Will Quantum Computers Really Break All Encryption? — Two Misconceptions: "All" and "Later"

A Standard Candidate That Fell Without a Quantum Computer

In 2016, the U.S. National Institute of Standards and Technology (NIST) kicked off a standardization project to select new public-key cryptography that could withstand even quantum computers (arXiv:1912.00916, preprint). A quantum computer is a new kind of computer that uses the laws of physics for extremely small particles in its calculations, and a public key is an open padlock put out for anyone to use (as defined in "Keys and Locks — Why a Public Key Is Safe to Publish"). Post-quantum cryptography is public-key cryptography newly built upon problems considered hard to solve even with a quantum computer. A preprint is a paper released before peer review, and this article notes that inside parentheses for such literature.

Round 1 opened in December 2017 with 69 candidates. After three rounds of evaluation, four algorithms were selected for standardization, and four key-establishment candidates — BIKE, Classic McEliece, HQC, and SIKE — advanced to Round 4 for further analysis (DOI: 10.6028/nist.ir.8413). Key establishment is the procedure that allows two distant parties to share the same secret key.

SIKE failed to become a standard. What brought SIKE down was not a quantum computer, but an ordinary classical computer, meaning the kind of computer we use today.

"Keys and Locks" notes that the value for opening a public key is merely expensive for now, and pointed to quantum computers as the machines that could make that value cheap. This article starts from the next question: once the value becomes cheap, what collapses and by how much?

The sentence "Once quantum computers are finished, all current cryptography becomes useless" constantly tags along in discussions of quantum computers. That sentence is only half right, and the wrong half matters more. This article unpacks two misconceptions in that sentence in turn. First, "all" is wrong. What collapses is only one type of cryptography. Second, "later" is wrong. The danger has already begun, ahead of the day quantum computers are finished. We then follow the collapse of SIKE.

This article does not cover how to build a quantum computer. Why qubits — the basic units quantum computers use for calculation — are fragile and how error correction works are separate stories. Here, we set the condition "if a sufficiently large quantum computer arrives someday," and look only at what happens to cryptography then. We neither stir up the fear common in this field nor offer reassurance.

The Common Belief That When Quantum Computers Are Finished, All Ciphers Will Collapse

The common belief has grounds. They are two quantum algorithms known in the 1990s. Shor's algorithm is a quantum algorithm that solves prime factorization and the discrete logarithm in polynomial time. Grover's algorithm is a quantum algorithm that reduces the search of trying answers one by one to the square root level.

Exponential time and polynomial time are terms that distinguish how much the amount of computation swells when a problem grows. A problem taking exponential time sees its computation swell uncontrollably even with just a slight increase in digits. A problem solvable in polynomial time does not see its computation explode by that much even when digits increase.

As "Keys and Locks" showed, a public key rests upon a one-way computation, in other words, a computation that anyone can do quickly in one direction but where reversing it the other way is absurdly difficult. Prime factorization is that difficult direction of recovering the original two numbers by looking only at the product. The discrete logarithm is another difficult direction of finding out how many times the same operation was repeated by looking only at the result. The security of RSA, Diffie-Hellman, and Elliptic Curve Cryptography (ECC), which are widely used public key schemes today, leans on the mathematical difficulty of these two problems. While these problems see their computation swell much more steeply (close to an exponential) than polynomial time with classical algorithms, Shor's algorithm solves them in polynomial time. Meanwhile, Grover's algorithm gives a square-root-level time advantage in the key search of symmetric key schemes like AES and 3DES (arXiv:2202.02826, preprint).

It is a single step to the conclusion that "everything breaks." The certificate system connecting public keys and their owners—in other words, Public Key Infrastructure, the backbone of internet security today—has long stood almost entirely on RSA and ECC. Website certificates, messenger key exchanges, software signatures, and even blockchain wallets have been this way. If this collapses all at once, the word "everything" does not sound like an exaggeration alone. The first misconception starts here.

What Collapses Is the Way We Hand Over the Keys

By the definition in "Keys and Locks", a symmetric cipher is one where the key that locks is the same as the key that unlocks. Locking a file with a password is an example. It is fast and robust, but you and the other person must share the same key in advance. Public-key cryptography lifts that burden. You lock with a public key that anyone can take and use, and only the owner opens it with a private key kept to themselves and sent to no one. We can converse securely with a server we have never met before precisely because of this method.

The threat of quantum computers acts on these two with entirely different magnitudes. RSA and elliptic-curve cryptography are at risk of being neutralized by quantum computers, while symmetric algorithms like AES-128 maintain their security under quantum attacks while their effective key length is reduced (arXiv:2603.06969, preprint). The effective key length is the effort an attacker actually has to expend, converted into the number of bits of the key. Symmetric keys merely weaken, and you can undo that as much by using longer keys. A 2022 review paper summarizing the NIST standardization process reaches the same judgment. It notes that symmetric-side components like block ciphers and hash functions will "only slightly" be damaged (DOI: 10.30837/rt.2022.3.210.05). A hash function is a function that shrinks a text of any length into a single short value of a fixed length (from "What Is a Blockchain — Why a Ledger With No One in Charge Holds Up").

