Overview of quantum computing and post-quantum cryptography

Existing quantum processors contain around 1,000 qubits, remaining roughly 500 times smaller than the systems required to break classical algorithms like RSA. However, revised architectural estimates and harvest-now-decrypt-later tactics have accelerated the cryptanalytic threat timeline. Consequently, standards agencies have begun releasing post-quantum cryptographic protocols to protect sensitive digital infrastructure.

Current state of quantum hardware and threat timelines

The largest quantum computers currently consist of approximately 1,000 qubits ^[1]. A whitepaper published by Google Quantum AI showed that the size of a quantum computer that would pose a cryptographic threat is approximately 20 times smaller than previously thought ^[2]. A concurrent publication demonstrated that the hardware itself improved, with a great reduction in the number of physical qubits required to achieve a logical qubit ^[3]. Even with these reductions, an operational quantum computer capable of posing a threat is estimated to require about 500 times the capacity of today's largest machines ^[1]. Most experts believe that large-scale quantum computers will not be built for at least another decade ^[4]. The probability of a quantum computer executing a successful cryptographic attack within the next three years is considered extremely low, at less than one percent ^[5]. However, over a horizon of five, six, or ten years, the estimated probability increases to five percent, ten percent, or more ^[6].

Cryptographic vulnerabilities and systemic exposure

Conventional security protocols protecting data online rely primarily on RSA and elliptic curve cryptography ^[7]. While these algorithms cannot be cracked by supercomputers, a sufficiently large quantum computer would make quick work of them ^[7]. Currently intractable computational problems that protect widely deployed cryptosystems like RSA and elliptic curve schemes are expected to become solvable by quantum machines ^[8]. Almost all data on the internet, encompassing bank transactions, medical records, and secure chats, is protected by RSA encryption ^[9]. Furthermore, versions of elliptic curve cryptography are deployed in military encryption and national security systems ^[10]. A breakthrough in quantum computing threatens to undermine security for hundreds of billions of dollars in e-commerce and puts trillions of dollars at risk across the wider digital economy ^[11]. The urgency of this threat is magnified by harvest now, decrypt later tactics, where an adversary downloads and stores encrypted data today to decrypt once a large quantum computer becomes operational ^[12]. Moreover, many devices employing RSA security, such as automobiles and internet-of-things equipment, are expected to remain in active field use for at least a decade ^[13].

Post-quantum cryptographic standards and mathematical schemes

To counter quantum threats, the National Institute of Standards and Technology announced the standardization of three post-quantum cryptography encryption schemes ^[14]. These algorithms are designated as Federal Information Processing Standards 203 through 206, with FIPS 203, 204, and 205 released initially and FIPS 206 expected in late 2024 ^[15]. Post-quantum algorithms fall into two operational categories: general encryption to safeguard data transferred across public networks, and digital signatures to authenticate individuals ^[16]. Digital signatures also support code-signing applications that establish confidence that software was created by an intended developer rather than a hacker ^[17]. The underlying mathematical foundations vary across families; while code-based cryptography has undergone a long history of public scrutiny, lattice-based cryptography provides very fast algorithms ^[18]. Lattice cryptography underlies most post-quantum security today ^[19]. Specifically, FIPS 203, FIPS 204, and FIPS 206 are based on lattice cryptography ^[20]. In contrast, FIPS 205 is based on hash functions ^[21]. Although a preprint by Yilei Chen claimed that lattice-based cryptography was not immune to quantum attacks, subsequent inspection revealed that the argument contained a flaw ^[22].

Engineering trade-offs and implementation challenges

Transitioning to post-quantum cryptography introduces significant architectural trade-offs, as keys, ciphertexts, and digital signatures are significantly larger, even though computations are typically faster ^[23]. In distributed ledgers where block space is constrained, projects have begun early integration, with Algorand implementing post-quantum cryptography on its blockchain ^[24]. A systematisation of knowledge reviewing 33 publications evaluated post-quantum software implementation through human, organisational, and technological dimensions ^[25]. Implementation approaches in the literature divide into four categories: guidelines, frameworks, tools and libraries, and educational interventions ^[26]. Engineering challenges span five distinct layers: implementation security, system integration and lifecycle, tooling, organisational governance, and human factors ^[27]. To address these operational demands across critical sectors, the United States government established 2035 as its target date for migrating all national security systems to post-quantum cryptography ^[28].

Key facts

• Existing quantum computers feature approximately 1,000 qubits, whereas breaking current encryption is estimated to require about 500 times more qubits ^[1].
• Recent findings from Google Quantum AI indicate that the machine size posing a cryptographic threat is approximately 20 times smaller than previously estimated ^[2].
• Concurrent hardware research demonstrated a substantial reduction in the physical qubits required to produce a logical qubit ^[3].
• The likelihood of a successful quantum attack on cryptography within three years is less than one percent ^[5].
• The probability of quantum cryptanalytic capability reaches five to ten percent or higher across a five- to ten-year window ^[6].
• Most experts anticipate that large-scale quantum computers will not be built for at least a decade ^[4].
• Modern public-key cryptosystems such as RSA and elliptic curve cryptography are vulnerable to quantum algorithms, creating risks for internet commerce, chat services, and military infrastructure ^{[10][7][9][8][11]}.
• Adversaries can perform harvest now, decrypt later attacks by storing encrypted data today to decrypt once quantum hardware matures ^[12].
• Vehicles and internet-of-things devices using RSA are often projected to remain in operation for at least a decade ^[13].
• The National Institute of Standards and Technology has standardized FIPS 203, FIPS 204, and FIPS 205, with FIPS 206 slated for late 2024 ^[14][15].
• FIPS 203, 204, and 206 rely on lattice cryptography, whereas FIPS 205 is built on hash functions ^[20][21].
• Post-quantum cryptographic schemes feature larger key and signature sizes but generally execute calculations faster than legacy public-key algorithms ^[23].
• The United States government set 2035 as the completion target for migrating all national security systems to post-quantum standards ^[28].
• Software implementation across organizations faces challenges spanning five layers: implementation security, system integration and lifecycle, tooling, organisational governance, and human factors ^[27].