The Post-Quantum Field Guide

LaMarr LabsLaMarr Labs

Did We Know the Quantum Threat Was Coming

10 min read

up:: The Threat MOC

Did We Know the Quantum Threat Was Coming?

In 1977 the United States gave the public its first official encryption standard, the Data Encryption Standard, and in the same window the two cryptographers who had just invented public-key cryptography published a paper explaining that the new standard was already built too weak to last. Whitfield Diffie and Martin Hellman pointed out that DES used a key of only 56 bits, a keyspace small enough that a purpose-built machine could eventually try every possibility, and they put a rough date on the failure. Sometime in the 1990s, they wrote, a well-funded attacker would be able to break DES by brute force.1 They were right almost to the decade.

In July 1998 the Electronic Frontier Foundation switched on a machine it had built for under $250,000, nicknamed Deep Crack, and it recovered a DES key by exhaustive search in 56 hours.2 The warning arrived in plain sight, stapled to the very first standard, and the field spent 20 years watching it come true. That’s the shape of the whole story I want to tell you, because it’s the story the quantum transition is repeating right now.

For more than 40 years cryptographers have known a plain and slightly uncomfortable thing. Every cipher has a shelf life. The math that looks unbreakable today gets chipped at by clever people and faster machines until eventually it falls, and the only reliable defense is to build systems that can swap a failing algorithm for a fresh one without being torn apart. The post-quantum migration feels new and enormous, and in scale it is, yet the lesson underneath it has been on the table since the DES days. We were told, repeatedly and with receipts, and we mostly built as though the warning were somebody else’s problem.

We built the whole internet on two hard puzzles

The public-key cryptography that secures nearly all digital infrastructure rests on a remarkably small mathematical base. RSA, introduced in 1977, draws its security from the difficulty of factoring very large numbers.3 Elliptic-curve cryptography, proposed independently by Neal Koblitz and Victor Miller in 1985 and deployed widely two decades later, draws its security from the discrete-logarithm problem.4 Those two puzzles, factoring and discrete logs, are close mathematical relatives, and between them they came to underpin the key exchange, the certificates, and the digital signatures that the entire web runs on.

That concentration is its own kind of exposure, and it has a name: a cryptographic monoculture. When an entire ecosystem leans on one family of mathematics, a single breakthrough against that family becomes a break against everything at once. The industry knew RSA and elliptic curves were cousins, knew they could in principle fall to related techniques, and standardized deep, hard-to-change dependencies on both anyway, because they were fast, they were well understood, and the day of reckoning felt comfortably far off.

Then came the warning with a date on it

In 1994 Peter Shor gave the concentration a precise expiration condition. He showed that a sufficiently large quantum computer could solve both factoring and the discrete-logarithm problem efficiently, using a single underlying technique.5 From that moment the danger to RSA and to elliptic-curve cryptography was fully understood in theory. The machine to execute Shor’s algorithm didn’t exist, and still doesn’t in 2026, yet the intellectual work was finished more than 30 years ago. Anyone paying attention knew that the two puzzles holding up the internet had a common structural flaw, and that a specific future device would exploit it.

The next stretch of the timeline is the striking one. After 1994, with the theoretical break already published, the world went on deploying RSA and elliptic curves more widely and more deeply. They spread into TLS, into the public-key infrastructure behind every certificate, into code signing, into the chips in payment cards and phones and cars. The warning had a citation and a mechanism, and the response for three decades was to pour more foundation on top of the crack. That gap between knowing and acting is the real subject of the transition, and it’s a human pattern more than a cryptographic one, which is a story I tell in full in The Psychology of Post-Quantum Risk.

A cipher can turn from trusted to dangerous fast

If the quantum threat still feels abstract, the record of ordinary, non-quantum breaks is anything but. The clearest recent proof is a hash function that most of the internet trusted for 20 years. SHA-1 was a government-standard fingerprint sitting under certificates, signatures, and software integrity from 1995 onward. Cryptographers found theoretical collisions in 2005, showing the algorithm was weaker than its size implied.6 In 2017 a team at CWI Amsterdam and Google produced the first real collision, two different PDF files with an identical SHA-1 digest.7

By 2020 the attack had matured into a chosen-prefix collision that a researcher could rent for roughly $45,000, cheap enough to forge documents against a chosen target.8 NIST formally retired SHA-1 in December 2022 and set the end of 2030 as the date it becomes disallowed.9 A primitive the whole world leaned on became a liability through nothing more exotic than patient classical mathematics.

The post-quantum era has already delivered its own version of the same shock, and it’s even sharper. Isogeny-based cryptography, and specifically the scheme called SIKE, was a serious NIST candidate designed from the ground up to resist quantum computers. It survived roughly a decade of scrutiny and advanced deep into the standardization process.

Then in July 2022 Wouter Castryck and Thomas Decru published a key-recovery attack that ran on an ordinary classical computer, recovering the private key for the weakest parameter set in minutes and the strongest, SIKEp751 at NIST level 5, in about 3 hours 15 minutes, on a single processor core.10 A scheme built specifically to withstand the most powerful machines imaginable fell to a laptop-class computer and some new mathematics its designers hadn’t anticipated. Trusted, in cryptography, is always a temporary status, and the interval between “trusted” and “broken” can be a single paper.

