and authenticity in our digital infrastructure.

There is also a wide range of – usually non-standardized – privacy-enhancing cryptographic schemes which are incredibly powerful, yet less widely adopted. Multiple of these cryptographic schemes are quantum vulnerable and need replacement. However, practical post-quantum alternatives are not always readily available as they come with significant research challenges. This considerably complicates PQC migration of privacy-enhancing cryptography (PEC).

This section discusses four types of privacy-preserving cryptography: Zero-knowledge proofs, anonymous credentials, oblivious pseudorandom functions and fully homomorphic encryption.

Zero-knowledge proofs

A zero-knowledge proof (ZKP) enables one party to prove a claim to another party without disclosing further details about that claim. In 2026, Google Quantum AI, along with other researchers, published a scientific paper on how a sufficiently powerful quantum computer could break ECC. Instead of disclosing details about the quantum circuit, the correctness of the benchmarks was proven using a – quantum vulnerable – ZKP.

ZKPs are increasingly adopted in blockchain context to protect confidentiality and privacy, as well as for scalability. Prevalent ZKP technologies, such as zk-SNARKs and Bulletproofs, are not quantum-resistant. Partly due to this, zk-STARKs were introduced in 2018. This technology significantly increases proof size from 0.2–0.6 KB to 45–200 KB, making proofs roughly 300 times larger. Moreover, it has a smaller developer community and is currently less mature. Their uptake by the blockchain community remains limited for the time being.

Google Longfellow is an open-source system built by Google and released in 2025. It integrates with the European Digital Identity (EUDI) Wallet and enables citizens to selectively disclose personal data. Longfellow allows citizens to derive quantum-safe ZKPs about personal attributes contained in traditional identity documents. Although computationally efficient, the proof size, which lies around 325 KB for a single attribute, is large. Moreover, it is currently unable to derive proofs from identity documents signed with PQC digital signature algorithms.

More recently, IBM Research developed LaZeR, a library that enables quantum-safe concise and computationally efficient proofs. This is still in a research phase and not suited for production environments.

Anonymous Credentials

Anonymous credentials, which have been proposed in the early 2000s, rely heavily on ZKPs. They enable a citizen  to selectively disclose personal information, instead of revealing all information on an official document such as an identity card or driving license. A typical example is proving that you are older than 18 and a Belgian resident while hiding other information contained in the anonymous credential, such as exact date of birth and social security number. In contrast to solutions such as Google Longfellow, anonymous credentials work with their own algebraic structures and cannot deal with legacy identity documents. The technology comes with a set of powerful properties, such as conditional anonymity and unlinkability. The former enables a dedicated party to identify the user in case of abuse, while the latter guarantees that verifiers cannot link multiple presentations of the same anonymous credential.

Anonymous credentials are a fairly widely adopted technology.

• It has been adopted by the government of the Canadian province British Columbia.
• In the Netherlands, Yivi, formerly known as IRMA, is an identity solution for citizens based on anonymous credentials. It is used by the municipality of Nijmegen, to perform KYC (know your customer) in the banking sector and it is being tested in the healthcare sector.
• Signal, the popular secure messaging app with approximately 70 million users, uses keyed-verification anonymous credentials (KVACs) to manage private groups.
• A TPM (Trusted Platform Module) is a security chip in a computer. It can prove the integrity of the system to an external entity in a privacy-friendly manner, which is done using a type of anonymous credential linked to the TPM chip. Intel’s technology applied in its secure SGX chips is called Enhanced Privacy ID (EPID). To date, more than 2.5 billion EPID credentials have been issued. It is arguably the most successful application of anonymous credential technology today.

The technology used in all the above use cases is quantum vulnerable. Currently, only a few quantum-safe systems for anonymous credentials have been proposed. These systems are still new and much less performant, both I terms of computation and communication. More research is therefore ongoing.

Oblivious pseudo-random function

A pseudo-random function (PRF) is a deterministic function whose output cannot be distinguished from randomly generated numbers, without knowledge of the key, which is given as input together with a chosen input value. Oblivious pseudo-random functions (OPRFs) enable two parties to compute jointly a pseudo-random function, whereby only the party that provides the input value learns the result, while the other party, who has the key, learns nothing. OPRFs are used, among others, for password-based authenticated key exchange (PAKE) and for checking passwords against breach lists while keeping the password confidential.

No battle-tested efficient quantum-safe OPRFs are available today. Recently, however, there have been scientific breakthroughs, such as Leap, which is a lattice-based OPRF. These results are still experimental.

Fully homomorphic encryption

Fully homomorphic encryption (FHE) enables arbitrary computations on encrypted data. The idea was launched in 1978 and the first scheme was presented in 2009. Its speed has historically been the main bottleneck, but thanks to consistent improvements in algorithms and implementations as well as the development of hardware accelerators, it is expected to become practical for an increasing number of use cases in the next years. Just as prominent PQC standards, it is typically based on mathematical problems defined in lattices, more in particular on the Learning with Errors (LWE) problem. Such problems are assumed hard for both classical and quantum computers. Steps are being taken in preparation of a potential future standardization of this technology.

Today, its practical use is limited to some specific use cases in the context of private information retrieval, such as Password Monitoring in Microsoft Edge, Caller identity retrieval and spam blocking by Apple, and Identifying points of interest (POI) on pictures, also by Apple.

FHE is a generic technology; when used as a building block, it is fairly straightforward to build on top of this quantum-safe alternatives for multiple PEC categories, such as the previously discussed OPRF, but also private set intersection (PSI), and oblivious transfer (OT). Today, this approach can be extremely slow. However, thanks to the performance improvements, it may become a competitive option in the future, especially once standardized. It is for an organisation indeed safer and easier to maintain a single standardized scheme rather than several non-standardized ones.

Conclusion

Privacy-enhancing cryptography (PEC) is a group of cryptographic schemes with powerful capabilities. . Although less widely used than standard cryptographic workhorses, they are still fairly broadly adopted. Since these schemes are not standardized, applying them in real-world environments comes with additional risks. The most prevalent threat today for many of these PEC types is the lack of mature, practical quantum safe schemes. This makes it extra challenging to meet the PQC migration targets. A summary of the current state is given in the table below.

Category	Description	Quantum readiness
Zero-knowledge proofs	One party proves a claim to another party without disclosing further details about that claim.	Quantum-safe alternatives are available, but proofs are orders of magnitude larger or still in research phase.
Anonymous credentials	A citizen selectively discloses personal information (e.g., age > 18), instead of revealing all information on a digital document.	Quantum-safe alternatives are still new and insufficiently performant.
Oblivious pseudo-random function	Client & server jointly compute a pseudo-random function[1]. The client only learns the result, while the server, who has the key, learns nothing.	No battle-tested efficient quantum-safe alternatives available today. Recent scientific breakthroughs are promising.
Fully homomorphic encryption	Arbitrary computations on encrypted data.	Quantum-safe. Hardware acceleration required to make it practical.

In case no competitive quantum safe PEC alternatives are available yet, it is recommended to prepare for a future migration by making existing systems that use PEC crypto agile. The actual migration is performed once sufficiently performant quantum-safe alternatives reach maturity. This is indeed what is currently happening in, for instance, the Yivi project.

---

This is a contributed article by Kristof Verslype, a cryptographer at Smals Research. It was written in a personal capacity and does not represent the position of Smals.