The difference comes from the scale of the gain. Brute-force is an attack that tries out every possible key one by one. If it classically takes 2^128 attempts to find a 128-bit key via brute-force, quantumly it theoretically takes its square root, in other words roughly 2^64 repetitions. That means the effective key length is halved. It is a large gain, but symmetric keys return to their original place if you double the key length. This is because the square root of a 256-bit key is 2^128 again. The gain that Shor's algorithm gives to public keys is a leap from exponential time to polynomial time. It is a qualitative difference that cannot be caught up with by simply lengthening the key slightly.

The gap between theory and reality is also large for Grover's attack. Every time it repeats, Grover's algorithm calls a component that asks "Is this key correct?", namely an oracle. If this oracle occasionally fails in real hardware, the moment that failure crosses a certain threshold, the success probability collapses sharply. That practical reliability threshold drops exponentially according to the problem size (the threshold is proportional to 2^(−n/2)). Even when n=40, the oracle must fail less than roughly once per 800,000 repetitions for the quantum advantage to hold, and as the key grows larger, the demand becomes geometrically harsher. While stating that this result does not deny the theoretical correctness of Grover's algorithm, the authors conclude that under realistic hardware constraints, the feasibility of Grover-based attacks can be considerably lower than commonly assumed (DOI: 10.20944/preprints202602.0122.v1, preprint).

There are even more extreme calculations. A secret key 831 bits long has been calculated to be unrecoverable even by the point when star formation is projected to stop in a universe dominated by expanding dark energy (arXiv:2603.13654, preprint). This is an extreme value incorporating cosmological assumptions and is not an engineering prediction. Even so, the direction is clear. A sufficiently long symmetric key remains practically unscathed even in front of a quantum computer.

However, a condition is attached to "symmetric keys are safe." Our trust in symmetric ciphers largely relies on a track record of withstanding all sorts of decryption techniques, and that track record must be re-verified in the quantum world. Differential analysis and linear analysis are representative classical techniques for attacking symmetric ciphers. Quantum versions of these techniques can generally also achieve square-root acceleration. Yet this is not true for all variants, and there is no guarantee that the best attack in the classical world is also the best attack in the quantum world (arXiv:1510.05836, preprint).

If we make the attacker's capabilities stronger, the warnings become sharper as well. Quantum queries are the assumption that an attacker can cast questions in a superposition state into a device containing a key. In this strong model, a quantum algorithm called Simon's algorithm can distinguish 3-round Feistel structures or forge CBC-MAC (DOI: 10.26421/qic17.1-2-4). A Feistel structure is a common skeleton for building symmetric ciphers, and CBC-MAC is a method of attaching an anti-forgery tag to messages. This is a problem of specific configurations and not a collapse of symmetric ciphers across the board. Still, the authors believe that classical security proofs must be re-examined in front of a quantum attacker.

What collapses in front of a quantum computer is the way we safely hand over keys and prove our identities—in other words, public-key cryptography. Symmetric keys, which lock the vault, push through by making the keys longer. And the internet is built right on top of that handover.

The Danger Started Today — Harvest Now, Decrypt Later

The second misconception is about timing. The statement "We can just switch when quantum computers arrive" does not hold up. That is because ciphertexts can be stored.

Attackers are right now scraping up and saving encrypted communications moving back and forth. They cannot crack them today. When a sufficiently powerful quantum computer eventually exists, they will open their warehouses and work backward to decrypt past communications. "Harvest now, decrypt later" is an attack strategy where ciphertexts are collected today to be cracked after a quantum computer exists.

What makes this strategy a threat is cost. TLS is the protocol protecting the connection between a browser and a site with encryption as seen in "Keys and Locks", and QUIC and SSH are also protocols protecting communications with encryption. Looking at the attacker's costs across all three, the cost of storing intercepted traffic is economically trivial (arXiv:2603.01091, preprint). Therefore, the question for the defending side shifts from "Can the attacker store it?" to "How much does decryption cost?"

The same study divides defenses into two branches. The approach of inflating the storage volume the attacker must accumulate also imposes burdens on the defender. The approach of inflating the quantum computations required for decryption targets only the attacker. Thus, apart from moving to post-quantum cryptography, among the measures that can be used with just current settings, frequent key renegotiation (rekeying) and large key parameters are considered the strongest defense levers (arXiv:2603.01091, preprint).

