I’m not aware of anything stopping it except for perhaps how the system is set up.
Like if I want to fund a pet study that I’m interested in, can I just call up Harvard and offer the lab $1M to work on it? I’ve never heard of anyone doing that, but I’m not really sure why it doesn’t exist (which is why I’m asking if anyone else knows).
More or less. Corporations fund research all the time. Just to pick a random example, check out the acknowledgements on this paper: https://eprint.iacr.org/2025/132
"This work was funded in part by NSF Award CNS-2054869 and gifts from Apple, Capital One, Facebook, Google, and Mozilla."
That said, private grant funding is just of a completely different scale than government grant funding. For example, NIH's annual budget is 48 billion and most of that goes to research (https://www.nih.gov/about-nih/organization/budget).
As far as I understand, the key material for any post quantum algorithm is much, much larger compared to non-quantum algorithms which leads to huge overheads in network traffic and of course CPU time.
[1]: https://eprint.iacr.org/2025/1237
- Current PQ algorithms, for both signature and key establishment, have much larger key sizes than traditional algorithms. In terms of compute, they are comparably fast if not faster.
- Most protocols (e.g., TLS, SSH, etc.) do key establishment relatively infrequently (e.g., at the start of the connection) and so the key establishment size isn't a big deal, modulo some interoperability issues because the keys are big enough to push you over the TCP MTU, so you end up with the keys spanning two packets. One important exception here is double ratchet protocols like Signal or MLS which do very frequent key changes. What you sometimes see here is to rekey with PQ only occasionally (https://security.apple.com/blog/imessage-pq3/).
- In the particular case of TLS, message size for signatures is a much bigger deal, to a great extent because your typical TLS handshake involves a lot of signatures in the certificate chain. For this reason, there is a lot more concern about the viability of PQ signatures in TLS (https://dadrian.io/blog/posts/pqc-signatures-2024/). Possibly in other protocols too but I don't know them as well