Quantum computers just got much more dangerous: the encryption threat

01Why quantum computing threatens encryption

Modern digital security relies on the computational difficulty of certain mathematical problems. RSA encryption, for example, depends on the fact that multiplying two large prime numbers is easy, but factoring the product back into those primes is computationally intractable for classical computers.

Quantum computers exploit quantum-mechanical phenomena like superposition and entanglement to perform certain calculations exponentially faster than classical machines. This speedup is not universal; quantum computers are not simply faster versions of classical ones. But for specific problems like integer factorization and discrete logarithms, they offer a catastrophic advantage.

The threat is not theoretical. Every encrypted message ever recorded and stored by an adversary could be decrypted retroactively once a sufficiently large quantum computer exists. This harvest-now-decrypt-later strategy means the clock is already ticking for data that must remain confidential for decades.

02Shor algorithm and RSA vulnerability

Shor's algorithm, developed by Peter Shor in 1994, is a quantum algorithm that can factor integers in polynomial time. On a classical computer, factoring a 2048-bit RSA key would take billions of years; on a sufficiently large quantum computer, it could take hours or days.

The algorithm works by reducing factoring to a problem called order-finding, which quantum computers can solve efficiently using the quantum Fourier transform. The quantum advantage is exponential, meaning that once the qubit threshold is crossed, adding more bits to the RSA key provides only marginal additional security.

RSA is not the only victim. Elliptic curve cryptography, used in Bitcoin, TLS, and countless other systems, is also vulnerable to a quantum variant of Shor's algorithm. The discrete logarithm problem that underpins ECC is solvable by quantum computers with comparable efficiency.

03The post-quantum cryptography race

Post-quantum cryptography refers to cryptographic algorithms that are believed to be secure against quantum attacks. Unlike quantum key distribution, which requires specialized hardware, PQC algorithms run on classical computers and can be deployed through software updates.

The National Institute of Standards and Technology completed its multi-year PQC standardization process in 2024, selecting four algorithms for standardization: ML-KEM for key encapsulation, ML-DSA for digital signatures, SLH-DSA as a hash-based fallback, and FN-DSA for specialized use cases.

The transition is monumental. Every encrypted connection on the internet, every code signing certificate, every VPN tunnel, and every cryptocurrency wallet must eventually be migrated. The internet engineering community has begun building hybrid protocols that combine classical and post-quantum algorithms to provide security during the transition period.

04Which encryption standards are at risk

Public-key algorithms based on integer factorization or discrete logarithms are directly vulnerable. This includes RSA, DSA, Diffie-Hellman key exchange, and all elliptic curve variants including Curve25519 and NIST curves.

Symmetric algorithms like AES are less vulnerable. Grover's algorithm, another quantum algorithm, provides a quadratic speedup for brute-force search, effectively halving the key strength. AES-256 would provide approximately 128 bits of post-quantum security, which remains adequate.

Hash functions like SHA-256 are also relatively resistant, with Grover's algorithm reducing their effective security by half. The critical vulnerability lies in public-key cryptography, which forms the backbone of internet authentication and key exchange.

05Timeline when will quantum computers break RSA

Estimates vary widely. Some researchers believe a cryptographically relevant quantum computer could exist within 10 to 15 years, while others consider 20 to 30 years more realistic. The uncertainty stems from the difficulty of scaling quantum error correction, which is essential for running Shor's algorithm on large keys.

Physical qubits are noisy and require error correction overhead. A machine capable of breaking RSA-2048 might need millions of physical qubits to produce the thousands of logical qubits required. Current quantum computers have hundreds to low thousands of physical qubits, though error correction has improved.

Recent advances in quantum error correction, including demonstrations of logical qubits with lower error rates than their physical constituents, have shortened the perceived timeline. Some experts now treat a 10-year horizon as plausible, particularly given the harvest-now-decrypt-later threat to long-lived data.

06What governments and companies must do now

The migration to post-quantum cryptography cannot wait until quantum computers arrive. Organizations must inventory their cryptographic assets, identify systems that use vulnerable algorithms, and plan migration paths that account for long-lived data and systems with extended deployment cycles.

The U.S. National Security Memorandum 10 and subsequent directives require federal agencies to prepare for the transition. The Cybersecurity and Infrastructure Security Agency has published guidance, and the Office of Management and Budget has set deadlines for agency compliance.

Private companies face similar pressures. Financial institutions, healthcare providers, and infrastructure operators must protect data that could remain sensitive for decades. The transition is complicated by legacy systems, embedded devices, and protocols that cannot be easily updated.

07The y2q problem explained

Y2Q, short for Years to Quantum, is the cybersecurity community's analog to the Y2K problem. It refers to the estimated time until a quantum computer capable of breaking current public-key cryptography becomes operational, triggering a global migration deadline.

Unlike Y2K, the Y2Q problem does not have a fixed date. The deadline is uncertain, and the consequences of missing it include retroactive decryption of all previously intercepted encrypted traffic. This asymmetry makes preparation more urgent, not less, because the cost of being late is irreversible.

The concept has gained traction in policy circles. The longer organizations wait to begin migration, the more expensive and risky the transition becomes. Early movers benefit from learning curves and avoid the rush that will inevitably occur as the quantum threat becomes imminent.