The side currently at risk is the one where secrets that need to be protected today have a long lifespan. The exposure window is the period during which stored ciphertext remains in a state where it can be decrypted in the future. As a result of modeling this threat as a risk that changes over time, sectors that store data for a long time, such as satellite communications or healthcare, are placed in exposure windows lasting decades if their transition to post-quantum cryptography is delayed. The result of this model is that employing devices like hybrid key exchange and forward secrecy reduces that risk horizon by more than two-thirds (DOI: 10.3390/telecom6040100). Forward secrecy is a property that ensures past communications cannot be decrypted even if a long-lived key is compromised later. However, if an attacker directly cracks the recorded key exchange using a quantum computer, this property alone does not stop them, which is why this model also places it alongside hybrids. Hybrid refers to the layering method we will look at later.

In blockchains, this threat operates ironically. Anyone can obtain a copy of a blockchain's ledger—that is, the record of who did what and when, written in the order it happened ("What Is a Blockchain — Why a Ledger With No One in Charge Holds Up"). A 2025 analysis published as a Federal Reserve staff working paper (Finance and Economics Discussion Series, not a peer-reviewed academic journal) uses Bitcoin as an example to view it this way. If operating entities adopt post-quantum cryptography, they can protect future security and integrity. Even so, the privacy of past transactions already recorded in the ledger remains vulnerable. This is because anyone can keep a copy of the ledger and reveal masked information at a later date. The authors point out that countermeasures to plug this gap are lacking (DOI: 10.17016/feds.2025.093).

A 2022 German commentary also called this same strategy "Steal now, decrypt later", reporting that experts view that timeline as 10 to 15 years away (DOI: 10.1007/s00287-022-01474-z). This figure is an expectation from the vantage point of 2022 and is not a fixed prediction. As we will see later, timeline estimations of this sort are precisely the most shaky part.

A Candidate That Collapsed on a Laptop Before Quantum Computers Even Arrived

Now we return to SIKE from the introduction. The most dramatic collapse happened without a quantum computer.

An isogeny is a special structure-preserving correspondence rule (mapping) that shifts one elliptic curve to another. SIKE was an isogeny-based cipher. It was built on the assumption that it is difficult to find a secret isogeny among special curves called supersingular elliptic curves, and it had the appeal of much smaller keys. Yet while the fourth round was underway, a classical computer attack on the SIDH key exchange, which forms the foundation of SIKE, was announced. It was an attack run on the kind of computers we use today.

This article reconstructs the events as recorded by subsequent and analytical literature that followed the original attack paper, rather than the original paper itself.

First is the record that the event took place. An endomorphism ring is a mathematical object containing the internal structure of a curve, and given an isogeny, the problem of computing the endomorphism ring of the target curve is, as of 2023, the problem "at the heart of recent attacks that broke the SIDH key exchange" (arXiv:2305.19897, preprint). Another paper evaluating the efficiency of isogeny-based signatures calls these "devastating attacks on SIDH (the underlying mathematical problem)" (DOI: 10.1515/jmc-2023-0023).

The weakness lay in the information SIDH sends along the way. SIDH-based schemes hide the secret isogeny itself, but they also publish information that restricts that isogeny to a specific subgroup of the curve. This auxiliary information is called torsion point information (arXiv:2005.14681, preprint). This became the clue for the attack. Research attempting to mitigate the Castryck–Decru attack, which is counted among the attacks that exposed flaws in SIDH, summarizes the flaws revealed by this attack as "the predictability of torsion points and vulnerabilities in curve parameters" (DOI: 10.21203/rs.3.rs-4813769/v1, preprint).

Warning signs had existed even before that. As summarized in a 2020 paper, Petit first showed in 2017 that torsion point information could noticeably reduce the difficulty of finding a secret isogeny, demonstrating in particular that SIDH with "overstretched" parameters could be broken in polynomial time. However, that result did not affect the security of any cryptosystem proposed in the literature (arXiv:2005.14681, preprint).

This 2020 paper strengthened Petit's technique to completely break a multiparty group key exchange scheme using a classical computer (for 6 parties or more), and also presented backdoor SIDH variants purposely designed to be vulnerable to its own attack. Even so, the authors drew a line. "Our results do not degrade the security of or expose any weaknesses in the NIST submission SIKE" (arXiv:2005.14681, preprint). Danger signs had been present, but the main standard candidate body seemed safe, and that wall would soon fall.

The scale of the collapse is most directly shown by subsequent research published after the incident. This paper, which deals with four-dimensional isogeny computations, writes of their achievement: "Even when the endomorphism ring of the starting curve is unknown, a complete key recovery attack can be carried out in a matter of seconds on a laptop for all NIST SIKE parameters" (arXiv:2407.15492, preprint). Every security level of the standard candidate SIKE was cracked in seconds on an ordinary laptop rather than specialized equipment. This speed comes from the implementation in this 2024 study.

The conclusion remains in the NIST documents. The fourth-round final report noted that among BIKE, Classic McEliece, HQC, and SIKE, "the only key establishment algorithm to be standardized is HQC" (DOI: 10.6028/nist.ir.8545).

