Picture a digital vault that would take today’s most powerful supercomputers billions of years to crack. Now picture a machine that could open it in a matter of hours. That machine is a quantum computer, and the vault is the cryptographic framework underpinning virtually every secure transaction, message and login on the internet today.
Quantum computing has moved well beyond theoretical physics. With major milestones from IBM, Google and a host of well-funded startups arriving regularly, the question facing cryptographers, governments and businesses is no longer if quantum machines will disrupt modern encryption, but when — and what happens next. This article explores how quantum computing threatens current cryptographic standards, what “post-quantum” actually means, and the practical steps organisations are taking right now to prepare.
How Does Modern Cryptography Actually Work?
To understand why quantum computing poses such a threat, it helps to know what makes today’s encryption secure in the first place. The overwhelming majority of secure communication on the internet relies on public-key cryptography — systems like RSA, Elliptic Curve Cryptography (ECC) and Diffie-Hellman key exchange.
These systems work because of mathematical problems that are easy to perform in one direction but extraordinarily difficult to reverse. RSA, for example, relies on the fact that multiplying two enormous prime numbers together is trivial, but working out which two primes produced a given product is practically impossible for classical computers within any useful timeframe. ECC relies on a similar one-way function involving points on an elliptic curve.
A 2048-bit RSA key — the current industry standard — would take a classical computer roughly 300 trillion years to factorise using the best known algorithms. That’s the security assumption the entire digital economy rests upon: not that the maths is unsolvable, but that solving it would take so long it becomes irrelevant.
Symmetric Encryption: A Different Story
Not all cryptography faces the same level of quantum risk. Symmetric encryption algorithms like AES (Advanced Encryption Standard) use the same key to encrypt and decrypt data. Quantum computers can speed up attacks against symmetric systems using Grover’s algorithm, but the effect is far less dramatic. Grover’s algorithm effectively halves the security strength — meaning AES-256 would offer roughly the equivalent security of AES-128 against a quantum attacker. Doubling key lengths largely solves the problem, making symmetric encryption comparatively resilient.
Why Are Quantum Computers Such a Threat to Encryption?
The real danger lies in Shor’s algorithm, developed by mathematician Peter Shor in 1994. Shor demonstrated that a sufficiently powerful quantum computer could solve the integer factorisation problem and the discrete logarithm problem — the two mathematical foundations of RSA, ECC and Diffie-Hellman — in polynomial time. In plain terms, a task that would take classical computers trillions of years could be completed in hours or even minutes.
Quantum computers achieve this through two properties that set them apart from classical machines:
- Superposition — quantum bits (qubits) can exist in multiple states simultaneously, allowing quantum computers to explore vast numbers of possibilities in parallel.
- Entanglement — qubits can be correlated with one another in ways that have no classical equivalent, enabling coordinated computation across an enormous state space.
When these properties are harnessed by Shor’s algorithm, the mathematical hard problems underpinning public-key cryptography simply cease to be hard. A cryptographically relevant quantum computer — one powerful enough to break RSA-2048 — would need an estimated 4,000 to 20 million physical qubits, depending on error correction efficiency. Current machines from IBM and Google sit at roughly 1,000 noisy qubits, but the trajectory is steep and accelerating.
The “Harvest Now, Decrypt Later” Problem
Perhaps the most immediate concern isn’t a future quantum attack — it’s what’s happening right now. Intelligence agencies and sophisticated threat actors are widely believed to be intercepting and storing encrypted data today, with the intention of decrypting it once a capable quantum computer becomes available. This strategy, known as “harvest now, decrypt later” (HNDL), means that sensitive data encrypted today with RSA or ECC may already be compromised in practical terms.
Any information with a long shelf life — medical records, state secrets, financial data, intellectual property — is particularly vulnerable. If your data needs to remain confidential for ten years or more, the quantum threat isn’t a future problem. It’s a present one. The same caution applies to everyday internet users, where public Wi-Fi security risks already expose sensitive data to interception even without quantum computing in the picture.
What Is Post-Quantum Cryptography?
Post-quantum cryptography (PQC) refers to cryptographic algorithms that are designed to be secure against attacks from both classical and quantum computers. Crucially, these algorithms run on classical hardware — you don’t need a quantum computer to use them. They simply rely on mathematical problems that even quantum computers are not known to solve efficiently.
The US National Institute of Standards and Technology (NIST) has been leading the global effort to standardise post-quantum algorithms. After a multi-year evaluation process involving cryptographers worldwide, NIST published its first set of PQC standards in August 2024:
- FIPS 203 (ML-KEM) — based on the CRYSTALS-Kyber algorithm, designed for key encapsulation and general encryption. It relies on the hardness of lattice-based problems.
- FIPS 204 (ML-DSA) — based on CRYSTALS-Dilithium, intended for digital signatures.
- FIPS 205 (SLH-DSA) — based on SPHINCS+, a hash-based signature scheme serving as a backup approach.
These algorithms draw on mathematical structures — particularly lattices and hash functions — that are believed to resist quantum attacks. Lattice-based cryptography, in particular, has emerged as the frontrunner because it offers a strong balance of security, efficiency and versatility.
Quantum Key Distribution: An Alternative Approach
Alongside PQC, some researchers and governments are exploring Quantum Key Distribution (QKD) — a method of sharing encryption keys using quantum mechanics itself. QKD uses the principle that observing a quantum system disturbs it, meaning any eavesdropper attempting to intercept a key exchange would be detectable.
