Does quantum computing pose a real threat to current encryption standards?

Which encryption methods are most at risk, and why?

Public-key cryptosystems like RSA and Elliptic Curve Cryptography (ECC) are the most vulnerable. These systems rely on the mathematical difficulty of factoring large numbers or solving discrete logarithms—problems that a quantum computer running Shor's algorithm could solve exponentially faster than any classical computer [1][6][9]. One paper projects that by 2034, quantum computers could achieve a quantum volume of around 10^7 qubits with low error rates, a level of power sufficient to break RSA-1024 [1]. This would compromise the security of internet communications, digital signatures, and blockchain systems that depend on these algorithms [13].

Symmetric encryption, such as the Advanced Encryption Standard (AES), is much less vulnerable. Grover's algorithm can speed up a brute-force key search, but it only halves the effective security level. For example, AES-256 would provide the equivalent of 128-bit security against a quantum attack, which is still considered strong [2][12]. However, AES-128 would be reduced to only 64-bit security, which is breakable in practice. Therefore, using larger key sizes (e.g., AES-256) is an effective short-term defense [2][7].

How imminent is the quantum threat to encryption?

The threat is real but not immediate. Current quantum computers are far too small and error-prone to break any real-world encryption. One paper notes that breaking future quantum computers would require 100,000 times more processing power and a 100 times lower error rate than today's best machines [3]. Another study found that while AES is theoretically at risk from Grover's algorithm, current hardware limitations and noise levels make practical exploitation impossible today [12].

However, the window for preparation is narrow. Experts predict that significant breakthroughs in qubit scaling and error correction could occur between 2025 and 2030, and that by 2034, quantum computers could be powerful enough to break RSA-1024 [1]. This timeline creates an urgent need to develop and deploy quantum-resistant cryptography before 'Q-day' arrives [1][4]. The National Institute of Standards and Technology (NIST) has been leading a multi-year effort to standardize post-quantum algorithms, but the process has been challenging—80 of 82 initial candidates failed the standardization process, and two of the finalists were later cracked by classical computers [5].

What solutions are being developed to counter the quantum threat?

Two main approaches are being pursued: Post-Quantum Cryptography (PQC) and Quantum Key Distribution (QKD). PQC involves developing new mathematical algorithms that are believed to be resistant to both classical and quantum attacks. Key families include lattice-based, hash-based, and code-based cryptography [4][8][11]. These algorithms are being standardized by NIST, though the process has seen setbacks, with some candidates being broken [5]. Hybrid approaches that combine classical and quantum-resistant algorithms are also being explored to ease the transition [4][8].

QKD uses the principles of quantum mechanics to create a secure communication channel that is theoretically immune to eavesdropping. Any attempt to intercept the quantum key disturbs the system, alerting the users [4][10]. While promising, QKD requires specialized hardware and is currently limited to shorter distances, making it less practical for widespread internet use than PQC [4][11]. Ultimately, a combination of both approaches, along with a global effort to standardize and implement quantum-resistant solutions, will be necessary to secure digital infrastructure for the quantum age [1][4][11].

Sources used in this answer

Related research questions