Two things should be made clear from this conclusion. First, not all of isogeny cryptography collapsed. The aforementioned signature research notes that despite the devastating attacks, the identification protocol backed by that signature relies on a different (and more standard) isogeny problem and remains secure (DOI: 10.1515/jmc-2023-0023). Afterward, this field rebuilt its foundations. It was proven that the isogeny problem, the endomorphism ring problem, and the maximal order problem are equivalent to each other without unproven assumptions like the Generalized Riemann Hypothesis (arXiv:2502.17010, preprint). Equivalence means that if even one of them is hard (in the worst case), all the rest are also hard (on average). This proof showed that the problems are tied together, while the hardness of the problems themselves remains an assumption. What collapsed was the specific design called SIDH, while the entire mathematical foundation of isogenies survived.

Second, the lesson of this incident is concrete. The security of post-quantum candidates rests not on mathematical proofs, but on the empirical track record of "no one has broken it yet," and that track record can be overturned overnight.

Why Only Public Keys Are Vulnerable — The Work of Finding Hidden Periods

RSA's reliance on prime factorization and the reliance of Diffie-Hellman and elliptic-curve cryptography on the discrete logarithm actually share the same root, despite appearances. A hidden period is the interval at which a calculation repeats until the result loops back to the start. Both problems can be rewritten as finding this hidden period, and period-finding is something quantum computers are exceptionally good at. Shor's algorithm solves both problems in polynomial time this way. These are problems that take exponential time with classical algorithms (arXiv:2202.02826, preprint).

Elliptic curves carry one more ironic asymmetry. For an elliptic curve over an $n$-bit prime field (a number system that counts based on a single prime number), the discrete logarithm can be computed using at most $9n + 2\lceil\log_2n\rceil + 10$ qubits. Using the parameters examined by that study and comparing them on the basis of the same classical security level, the number of qubits required to attack an elliptic curve is smaller than for RSA (arXiv:1706.06752, preprint). ECC's advantage of providing the same security with shorter keys turns into a disadvantage in the quantum world.

The Ground the New Candidates Stand On

The new candidate pool is divided into five families: lattice-, code-, hash-, multivariate-, and isogeny-based. According to a 2026 systematic review, after eight years of public competition, the first three standards came out in August 2024, and a fourth key encapsulation mechanism was additionally selected in March 2025 (DOI: 10.2139/ssrn.7128678, preprint). Key encapsulation is one way to establish a key.

Lattice-based cryptography is the main force. A lattice is a pattern of dots stretching out endlessly at regular intervals, and the shortest vector problem (SVP) is the problem of finding the non-zero dot closest to the origin within it. Lattice-based cryptography relies on the assumption that this problem is hard.

Hash-based signatures are conservative in their assumptions because they only need a hash function, but there is a price. The signature size noted in one review is 17–50 KB (arXiv:2603.06969, preprint). Compared to the signatures we use now, which are tens to hundreds of bytes, this is hundreds of times larger.

Code-based cryptography relies on the hardness of decoding random linear codes. A code is a rule added to a message to correct errors, and decoding is the work of recovering the original message from a noise-mixed signal.

These candidates also hold their ground within the firing range of quantum attacks. The lattice SVP is a target of quantum sieving algorithms. Sieving is a method of generating a large mass of candidate vectors and filtering them to find short vectors, and its quantum version applies Grover's search. A 2021 study reduced the previous best time requirement (roughly speaking) of this algorithm from $2^{0.2653d}$ to $2^{0.2570d}$ ($d$ is the lattice dimension) (arXiv:2105.05608, preprint). Similarly for code-based cryptography, the quantum complexity of an attack called information set decoding was lowered from $2^{0.06035n}$ to $2^{0.05869n}$ ($n$ is the code length) (arXiv:1703.00263, preprint). This battle played out at the second decimal place of the exponent is the actual substance of what we call quantum resistance.

Why Migration Is Difficult

Even if a new algorithm exists, transition is a massive construction project, and there are four stumbling blocks.

First is size. Post-quantum algorithms have large keys and signatures, which collide with the physical constraints of communication protocols. A review analyzing 5G/IoT environments cites a 372-byte SIB1 bottleneck, fragmentation delays caused by splitting large messages to send them, and the energy burden on low-power terminals as specific friction points (DOI: 10.2139/ssrn.6412508, preprint). While this review notes that dropping quantum-resistant cryptography in as-is does not theoretically fit real-time and ultra-low-power uses, it reports that mitigations such as hybrid frameworks, hardware acceleration, signature-free authentication, and secure fragmentation consistently lowered overhead to a viable level in benchmarks and industry pilots, and proposes a phased roadmap through the hybrid transition period of 2025–2030. A 2019 mobile measurement study reports that energy, bandwidth, and latency requirements among algorithms span several orders of magnitude (arXiv:1912.00916, preprint). Even so, it concludes that for most use cases, fast structured lattice methods are the preferred choice for mobile devices connected to the cloud.

