The Post-Quantum Field Guide

LaMarr LabsLaMarr Labs

What Can a Quantum Computer Actually Break

11 min read

up:: The Threat MOC

What Can a Quantum Computer Actually Break?

Every few months a headline promises that a quantum computer is about to break all encryption and end digital privacy as we know it. The precise version is narrower and far more useful. A quantum computer breaks one specific half of cryptography completely, leaves the other half standing with a minor adjustment, and does neither of those things today. Getting that distinction right is the whole difference between a migration aimed at the real exposure and a panic aimed at the wrong layer.

I run cryptographic risk work for a living, and the myth costs organizations real money. Teams brace to replace ciphers that were never in danger while the algorithms that actually fall sit untouched inside their key exchanges. So here is the sober version, drawn from what NIST, the NSA, and the peer-reviewed literature actually say, of what a quantum computer can break, what it can only dent, and where the popular story goes wrong.

The one thing quantum genuinely breaks is public-key cryptography

The real casualty is public-key cryptography, the math that lets two strangers agree on a secret and that proves a certificate is genuine. RSA, Diffie-Hellman, and every form of elliptic-curve cryptography rest their security on two hard math problems: factoring a very large number back into its primes, and solving a discrete logarithm. A classical computer would need longer than the age of the universe to crack either one at real key sizes, and that slowness is the security.

In 1994, Peter Shor showed that a quantum computer can solve both problems efficiently.1 Shor’s algorithm recovers a private key straight from the matching public key, so the padlock stays intact while its combination becomes readable in hours. When it runs, key exchange fails, which is a confidentiality problem, and digital signatures fail, which is a trust problem. That reaches TLS and the certificates behind every HTTPS connection, plus VPNs, SSH, and software signing, the entire trust fabric the internet runs on.2

One counterintuitive fact matters for planning: elliptic-curve cryptography falls to a smaller quantum computer than RSA at comparable classical strength, because it needs fewer error-corrected qubits to attack.3 The compact keys that make ECC efficient today are the same keys that make it fall first, so moving from RSA to ECC to buy time runs exactly the wrong way.

The myth that it breaks AES and hashing

Here is where the “breaks all encryption” story falls apart. Symmetric encryption like AES-256 and hash functions like SHA-256 give Shor’s algorithm nothing to grab. Their security comes purely from the size of the keyspace, with no factoring problem or discrete logarithm hidden inside for Shor’s to solve. The only quantum attack against them is Grover’s algorithm, and it is far weaker.

Grover’s algorithm speeds up blind search, finding a target among N possibilities in about the square root of N steps rather than N. Against a cipher, that halves the effective security, so an n-bit key drops to roughly n/2 bits. NIST states the consequence plainly, that Grover’s speedup “does not render cryptographic technologies obsolete,” and that “doubling the key size will be sufficient to preserve security.”4 So AES-128 drops to about 64 bits and is worth retiring, while AES-256 drops to about 128 bits and stays comfortably safe.

The real picture is even more forgiving, because Grover’s speedup barely parallelizes and demands enormous, deep circuits, which is why NIST concludes the symmetric primitives “provide substantially more quantum security than a naïve analysis might suggest.”4

Hash functions absorb it the same way, by sizing the output. SHA-256 keeps about 128 bits of preimage resistance against Grover’s, which stays strong, and SHA-384 covers the highest-assurance use.4 The clearest tell that the myth is wrong sits in the NSA’s own CNSA 2.0 suite: the same advisory that retires RSA and elliptic-curve cryptography for national-security systems keeps AES-256 in place as the required symmetric cipher.5

The accurate headline runs deeper than “quantum breaks encryption.” Quantum shatters the public-key half through Shor’s and merely trims the symmetric half through Grover’s. That asymmetry is the single most important fact in the whole transition, because it means the work ahead is overwhelmingly a public-key migration.

Myth versus fact, in one table

The popular claimWhat actually happensWhy
Quantum breaks all encryptionIt breaks public-key cryptography; symmetric encryption and hashing surviveShor’s hits factoring and discrete logs; Grover’s only speeds up search14
Quantum breaks AES-256AES-256 stays safe, retaining about 128 bits of strengthGrover’s halves the margin, and a 256-bit key has margin to spare4
Quantum breaks SHA-256 hashingSHA-256 keeps about 128-bit preimage resistance and stays strongGrover’s only dents it; larger digests cover high assurance4
A record qubit count means RSA is about to fallToday’s noisy machines are far short of the thresholdThe metric is error-corrected logical qubits, needing millions of physical ones3
RSA is stronger than ECC, so it outlasts itElliptic-curve systems fall to a smaller machine than RSAECC needs fewer logical qubits at comparable classical strength3
Q-Day is a fixed date on the calendarIt’s a capability threshold with an uncertain arrival, roughly 2030 to 2040Expert surveys report a probability band rather than a countdown6
One PQC product makes you quantum-safePost-quantum readiness is a multi-year migration across every systemCryptography hides in protocols, vendors, and hardware you have to find first7

Q-Day is a capability threshold rather than a calendar date

Q-Day is shorthand for the day a cryptographically relevant quantum computer can break RSA-2048, and it’s a capability threshold rather than a scheduled event. No such machine exists in 2026. The threshold is measured in error-corrected logical qubits, thousands of them, which today means millions of high-quality physical ones, while leading machines have reached only the low thousands of noisy physical qubits.3

Expert surveys put a capable machine plausibly in the 2030 to 2040 band and report it as a probability distribution.6 Authoritative bodies encode that uncertainty as a planning horizon: NIST IR 8547 deprecates RSA and elliptic-curve cryptography by 2030 and disallows them by 2035, and the UK NCSC sets a parallel roadmap with milestones in 2028, 2031, and 2035.78 Talk of a firm “Q-Day 2030” mistakes a forecast band for an appointment.

