Quantum Threat Mechanics
How quantum computers break RSA, ECC, and weaken AES — and why PQC algorithms survive.
Qubits & Superposition
Classical computers store information as bits — each is definitively 0 or 1. A quantum computer uses , which exploit two quantum phenomena to process information fundamentally differently.
Always in a definite state. N bits represent exactly one of 2N values at a time.
exists in a combination of 0 and 1 simultaneously. qubits can be correlated so measuring one instantly determines the other. Together, N qubits can process 2N states in parallel.
Key insight: Quantum speedup doesn't come from "trying all answers at once." It comes from carefully constructing interference patterns that amplify correct answers and cancel wrong ones. Only specific algorithms (like and ) can exploit this structure.
Shor's Algorithm — Breaking &
Peter Shor discovered in 1994 that a quantum computer can solve two hard mathematical problems exponentially faster than any classical computer:
RSA relies on the difficulty of factoring large numbers (N = p × q).
RSA-2048 requires ~4,098 logical qubits. A CRQC could factor it in hours, not billions of years.
ECC (, , ) and Diffie-Hellman rely on the hardness of discrete logarithms.
P-256 requires ~2,330 logical qubits. All ECC variants (P-256, P-384, , ) are equally broken.
Impact: Every public-key algorithm based on integer factorization or discrete logarithms — RSA, DSA, ECDSA, ECDH, EdDSA, DH — provides zero security against a quantum adversary. Key size increases do not help because Shor's algorithm scales polynomially.
Grover's Algorithm — Weakening & SHA
Lov Grover discovered in 1996 that a quantum computer can search an unstructured database quadratically faster. This affects symmetric encryption and hash functions:
| Algorithm | Classical Security | Quantum Security | Status |
|---|---|---|---|
| AES-128 | 128-bit | 64-bit | Insufficient |
| AES-192 | 192-bit | 96-bit | Adequate |
| AES-256 | 256-bit | 128-bit | Secure |
| SHA-256 (collision) | 128-bit | ~85-bit | Secure |
Practical note: Grover's algorithm is less threatening than Shor's. It provides only a quadratic speedup (halving security bits), and the algorithm requires sequential oracle queries — it cannot be parallelized effectively. The fix is simple: double the key size (AES-128 → AES-256).
CRQC Timeline Projections
A is one powerful enough to run Shor's algorithm against production-size keys. Experts disagree on when this will happen, but major agencies are planning for it now:
Bottom line: Whether a CRQC arrives in 2030 or 2040, migration takes years. Organizations handling long-lived data (government, healthcare, finance) must begin now because of the Harvest Now, Decrypt Later threat.
The most urgent quantum threat is not future code-breaking — it's data being intercepted today for future decryption. This attack is called Harvest Now, Decrypt Later (HNDL), also known as "Store Now, Decrypt Later" or "retrospective decryption."
Adversaries intercept encrypted traffic today (VPN, TLS, email) and store it.
Data is archived — storage is cheap. Adversaries wait for quantum capability.
Once CRQC is available, Shor's breaks the key exchange. Symmetric keys are recovered, all data is decrypted.
Mosca's Theorem (Migration Deadline): If your data must remain secure for X years, your migration will take Y years, and a CRQC is expected in Z years, you must start migrating within Z − X − Y years. For data with 25-year sensitivity, a 5-year migration time, and a CRQC in 2035, migration should have started by 2005.
HNDL targets confidentiality. HNFL targets authenticity and integrity. Adversaries collect signed artifacts today — firmware images, certificate chains, code-signing blobs — and store them. Once a CRQC arrives, Shor's algorithm recovers the signer's private key, enabling forged signatures on any document or binary.
Collect signed artifacts — firmware images, CA certificates, code-signing blobs. Public-key material is often publicly accessible.
Archive for years to decades. No active attack is needed — the adversary waits for quantum capability.
CRQC runs Shor's algorithm on the signer's public key, recovers the private key, and forges arbitrary signatures retroactively.
- • hierarchies & root CA certificates
- • Firmware signing (medical devices, industrial, automotive)
- • Software update pipelines & code-signing certs
- • Government ePassports & digital ID credentials
A Root CA issued today with a 20-year validity period will still be trusted in 2046. If a CRQC arrives in 2035, that CA's RSA or ECDSA key is breakable — and every certificate it ever signed becomes forgeable. Migration to or must complete before CRQC arrival.
HNFL vs HNDL: HNDL requires intercepting encrypted traffic. HNFL does not — signed artifacts are often public. The re-issuance deadline formula is simpler: Re-issuance Deadline = CRQC Year − Re-issuance Time. Use the Step 5 workshop to calculate your credential migration window.
Related Resources
Explore Interactively
Use the Workshop to visualize security degradation, compare algorithms, and calculate your HNDL migration deadline.