Second is hybrid. Hybrid is a method where a new algorithm is used alongside a traditional one, so that if either one breaks, the other remains. It is a realistic path to address the problem that new algorithms have a short track record. In a simulation overlapping classical key exchange with lattice-based key encapsulation, the public key grew to roughly 1.2KB and handshake latency increased by 18%, which the authors consider manageable (DOI: 10.15680/ijircce.2026.1406040). A handshake is the procedure where both sides exchange messages to establish keys when a connection is first made.

Third is implementation. Even if an algorithm is secure, it is useless if the implementation leaks. Side-channel attacks read secrets from incidental signals like computation time or power, and fault-injection attacks extract secrets by deliberately causing errors in the device. A study examining such attacks on the lattice-based algorithms selected for standardization (Kyber and Dilithium) organizes an extensive list of attacks and tailored countermeasures for them, which were applied with reasonable performance overhead on both embedded platforms evaluated (DOI: 10.1145/3603170).

Fourth is the long tail. Many organizations do not even know what they need to change. The starting point highlighted by a study on static analysis tools is that most codebases lack even the tools to automatically catalog the classical cryptography they use (arXiv:2604.00560, preprint).

Because of this, transition period estimates are long. A 2025 expert synthesis suggests 5–7 years for small businesses, 8–12 years for mid-sized ones, and 12–15 years or more for large enterprises under baseline assumptions. The authors view this not as an isolated upgrade, but as a task that the entire ecosystem must coordinate together. They place this schedule alongside the window they set for the arrival of fault-tolerant quantum computers capable of long calculations while correcting errors (2028–2033) (DOI: 10.3390/computers15010009).

The cost structure is also ironic. An estimate pegging the deployment cost for Google alone at $1.17 billion to $3.85 billion points out a paradox: adopting early brings heavy initial costs and personnel burdens, while adopting late lowers costs but leaves you carrying the risk of retrospective decryption (DOI: 10.36227/techrxiv.176583452.24018891/v1, preprint). Because this figure is the product of a specific model, it is better to read the structure than the exact amount.

When Is Q-day — Qubit Count Estimates Depend on Assumptions

The day when quantum computers can actually break current public keys is commonly called Q-day, and no one knows when that day will be. Even the question "How many qubits are needed to break RSA?" does not have a single answer. Qubit count estimates vary completely depending on what is being counted, in what units, and under what conditions.

The units themselves differ. Physical qubits are noisy qubits that actually exist in hardware. Logical qubits are single reliable qubits for computation made by bundling multiple physical qubits together to correct errors. The extra cost required for this bundling is the error-correction overhead.

An estimate cited as background in a 2023 paper is that, taking error-correction overhead into account, about 20 million (noisy) physical qubits are needed to factor a 2048-bit RSA key in 8 hours (arXiv:2303.04656, preprint). This number comes with conditions: "within 8 hours," "physical qubits," "including error-correction overhead," and "an estimate as of that time."

Change the target and the units, and the numbers change completely. One preprint compiling elliptic curve attack resources estimates that 2,330 logical qubits are needed to break the standard elliptic curve NIST P-256 using pure Shor's algorithm. Because this is a value before conversion to physical qubits, it is not a number that can be directly compared to the 20 million above. The same preprint projects that recent engineering innovations could reduce future requirements by 1.5 to 2.3 times, dividing the scenarios into three. The conservative scenario is 2033–2035, the realistic scenario is 2031–2033, and the optimistic scenario is 2029–2031 (DOI: 10.20944/preprints202509.2429.v2, preprint).

This literature is a preprint that has not undergone peer review, and the authors themselves state that the basis for the timeline predictions is the convergence of corporate and government roadmaps. Roadmaps are plans, not performance. While the authors point to the gap between quantum memory and logical operations as a remaining core engineering challenge, they write that new demonstrations released up to October 2025 are rapidly narrowing that gap. As evidence, they present both figures from a corporate roadmap (200 logical qubits by 2029, 2,000 after 2033) and a government program that has set 2033 as its official milestone together.

There are also variables on the algorithm side. Regev's multi-dimensional factoring algorithm presented in 2023 reduced the number of gates—the basic operations of a quantum computer—but increased qubit requirements and relies on unproven number-theoretic assumptions (DOI: 10.54254/2755-2721/110/2024melb0122). Conversely, a proposal claiming to have dramatically reduced quantum resources turned out to be missing a complexity analysis of the part handled by classical computers upon closer examination (arXiv:2303.04656, preprint). Resource estimation is still a debated topic.

The Trap of "Already Factored" Demonstrations

When you see news reporting that "a quantum computer has factored a certain number," there is a point to check. The order is the exact hidden period that Shor's algorithm needs to find. If you tear down the circuits of various factorization experiments, the circuits of some experiments were built on the condition that the order of the target number was known in advance. Not knowing that order in the actual algorithm is the entire problem. Such circuits are inappropriate as implementations of Shor's algorithm, and the remaining experiments were also built by relying heavily on the composite number in question (DOI: 10.1007/978-981-15-5191-8_7).

