Quantum computing coverage tends to land somewhere between "all encryption is about to fail" and "it is decades away, ignore it". Both statements are wrong in ways that make it hard to act sensibly.
The accurate version is narrower and more useful: one specific mathematical technique, running on hardware that does not yet exist at the required scale, would break one specific family of cryptography. That family happens to be the one that secures nearly every connection on the internet. The replacement already exists and is being deployed now.
Two algorithms, two very different threats
Almost all of the concern traces back to two results from the 1990s.
Shor's algorithm efficiently factors large numbers and solves the discrete logarithm problem. This is a complete break, not a speed-up. The security of RSA, Diffie-Hellman and elliptic curve cryptography rests entirely on those problems being hard. If they become easy, those systems provide no security at all — not weakened, not needing larger keys, simply broken.
Grover's algorithm speeds up brute-force search, but only quadratically. Searching a space of size N takes roughly the square root of N operations instead of N. Against a symmetric cipher this effectively halves the key length: 128-bit security becomes about 64-bit, 256-bit becomes about 128-bit.
That difference is everything. Shor is catastrophic for the affected algorithms. Grover is an inconvenience you fix by using longer keys, which most systems already do.
So what actually breaks
| Cryptography | Used for | Quantum impact |
|---|---|---|
| RSA | Key exchange, signatures, certificates | Broken completely |
| Elliptic curve (ECDH, ECDSA) | Modern TLS, messaging, most signatures | Broken completely |
| Diffie-Hellman | Key agreement | Broken completely |
| AES-128 | Bulk data encryption | Weakened, roughly 64-bit security |
| AES-256 | Bulk data encryption | Still comfortably secure |
| SHA-256 and SHA-3 | Hashing, integrity | Mildly weakened, still fine |
| Password hashing (Argon2, bcrypt) | Stored credentials | Essentially unaffected |
The pattern: public-key cryptography is in serious trouble; symmetric cryptography and hashing are largely fine.
Unfortunately, public-key cryptography is how every secure connection begins. Your browser uses it to agree on a symmetric key and to verify the site is who it claims. Break that and the symmetric encryption underneath is irrelevant, because the attacker was handed the key.
Why the hardware is not there yet
Current quantum processors have hundreds to low thousands of physical qubits. Breaking a 2048-bit RSA key with Shor's algorithm requires on the order of millions of physical qubits, because of error correction.
Qubits are extraordinarily fragile. They decohere in microseconds and every operation introduces error. Running an algorithm of Shor's depth requires logical qubits built from large numbers of physical ones — current estimates land somewhere between a thousand and ten thousand physical qubits per usable logical qubit, depending on error rates and the correction scheme.
So the gap is not "a few more years of the same". It is three to four orders of magnitude, and it requires error rates to improve alongside qubit counts. Expert surveys tend to put a cryptographically relevant machine somewhere in the 2035-2045 range, with wide disagreement and honest acknowledgement that a materially better error-correction scheme could compress that.
Two reasons the timeline does not license inaction. First, encrypted traffic can be captured now and decrypted later — so anything you send today with a secret lifetime beyond the arrival date is already exposed. Second, replacing cryptography across a large organisation historically takes ten to fifteen years. Both clocks are already running.
Harvest now, decrypt later
This is the concrete threat, and it is the only part of the problem that is urgent today.
An adversary with storage and patience records encrypted traffic now and keeps it. When a capable machine exists, the recorded key exchange is broken retroactively and the traffic is read.
Whether this matters depends entirely on how long your secrets need to stay secret:
- Yesterday's stock price: irrelevant, do nothing.
- A card number: the card expires. Low concern.
- Medical records, legal files, source code, personnel data: sensitive for decades. Real concern.
- State secrets, intelligence material, identity documents: the canonical case, and the reason government agencies moved first.
If your data has a secrecy lifetime shorter than the arrival of quantum hardware, this problem does not really apply to you. If it is longer, the migration is not optional.
The replacement exists
Post-quantum cryptography relies on mathematical problems for which no efficient quantum algorithm is known — primarily structured lattices, and hash-based constructions for signatures.
After a multi-year public competition, standards were selected and published. The main outcomes:
- A lattice-based key encapsulation mechanism for key exchange, which is the urgent replacement because key exchange is what enables harvest-now-decrypt-later.
- A lattice-based signature scheme as the general-purpose replacement for digital signatures.
- A hash-based signature scheme as a conservative alternative resting on different assumptions, valuable for long-lived things like firmware signing.
These are deployed already. Major browsers, messaging platforms and cloud providers have shipped hybrid key exchange, and a substantial share of web traffic is now protected by it.
Hybrid mode, and why it is the right call
The near-universal deployment approach combines a classical algorithm with a post-quantum one and derives the session key from both.
The logic is straightforward. Post-quantum algorithms are newer and less battle-tested; a classical break of one of them would be embarrassing. In hybrid mode an attacker must break both to recover the key. You are protected against quantum attacks by the new algorithm and against implementation flaws in the new algorithm by the old one.
The cost is slightly larger handshakes — post-quantum keys are bigger than elliptic curve keys, adding a couple of kilobytes. On most connections this is unmeasurable. On constrained embedded links it needs thought.
What to actually do
For an individual: essentially nothing. Keep software updated. Your browser and messaging apps are handling this without you.
For anyone responsible for systems, the sequence is unglamorous and well understood:
- Inventory your cryptography. This is the hard part and the reason migrations take a decade. Most organisations genuinely do not know where their keys live, which libraries are used, or which vendor products are involved.
- Classify by secrecy lifetime. Anything that must stay confidential past roughly 2040 is in scope now. Everything else can follow the normal upgrade cycle.
- Enable hybrid key exchange where it is available. Modern TLS libraries support it. This is usually a configuration change, and it directly addresses the harvest-now threat.
- Fix crypto-agility. The lasting deliverable is not this migration, it is being able to do the next one in months rather than years. That means no hard-coded algorithms, no key sizes baked into database columns, and negotiated rather than assumed parameters.
- Prioritise long-lived signatures. Firmware signing keys, root certificates and code-signing infrastructure have to be trusted for fifteen years. These deserve conservative, hash-based schemes.
- Ask vendors, in writing. Their roadmap is your timeline, whether you like it or not.
The proportionate view
This is a real problem with a known solution and a long lead time — which describes most good engineering work.
Nothing is broken today. Nothing will break suddenly. What will happen is that a slow, tedious, expensive migration either gets done in the available window or does not. The organisations that will struggle are not the ones that got the timeline wrong; they are the ones that never worked out where their cryptography was.
The most valuable thing you can do this year has nothing to do with quantum computing. It is producing an accurate inventory of what you already use, because you cannot replace what you cannot find.