The lesson was available the whole time

Two ideas would have absorbed nearly all of this, and both have been sitting on the table since the DES argument of the 1970s. The first is crypto-agility, the architectural discipline of treating your choice of algorithm as a setting you can change rather than an assumption welded into the code. A system built for agility retires a broken primitive with a configuration change. A system that hardcoded its algorithm has to be reopened and rebuilt, which is exactly why organizations ran SHA-1 and DES for years past their expiration dates. The difference between a clean rotation and a multi-year construction project is decided when the system is designed, long before the break lands.

The second idea is diversity, the deliberate refusal to build a monoculture. If the ecosystem keeps independent algorithms resting on unrelated hard problems, a break in one leaves the others standing, and an organization has somewhere to go in a hurry. NIST absorbed this lesson explicitly in the post-quantum standards, pairing a lattice-based main line with a code-based backup on entirely different mathematics, so a future break against one foundation wouldn’t take the whole encryption layer down together. Diversity gives you a safe alternative to run to; agility is what lets you actually reach it before the exposure window does its damage. Neither is a new invention. Both are the plain conclusion of watching ciphers fail for 40 years.

Where that leaves the quantum transition

The record, read whole, points away from doom. The field has a 40-year track record that tells it exactly what to do, and for the first time the tooling is ready to do it. The replacement algorithms are standardized. The architectural pattern that makes migration survivable is well understood. The regulators have even put the schedule in writing: NIST IR 8547 deprecates RSA and elliptic-curve cryptography by 2030 and disallows them by 2035, which turns the old, vague “someday” into a planning horizon a team can actually build against.11

So the way to frame everything in the section ahead is this. The quantum threat is real and it’s specific, and you’ll meet the machine that executes it, the cryptographically relevant quantum computer, and the two clocks that decide how soon your own data is exposed. Read all of it as the latest, largest instance of a very old and well-documented pattern rather than a bolt from the blue. Cryptography has always been temporary. The organizations that came through every earlier break intact were the ones that expected it and built to replace their algorithms cleanly. The 40-year warning reaches past quantum computers: it asks whether you’re building so that the next break, from whatever direction it comes, is a bad afternoon rather than a bad decade.

Everything here is the map, given freely. When your team needs the quantum transition turned into a real plan for your own systems and deadlines, built so the next algorithm change is a setting rather than a rebuild, that’s the work I do.

Last verified 2026-07-26 · Updated 2026-08-25 · Maintained by Addie LaMarr, LaMarr Labs.

Footnotes

  1. Whitfield Diffie and Martin E. Hellman, “Exhaustive Cryptanalysis of the NBS Data Encryption Standard,” Computer 10(6), 1977, pp. 74-84. They estimated a purpose-built machine could exhaust the 56-bit DES keyspace and predicted the standard would be insecure by the 1990s. doi.org/10.1109/C-M.1977.217750 ↩

  2. Electronic Frontier Foundation, “Cracking DES: Secrets of Encryption Research, Wiretap Politics, and Chip Design,” 1998. Deep Crack recovered a DES key by brute force in 56 hours on July 15, 1998, winning RSA Laboratories’ DES Challenge II. eff.org ↩

  3. R. L. Rivest, A. Shamir, and L. Adleman, “A Method for Obtaining Digital Signatures and Public-Key Cryptosystems,” Communications of the ACM 21(2), 1978 (work circulated 1977). doi.org/10.1145/359340.359342 ↩

  4. Victor S. Miller, “Use of Elliptic Curves in Cryptography,” CRYPTO 1985; Neal Koblitz, “Elliptic Curve Cryptosystems,” Mathematics of Computation 48(177), 1987. The two proposed elliptic-curve cryptography independently in 1985. doi.org/10.1007/3-540-39799-X_31 ↩

  5. Peter W. Shor, “Algorithms for Quantum Computation: Discrete Logarithms and Factoring,” Proceedings 35th Annual Symposium on Foundations of Computer Science (FOCS), 1994; expanded as “Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer,” SIAM Journal on Computing 26(5), 1997. arXiv:quant-ph/9508027 ↩

  6. Xiaoyun Wang, Yiqun Lisa Yin, and Hongbo Yu, “Finding Collisions in the Full SHA-1,” CRYPTO 2005. doi.org/10.1007/11535218_2 ↩

  7. Marc Stevens, Elie Bursztein, Pierre Karpman, Ange Albertini, and Yarik Markov, “The First Collision for Full SHA-1,” CRYPTO 2017, February 23, 2017. shattered.io ↩

  8. Gaëtan Leurent and Thomas Peyrin, “SHA-1 is a Shambles: First Chosen-Prefix Collision on SHA-1 and Application to the PGP Web of Trust,” USENIX Security 2020. The chosen-prefix collision cost roughly $45,000 in rented computing time. sha-mbles.github.io ↩

  9. NIST, “NIST Retires SHA-1 Cryptographic Algorithm,” December 15, 2022, setting December 31, 2030 as the date SHA-1 becomes disallowed. nist.gov ↩

  10. Wouter Castryck and Thomas Decru, “An Efficient Key Recovery Attack on SIDH,” IACR ePrint 2022/975, July 2022. A classical, polynomial-time attack recovered SIKE private keys on a single processor core, about 10 minutes for the level-1 set and about 3 hours 15 minutes for the level-5 set. eprint.iacr.org/2022/975 ↩

  11. NIST, “Transition to Post-Quantum Cryptography Standards,” NIST IR 8547 (initial public draft), 2024. Deprecates RSA and elliptic-curve cryptography by 2030 and disallows them after 2035. nvlpubs.nist.gov ↩

Graph View

Backlinks