Why combining classical and post-quantum cryptography is the pragmatic migration path

A post on dev.to walks through one of the most practical questions in current security engineering: how do you protect data against future quantum computers without abandoning the classical algorithms that have secured systems for decades? The author's answer is hybrid encryption — running a classical and a post-quantum algorithm side by side — and the post comes with a working reference point, an open-source library called Quipu that implements the approach for data at rest.

Two camps, two different risks

According to the post, every new cryptographic algorithm creates a tension. Classical algorithms such as X25519 for key exchange and Ed25519 for signatures have resisted attack for years, but a capable quantum computer is expected to defeat them. Post-quantum algorithms such as ML-KEM and ML-DSA are designed to withstand quantum attacks, but they are young and have accumulated far less scrutiny.

Hybrid schemes resolve the standoff by using both at once. As the post frames it, the combined system only breaks if both components fail simultaneously: a purely classical attacker would need to defeat the post-quantum half, while a quantum attacker would need to defeat the classical one as well. The result is protection against the future without betting everything on a single young algorithm.

How the combiner works

The post applies the idea in two places:

• Key exchange. X25519, the fast and heavily tested classical option, is combined with ML-KEM-1024, NIST's post-quantum key encapsulation mechanism at its highest parameter set. The two resulting secrets are mixed through HKDF, a key derivation function bound to the surrounding context, so that neither secret alone is sufficient to derive the final key.
• Digital signatures. Ed25519 is paired with ML-DSA-87, and a message is accepted only if both signatures verify — an AND combiner, meaning a forger must defeat two unrelated schemes at once.

The rule that never goes out of date

The post leans on Kerckhoffs's principle: a system must stay secure even when the attacker knows its entire design, because security lives in the keys rather than in hidden formats. In practice, the author argues, that means composing public, audited primitives — XChaCha20-Poly1305 for encryption, Argon2id for deriving keys from passwords, HKDF for domain separation — and never inventing novel cryptography.

Quipu, and an honest caveat

Quipu implements exactly this design for data at rest: hybrid X25519 plus ML-KEM-1024 encryption, hybrid Ed25519 plus ML-DSA-87 signatures, and only verified primitives underneath. According to the post, the library targets NIST security level 5, in line with CNSA 2.0, and the code is open source under AGPL-3.0 on GitHub, so anyone can review how the construction works.

The author is also upfront about a limitation: although Quipu composes standard primitives, the composition itself has not yet passed an independent cryptographic audit. For genuinely high-value secrets, the post suggests treating that external review as the seal worth waiting for — a reasonable position, since flawed composition is a classic way for individually sound primitives to fail together.

Why it matters

Migration to post-quantum cryptography cannot wait until quantum computers exist, yet it also cannot safely jump straight to algorithms with a short track record. Hybrid constructions dissolve that dilemma: against today's attackers they are no weaker than their strongest component, while already providing protection against the quantum threat. That hedging property is what makes hybrids the pragmatic default for migration, and the post works as a compact blueprint for building one. The Quipu caveat carries its own lesson for the field — using well-audited primitives is necessary but not sufficient, and open, reviewable code plus an independent audit is the standard a hybrid library should meet before it guards anything serious.