Whilst QKD offers theoretically perfect security for key exchange, it faces significant practical limitations: it requires specialised hardware (often fibre-optic connections), has limited range without trusted relay nodes, and doesn’t scale well for general internet use. Most security agencies, including the UK’s National Cyber Security Centre (NCSC), currently recommend PQC over QKD for most applications.
What Are Governments and Industry Doing About It?
The shift to post-quantum cryptography is no longer optional or theoretical. Governments around the world have set concrete timelines, and major technology companies are already deploying quantum-resistant algorithms.
Key developments include:
- The US government has mandated that federal agencies begin migrating to PQC, with a target of completing the transition for high-priority systems by 2030–2035.
- The UK’s NCSC has published guidance urging organisations to begin cryptographic discovery — identifying where and how they use vulnerable encryption — as a critical first step.
- Google has been testing hybrid post-quantum key exchange in Chrome since 2023, combining classical and post-quantum algorithms to maintain security during the transition.
- Apple announced in early 2024 that iMessage would adopt a hybrid post-quantum protocol called PQ3, making it one of the first widely deployed consumer applications of PQC.
- Cloudflare reports that a significant and growing percentage of its TLS connections already use post-quantum key exchange.
The message from every major standards body is consistent: start planning now. Migration to new cryptographic standards historically takes 10 to 15 years, and the window before a cryptographically relevant quantum computer exists may be shorter than that.
What Is Crypto-Agility and Why Does It Matter?
One of the most important concepts to emerge from this transition is crypto-agility — the ability to swap cryptographic algorithms in and out of systems without requiring a complete redesign. Organisations that hard-code specific algorithms into their infrastructure will find migration painful, expensive and slow. Those that build flexibility into their architecture from the outset will adapt far more readily.
Crypto-agility isn’t just about preparing for post-quantum algorithms. It’s a broader security principle: cryptographic standards will continue to evolve, and systems should be designed to evolve with them.
Will Quantum Computing Break Bitcoin and Blockchain?
Blockchain networks face a somewhat nuanced quantum threat. Bitcoin and most other cryptocurrencies use Elliptic Curve Digital Signature Algorithm (ECDSA) for transaction signing — which is vulnerable to Shor’s algorithm. However, the risk depends on how addresses are used.
Bitcoin addresses that have never broadcast a transaction keep their public keys hidden behind a hash, providing a degree of protection. But once a transaction is made, the public key is exposed on the blockchain, and a sufficiently powerful quantum computer could theoretically derive the private key from it. Estimates suggest that roughly 25–30% of all Bitcoin currently sits in addresses with exposed public keys.
The broader blockchain ecosystem is actively researching quantum-resistant signature schemes, but transitioning an entire decentralised network to new cryptography is a monumental coordination challenge — arguably harder than upgrading centralised systems.
How Far Away Is a Cryptographically Relevant Quantum Computer?
Estimates vary widely, and honest uncertainty remains. A 2023 survey by the Global Risk Institute found that a majority of quantum experts believe there is a greater than 50% probability that a quantum computer capable of breaking RSA-2048 will exist within 15 years. Some optimistic projections place it within a decade; more conservative voices suggest 20 to 30 years.
What makes prediction difficult is the gap between physical qubits and logical qubits — the error-corrected qubits needed for reliable computation. Current quantum machines have high error rates, and building enough logical qubits to run Shor’s algorithm at scale requires overcoming enormous engineering challenges in quantum error correction.
However, progress has been consistently faster than many predicted. Google’s Willow chip, announced in late 2024, demonstrated exponential error suppression as qubit counts increased — a critical milestone that suggests fault-tolerant quantum computing may arrive sooner than the conservative estimates suggest. Breakthroughs like this reflect how AI and emerging technologies are converging to accelerate innovation across the entire tech landscape.
What Should Organisations Do Right Now?
The transition to post-quantum cryptography doesn’t happen overnight, but waiting until quantum computers are a proven threat would be too late. Here are the steps that security experts and government agencies consistently recommend:
- Conduct a cryptographic inventory. Identify every system, application and protocol that relies on RSA, ECC or Diffie-Hellman. Many organisations are surprised by how deeply embedded these algorithms are.
- Prioritise by data sensitivity and lifespan. Data that must remain confidential for more than a decade should be migrated first, due to the harvest-now-decrypt-later threat.
- Adopt hybrid approaches. During the transition, combining classical and post-quantum algorithms provides security against both current and future threats.
- Build crypto-agility into new systems. Ensure that cryptographic components can be replaced without overhauling entire architectures.
- Follow NIST and NCSC guidance. Both organisations publish regularly updated timelines and technical recommendations.
- Engage with vendors. Ask hardware and software suppliers about their post-quantum roadmaps — supply chain readiness is just as important as internal systems.
Conclusion: A Fundamental Shift, Not a Distant Hypothetical
Quantum computing will not merely improve existing technology — it will fundamentally reshape the cryptographic landscape on which digital trust is built. Public-key systems like RSA and ECC, which have safeguarded global communications for decades, face a genuine and increasingly proximate existential threat from Shor’s algorithm running on fault-tolerant quantum machines.
The good news is that the cryptographic community has not been idle. NIST’s standardisation of post-quantum algorithms in 2024 marked a turning point, and major technology companies are already deploying quantum-resistant protocols in production systems. The tools to defend against the quantum threat exist today.
What changes next is not a question of waiting for quantum computers to arrive, but of how quickly and thoroughly organisations migrate to the new standards. The harvest-now-decrypt-later threat means that inaction today has consequences that will only become apparent years from now. The era of post-quantum cryptography has begun — and the organisations that treat it as an urgent priority rather than a distant curiosity will be the ones that maintain security and trust in the decades ahead.
Leave a Reply