A 2026 preprint points out the same problem. This study, which ran the core steps of Shor's algorithm on actual hardware, points out that existing experiments "rely on heavy circuit compilation to unintentionally bake prior knowledge of the correct answer into the circuit, bypassing the core challenge of quantum arithmetic." And it established a transparent baseline; the numbers handled that way were 51, 85, 255, and 771 (DOI: 10.21203/rs.3.rs-9793578/v1, preprint).

However, the targets were structured composite numbers composed of Fermat primes to make modular arithmetic simpler. Up to N=255, the fidelity reached up to 0.946, and for N=771, it merely showed quantitatively that the circuit deepens, noise accumulates, and the signal degrades. The distance to a 2048-bit RSA remains vast.

Even the New Standards May Not Hold Forever

The question left behind by the collapse of SIKE returns right here. Are lattices safe? The honest answer is "so far, yes."

Regarding the practical effectiveness of quantum attacks, there is actually skeptical evidence. A 2024 study that meticulously analyzed the resources of lattice-based algorithms calculated that even with very optimistic assumptions like a circuit-level noise of 10^-5, solving an SVP in dimension 400 would require about 10^13 physical qubits and about 10^31 years (arXiv:2410.13759, preprint). Dimension 400 roughly corresponds to the minimum security level that NIST was proposing at the time of that analysis. The authors estimate that a 6GHz single-core classical computer would take nearly the same amount of time for the same problem. They conclude that at cryptographically meaningful dimensions and as of that analysis, quantum speedup is practically nonexistent, and that obtaining a major speedup would require substantial breakthroughs in both theory and hardware.

However, the threat does not come solely from quantum computers. As SIKE showed, a classical breakthrough could arrive faster. LWE is the problem of finding a secret in a system of linear equations mixed with error, and it forms the foundation of lattice-based cryptography. A 2025 preprint tested attacks on an LWE-based scheme using two models (SALSA and VERDE) built with transformers, the neural network architecture used in large language models. Among the two models, VERDE achieved a higher attack success rate in higher-dimensional settings, and the authors consider that such attacks raise concerns for the robustness of lattice-based cryptography. Whether they reached actual standard parameters cannot be known from this abstract alone (DOI: 10.36227/techrxiv.174910091.18242062/v1, preprint). It is clear, at least, that new attack tools are emerging.

Unresolved issues also remain within the standardization process itself. The systematic review mentioned earlier points out four tension points that primary literature has not concluded. First, why NIST chose HQC instead of BIKE, which has smaller keys. Second, why the Falcon-family signature standard remained in draft form for nearly two years after its sibling standards were finalized at the time that review was written. Third, the structural limitations remaining even after standardization in ML-KEM, the key encapsulation standard derived from Kyber. Fourth, which of the hard-problem assumptions that have become standards will best withstand future decryption technique developments (DOI: 10.2139/ssrn.7128678, preprint).

Why Migrate Now Even If We Do Not Know When It Arrives

The logic for paying the cost now even without knowing when Q-day arrives is simple. The lifespan of the secrets to protect + the time taken for migration must be less than the time until a quantum computer arrives to be safe. If the first two terms are on the scale of decades and over a decade respectively, there is already no room left no matter how uncertain the third term is.

The aforementioned 2022 review paper points in the same direction. It notes that the fact that standardization continues should not be read to mean that users can delay adoption. However, it notes that migration comes with various complexities, and that there will be particular challenges in use cases such as small devices connected to the internet (IoT) or Certificate Transparency, where every certificate issuance is written to a public record ("What Does the Padlock in Your Address Bar Actually Guarantee?") (DOI: 10.30837/rt.2022.3.210.05).

Therefore, some literature around 2025 moves away from timeline prediction toward risk management. One study recommends starting with a Cryptographic Bill of Materials (CBOM), which lists what cryptography an organization uses and where, and proceeding with hybrid deployment and certificate lifecycle automation together (DOI: 10.37745/ejcsit.2013/vol13n523552). The goal is one. Crypto-agility is the ability to swap out algorithms at any time. In the phrase used by the preceding review, organizations must treat cryptographic security not as a one-time deployment, but as an ongoing process (arXiv:2603.06969, preprint).

There is also room here to guard against exaggeration. One study that predicted the probability of quantum decryption using a statistical model yields a figure where the probability remains negligible until 2029 and then surges to 78.6% in 2033 (DOI: 10.9734/acri/2025/v25i31098). This probability, written down to the first decimal place, is a value produced by predictive models like ARIMA and Monte Carlo along with their input assumptions, not a value guaranteed by physics.

The Safety of Cryptography Is a Track Record of Surviving Time, Not a Mathematical Proof

What this debate ultimately asks, beyond the number of qubits, is what we mean when we say something is "safe."

