What Quantum Computing Will Break and When Security Experts Expect It
RSA, Diffie-Hellman, and elliptic curve cryptography are the real targets, while AES-256 holds up. Expert timelines, NIST and NSA deadlines, and the migration mistakes that leave organizations exposed.
Quantum computing will break the public-key cryptography behind secure web connections, digital signatures, and software updates, namely RSA, Diffie-Hellman, and elliptic curve systems.
Surveyed experts put the odds of that happening within a decade between 28 and 49 percent, while government migration deadlines begin as early as 2027.
Trending Now!!:
The distinction matters because the threat is not a single event. Three clocks are running at once: the hardware clock that decides when a capable machine exists, the compliance clock set by regulators and procurement rules, and the data clock defined by how long a given secret must stay secret.
Most organizations watch the first and ignore the other two, which is the most common planning error in the field.
What Quantum Computers Will Actually Break
The vulnerability traces to Peter Shor, whose 1994 algorithm showed that a large, error-corrected quantum computer can factor integers and solve discrete logarithms efficiently. Those two math problems are the foundation of nearly all public-key cryptography in everyday use.
RSA relies on the difficulty of factoring. Diffie-Hellman key exchange, DSA, and elliptic curve cryptography, including ECDSA and ECDH, rely on discrete logarithm problems.
A machine running Shor’s algorithm at sufficient scale defeats all of them, and increasing key sizes offers no practical defense, because the attack scales polynomially while the key lengths needed to resist it become unworkable.
In practice, this covers the handshake in nearly every TLS connection, the certificates that authenticate websites, VPN tunnels, SSH sessions, code-signing for operating systems and firmware, secure email, document signatures, and the signature schemes that protect most blockchain assets. The break is less about stored files than about trust: the ability to prove who sent something and to agree on a secret key over an open network.
What Quantum Computers Will Not Break
A persistent misconception holds that quantum computing ends all encryption. It does not. Symmetric ciphers such as AES face only a quadratic speedup from Grover’s algorithm, which effectively halves the security level. AES-256 retains a comfortable margin, and AES-128 remains adequate for most purposes. Hash functions like SHA-256 and SHA-384 are similarly resilient.
The practical consequence is that the urgent work sits in key exchange and signatures, not in bulk data encryption. Security teams that respond by doubling every key length across the board spend budget on the wrong layer.
The Threat That Already Exists: Harvest Now, Decrypt Later
Waiting for a working quantum computer before acting ignores an attack that needs no quantum hardware today. Adversaries can record encrypted traffic now and store it until decryption becomes possible. The pattern is known as “harvest now, decrypt later”, and it makes the risk immediate for any data with a long confidentiality life.
Diplomatic cables, health records, genomic data, intellectual property, defense contracts, and financial instruments with multi-decade terms all qualify.
Public-key signatures behave differently: a forged signature only matters once the forger can act, so signature migration has a later practical deadline than key exchange. Prioritizing key establishment first is a sound sequencing rule, and the major browser and cloud vendors have followed it by deploying hybrid post-quantum key exchange before touching signatures.
How Close Is the Hardware?
The honest answer is that no machine today threatens real keys. The relevant measure is not raw qubit count but error-corrected logical qubits, and the gap between today’s noisy devices and a cryptographically relevant quantum computer remains large.
What has changed is the size of that gap. A widely cited 2019 analysis by Craig Gidney and Martin Ekerå estimated that breaking RSA-2048 would take about 20 million noisy physical qubits running for roughly eight hours. In May 2025, Gidney published a revised estimate of under one million noisy qubits and less than a week of runtime, a twentyfold reduction driven by better algorithms and error correction rather than new hardware.
Estimates have kept falling since. Preprints from Iceberg Quantum describe an architecture based on quantum low-density parity-check codes that puts the requirement below 100,000 physical qubits under favorable assumptions, with a later update citing figures near 72,000 qubits for a multi-day run.
Those figures depend heavily on assumed error rates and cycle times: slower platforms such as trapped ions require far more qubits or far longer runtimes under the same architecture. They are also preprints, not settled results.
Gidney himself offers a useful counterweight. Under the physical assumptions in his paper, he sees no way to cut the qubit count by another order of magnitude, and he wrote that he cannot plausibly claim a hundred thousand noisy qubits would suffice.
Different architectures with different assumptions disagree, which is the correct reading of the field: the direction of travel is clear, the destination is not.
When Security Experts Expect It
The most-cited expert barometer is the Quantum Threat Timeline Report from the Global Risk Institute, written by Michele Mosca and Marco Piani of evolutionQ.
Its seventh edition surveyed 26 experts and found the averaged probability of a cryptographically relevant quantum computer within ten years at 28 to 49 percent, the highest ten-year figure in the series. At fifteen years, 18 of 26 respondents rated the probability at 50 percent or higher, and by twenty years, 92 percent did.