People commonly believe that cryptography provides mathematically proven safety. However, whether RSA, elliptic curves, lattices, or isogenies, their safety rests on the assumption that "this problem is hard." The evidence that this assumption is true is mostly a track record of "many smart people trying for a long time and still failing to break it." The safety of cryptography is a track record of surviving time, not a proof, and a track record can be overturned overnight. That is precisely what happened with SIKE.

Viewed this way, the three previous stories connect into one. First, the threat is uneven. Symmetric keys hold up simply by making the keys longer, and what collapses is public key cryptography. Second, the time axis runs counter to conventional wisdom. Where data has a long shelf life, future machines already threaten today's communications. Third, danger does not come from quantum computers alone. One standard candidate collapsed on a laptop, and the lesson left by that incident applies equally to the new standards.

Therefore, the correct response is to "make it swappable no matter what comes" rather than "guess when it arrives." When you encounter the sentence "When quantum computers arrive, all cryptography will be broken," you can recall two sentences together. Not all of it will be broken. And we do not have the luxury of waiting. The two sentences do not clash with each other. Holding onto both allows us to stand in a place that is neither fear nor complacency.

Source Papers

• "Status report on the third round of the NIST PQC Standardization process" (2022) — DOI: 10.6028/nist.ir.8413 — 69 candidates in round 1, selection results for round 3, and the advancement of BIKE, McEliece, HQC, and SIKE to round 4.
• "Status report on the fourth round of the NIST PQC standardization" (2025) — DOI: 10.6028/nist.ir.8545 — HQC is the only key establishment algorithm standardized in round 4.
• "Post Quantum Cryptography: Techniques, Challenges, Standardization" (2022) — arXiv:2202.02826 (preprint) — Grover's gives a square-root speedup for symmetric keys, while Shor's solves factorization and discrete logarithms in polynomial time.
• "Securing Cryptography in the Age of Quantum Computing and AI" (2026) — arXiv:2603.06969 (preprint) — RSA and ECC are at risk, while AES-128 is reduced merely to a lower effective key length. Hash-based signatures take 17–50 KB. Cryptographic security is an ongoing process.
• "Status report on the third round of the NIST PQC standardization" (2022) — DOI: 10.30837/rt.2022.3.210.05 — Symmetric primitives will be damaged "only very slightly."
• "Practical Reliability Constraints on Grover-Based Attacks" (2026) — DOI: 10.20944/preprints202602.0122.v1 (preprint) — Reliability thresholds decrease exponentially as 2^(−n/2), meaning the practical feasibility of Grover attacks may be lower than commonly believed.
• "Thermodynamic Limits of Quantum Search" (2026) — arXiv:2603.13654 (preprint) — An 831-bit key cannot be deterministically recovered even by the time star formation ceases (including cosmological assumptions).
• "Quantum Differential and Linear Cryptanalysis" (2015) — arXiv:1510.05836 (preprint) — Quantum acceleration does not arrive for every variant, and the best classical attack is not the best quantum attack.
• "Using Simon's algorithm to attack symmetric-key cryptographic primitives" (2017) — DOI: 10.26421/qic17.1-2-4 — Round 3 Feistel distinguishers and CBC-MAC forgery in the quantum oracle model.
• "On the Practical Feasibility of Harvest-Now, Decrypt-Later Attacks" (2026) — arXiv:2603.01091 (preprint) — Storage costs are trivial, while key renegotiation and key size are the strongest defense levers.
• "Harvest-Now, Decrypt-Later: A Temporal Cybersecurity Risk" (2025) — DOI: 10.3390/telecom6040100 — High-retention sector exposure windows span decades; hybrids and forward secrecy shrink the risk horizon by more than two-thirds.
• "'Harvest Now Decrypt Later': Data Privacy Risks for Distributed Ledgers" (2025) — DOI: 10.17016/feds.2025.093 — Even after migrating, the past transaction privacy of ledgers remains vulnerable.
• "„Steal Now, Decrypt Later“" (2022) — DOI: 10.1007/s00287-022-01474-z — Experts at the time expected that milestone 10 to 15 years out.
• "Hidden Stabilizers, ... the Cryptanalysis of pSIDH" (2023) — arXiv:2305.19897 (preprint) — Explicitly noted as "the core of recent attacks that broke SIDH key exchange."
• "Efficiency of SIDH-based signatures (yes, SIDH)" (2024) — DOI: 10.1515/jmc-2023-0023 — Despite "destructive attacks on SIDH," protocols relying on other isogeny problems remain safe.
• "Strengthening SIDH Protocol Security: Mitigating the Castryck-Decru Attack" (2024) — DOI: 10.21203/rs.3.rs-4813769/v1 (preprint) — The flaws lie in the predictability of torsion points and the curve parameters.
• "Improved torsion point attacks on SIDH variants" (2020) — arXiv:2005.14681 (preprint) — Torsion point information lowers search difficulty. At the time, it was stated to "not compromise SIKE security."
• "Fast computation of 2-isogenies in dimension 4" (2024) — arXiv:2407.15492 (preprint) — A complete key-recovery attack in seconds on a laptop for all NIST SIKE parameters.
• "Unconditional foundations for supersingular isogeny-based cryptography" (2025) — arXiv:2502.17010 (preprint) — Unconditional equivalence of isogeny hard problems.
• "Quantum resource estimates for computing elliptic curve discrete logarithms" (2017) — arXiv:1706.06752 (preprint) — ECDLP qubit upper bound; ECC is an easier target than RSA.
• "Post-Quantum Cryptography: A Systematic Review" (2026) — DOI: 10.2139/ssrn.7128678 (preprint) — Five-family classification, the first three standards in August 2024, the fourth KEM in March 2025, and four unresolved tensions.
• "Lattice sieving via quantum random walks" (2021) — arXiv:2105.05608 (preprint) — Improves SVP quantum sieving complexity from 2^(0.2653d) to 2^(0.2570d).
• "Quantum Information Set Decoding Algorithms" (2017) — arXiv:1703.00263 (preprint) — The difficulty of random linear code decoding, with quantum complexity going from 2^(0.06035n) to 2^(0.05869n).
• "From Harvest-Now-Decrypt-Later to Quantum-Safe 5G/IoT" (2026) — DOI: 10.2139/ssrn.6412508 (preprint) — 372-byte SIB1 bottleneck, fragmentation delay, and energy burden on low-power terminals.
• "Mobile Energy Requirements of the Upcoming NIST PQC Standards" (2019) — arXiv:1912.00916 (preprint) — NIST standardization started in 2016, with energy, bandwidth, and latency differences of several orders of magnitude between candidates.
• "Architecting for Longevity: A Hybrid Cryptographic Framework" (2026) — DOI: 10.15680/ijircce.2026.1406040 — In a hybrid setup, public keys are about 1.2 KB and handshake latency increases by 18%.
• "Side-channel and Fault-injection attacks over Kyber, Dilithium" (2024) — DOI: 10.1145/3603170 — A catalog of attacks on implementations and tailored countermeasures.
• "Quantum-Safe Code Auditing" (2026) — arXiv:2604.00560 (preprint) — Most codebases lack even a tool to inventory classical cryptographic usage.
• "Enterprise Migration to PQC: Timeline Analysis" (2025) — DOI: 10.3390/computers15010009 — 5 to 7 years for small businesses, 8 to 12 years for mid-sized companies, and 12 to 15+ years for large enterprises.
• "Feasibility of Post-Quantum Cryptography Adoption" (2025) — DOI: 10.36227/techrxiv.176583452.24018891/v1 (preprint) — Google adoption costs estimated at $1.17 billion to $3.85 billion; the paradox of early adoption versus delay.
• "Pitfalls of the sublinear QAOA-based factorization algorithm" (2023) — arXiv:2303.04656 (preprint) — Approximately 20 million physical qubits estimated for an 8-hour factorization of 2048-bit RSA, with an omission of analysis in the sublinear claims.
• "Quantum Resource Requirements for Breaking Elliptic Curve Cryptography" (2025) — DOI: 10.20944/preprints202509.2429.v2 (preprint) — 2,330 logical qubits for P-256, 2029–2035 depending on the scenario (based on roadmaps).
• "An Overview of Regev's Quantum Factoring Algorithm" (2024) — DOI: 10.54254/2755-2721/110/2024melb0122 — Fewer gates but increased qubit requirements, relying on unproven number-theoretic assumptions.
• "Quantum Factoring Algorithm: Resource Estimation and Survey" (2020) — DOI: 10.1007/978-981-15-5191-8_7 — Some experimental circuits are constructed under the condition that the order is known in advance.
• "Factoring Some Integers Using Shor's Algorithm on Real Quantum Hardware" (2026) — DOI: 10.21203/rs.3.rs-9793578/v1 (preprint) — The critique that compilation bakes in a priori knowledge of the answer, for N ∈ {51, 85, 255, 771}.
• "On the practicality of quantum sieving algorithms for the shortest vector problem" (2024) — arXiv:2410.13759 (preprint) — 10^13 physical qubits and 10^31 years for 400-dimension SVP, with almost no quantum speedup.
• "Red Team Cryptanalysis of Lattice-Based PQC Using Transformers" (2025) — DOI: 10.36227/techrxiv.174910091.18242062/v1 (preprint) — An empirical evaluation of transformer attacks on LWE.
• "The Quantum Security Deadline: Building Crypto-Agility" (2025) — DOI: 10.37745/ejcsit.2013/vol13n523552 — A crypto-agility roadmap centered on CBOM, hybrid deployment, and certificate lifecycle automation.
• "Future-Proofing Data" (2025) — DOI: 10.9734/acri/2025/v25i31098 — ARIMA- and Monte Carlo-based quantum decryption probability forecasting (negligible by 2029, 78.6% by 2033).