Two cautions apply. The survey sample is small, and the range reflects different readings of how respondents’ answers are interpreted. Expert surveys also tend to lag breakthroughs in algorithms, which have repeatedly arrived faster than hardware forecasts assumed.
Industry analysts have drifted in the same direction. Gartner warned in early 2025 that conventional asymmetric cryptography could be unsafe by 2029, then moved that estimate to 2030 in its later cybersecurity trends report. No credible source offers a date with certainty, and anyone who does is selling something.
The Deadlines That Matter More Than Q-Day
The compliance clock is more predictable than the hardware clock, and for most organizations it binds first.
NIST finalized its first post-quantum standards in August 2024: FIPS 203 (ML-KEM) for key establishment, FIPS 204 (ML-DSA) for signatures, and FIPS 205 (SLH-DSA) as a hash-based signature backup.
Its draft transition report, IR 8547, proposes deprecating RSA-2048 and 256-bit elliptic curve algorithms after 2030 and disallowing quantum-vulnerable public-key algorithms after 2035. The report remains a draft, so wording could shift, but the dates align with the 2035 federal target set by National Security Memorandum 10 in 2022.
The NSA’s CNSA 2.0 suite is stricter for national security systems. New acquisitions must be CNSA 2.0 compliant beginning January 1, 2027.
Software and firmware signing and traditional networking equipment must use the new algorithms exclusively by 2030, while web services, cloud services, and operating systems follow by 2033. The 2027 procurement gate is the date with real teeth: a vendor selling to national security customers without compliant products loses the sale regardless of what any quantum computer does.
Gidney’s own endorsement of the NIST dates is revealing. He supports deprecation after 2030 and disallowance after 2035 not because he expects capable machines by 2030, but because he prefers that security not depend on progress being slow. That framing is the clearest argument against waiting for evidence.
A Framework for Deciding How Urgent This Is
Mosca proposed a simple inequality that remains the most useful planning tool in the field. Take the number of years the data must stay confidential, add the number of years a migration will take, and compare the sum with the number of years until a capable quantum computer exists. If the sum is larger, the organization is already late.
Applied honestly, the result is uncomfortable. A healthcare provider holding records with a thirty-year confidentiality requirement, plus a migration that realistically takes five to eight years across legacy systems, is exposed even under optimistic hardware forecasts. A retailer protecting short-lived session tokens is not.
Common Mistakes in Post-Quantum Migration
The first mistake is treating migration as an algorithm swap. Replacing RSA with ML-KEM and ML-DSA sounds simple until the size differences surface. An ML-KEM-768 public key runs 1,184 bytes, and an ML-DSA-44 signature runs 2,420 bytes, against 64 bytes for a typical ECDSA signature. Certificate chains grow, handshakes fragment, constrained devices run short of memory, and hardware security modules may lack support entirely.
The second mistake is skipping the cryptographic inventory. Most enterprises cannot list where public-key cryptography lives in their environment: embedded in third-party libraries, hard-coded in firmware, buried in legacy PKI, or inherited through vendors. A cryptographic bill of materials is the foundation of any credible PQC readiness assessment, and organizations that start with vendor tooling before inventory tend to buy the wrong things.
The third is neglecting crypto-agility. The standards will evolve, and NIST has already selected HQC as a backup key-encapsulation method alongside ML-KEM. Systems that hard-code a single algorithm repeat the same migration pain in a decade.
The fourth is ignoring the supply chain. An organization can finish its own migration and remain exposed through payment processors, cloud providers, certificate authorities, and identity vendors still running classical algorithms.
What Experts Recommend Doing Now
The sequence that most practitioners converge on is consistent. Build the cryptographic inventory first and classify each asset by data lifetime. Prioritize key establishment for long-lived confidential data.
Enable hybrid key exchange, which combines a classical algorithm with a post-quantum one, wherever vendors support it, since hybrid modes protect against both quantum attacks and unforeseen flaws in young algorithms.
Write post-quantum requirements into procurement contracts now, because equipment bought today will still be in service in 2035. Test performance on the slowest and smallest devices in the fleet, not the newest.
Budgeting follows inventory, not the other way around. Quantum-safe security solutions, managed PKI upgrades, and consulting engagements vary widely in scope, and the cost of migration depends almost entirely on how many systems depend on vulnerable cryptography and how well those dependencies are documented.
The Counterargument Worth Taking Seriously
Skeptics point out that fault-tolerant quantum computing has repeatedly looked ten to twenty years away, that engineering obstacles such as error rates, connectivity, and cryogenic scaling remain unsolved, and that migration money spent early could be misallocated. Those objections carry weight, and no one can rule out a decade or more of slower progress.
The asymmetry still favors action. Migration is expensive but finite and recoverable. A failure to migrate before a capable machine exists is neither, and the recorded traffic of the intervening years cannot be re-encrypted after the fact.
Deadlines are already fixed by regulators and procurement rules, so the practical question has shifted from whether the transition happens to whether an organization completes it on its own schedule or on its customers’ and regulators’ schedules.
What People Ask