The reason to act despite the uncertainty is harvest now, decrypt later: an adversary records encrypted traffic today and decrypts it once a CRQC arrives, so data with a long secrecy life is exposed the moment it crosses the wire. A 2026 analysis of Nginx TLS configurations published on GitHub found 28.9% specifying RSA key exchange with no forward secrecy, and sessions recorded against a server configured that way can be opened retroactively the day the machine turns on.9

Will a quantum computer break Bitcoin?

This is the question I get asked most, and the answer is specific rather than a flat yes or no. Bitcoin signs transactions with ECDSA on the secp256k1 curve, and Shor’s algorithm breaks ECDSA by recovering the private key from the public key, so the signature scheme is vulnerable in principle. The nuance is that your public key becomes visible on the blockchain only under certain conditions.

Modern Bitcoin addresses, the pay-to-public-key-hash type, publish only a hash of your public key, and a hash gives Shor’s algorithm nothing to attack. Your actual public key surfaces only when you spend from an address. Older pay-to-public-key outputs, including much of what early miners hold, store the full public key on-chain permanently, and any address reused after a spend has already revealed its key. Deloitte’s analysis found roughly 4 million BTC, about 25% of the supply, sitting in addresses with exposed public keys, split between early P2PK coins and reused addresses.10 Those are the coins a capable quantum attacker could take.

There is also a live-attack window even for well-managed addresses. When you broadcast a transaction, your public key enters the mempool before the network confirms the block, so an attacker with a fast enough CRQC could in principle derive the key and race a competing transaction into the next block.11 All of this needs a machine that does not exist yet, and the Bitcoin protocol can adopt post-quantum signatures before one arrives. The exposure is real, bounded, and fixable, well short of an on-off doomsday switch.

Is there a post-quantum silver bullet?

The last myth is the most expensive one, the belief that a single product or a one-line config change makes an organization “quantum-safe.” The replacements are real and standardized, ML-KEM for key establishment and ML-DSA alongside SLH-DSA for signatures, and they rest on lattice and hash problems with no known efficient quantum attack.12 Deploying them across a real estate is a multi-year migration, because cryptography hides in TLS stacks, VPNs, code-signing pipelines, hardware roots of trust, vendor products, and protocols you don’t control. NIST and the NCSC both front-load the same unglamorous first step, discovery, meaning finding where your cryptography actually lives, before anything gets replaced.78

The prudent path adds crypto-agility so future swaps become configuration changes, and hybrid deployments that run a classical and a post-quantum algorithm together, so security holds even if one is later found weak. The collapse of a leading post-quantum candidate in 2022, broken on a single processor core in hours, is the standing reminder that “post-quantum” is a moving research target rather than a finished guarantee.13

A second instance landed in 2026 and arrived by a different route. An AI system found a previously unknown symmetry in the lattice structure of HAWK, a signature candidate, halving its effective key size and dropping the expected attack cost on HAWK-256 from 2^64 to 2^38. The scheme had already survived 2 years and 2 rounds of expert human review. Its submission team withdrew it, and NIST’s round-3 page records the withdrawal.14

The scope matters as much as the finding. HAWK was a candidate and never a standard, no deployed system used it, and the researchers state plainly that the attack is specific to HAWK and does not reach the other candidates or lattice-based cryptography generally, so ML-KEM, ML-DSA, and SLH-DSA are untouched. What it does show is that analysis pressure on these schemes is rising on a software clock, which argues for crypto-agility rather than against post-quantum cryptography.

The sober summary

A quantum computer breaks public-key cryptography, meaning RSA, Diffie-Hellman, and elliptic-curve systems, through Shor’s algorithm. It leaves AES-256 and modern hashing standing, because Grover’s algorithm only trims their margin and a larger parameter restores it. The machine that finishes the job doesn’t exist yet, its arrival is a probability band rather than a date, Bitcoin’s exposure is confined to exposed public keys, and the fix is a deliberate migration rather than a purchase. Fear aimed at the wrong layer wastes the years you actually have, and precision aimed at the right one turns this into ordinary, finishable work.

Everything here is the map, given freely. When your team needs the threat sorted into what genuinely breaks, what merely weakens, and what to move first across your own systems, that’s the work I do.

Last verified 2026-07-26 · Updated 2026-08-25 · Maintained by Addie LaMarr, LaMarr Labs.

Footnotes

  1. Peter W. Shor, “Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer,” SIAM Journal on Computing 26(5), 1997. arXiv:quant-ph/9508027 ↩ ↩2

  2. CISA, NSA, and NIST, “Quantum-Readiness: Migration to Post-Quantum Cryptography,” August 2023. cisa.gov ↩

  3. Martin Roetteler, Michael Naehrig, Krysta M. Svore, Kristin Lauter, “Quantum resource estimates for computing elliptic curve discrete logarithms,” 2017, and Craig Gidney and Martin Ekerå, “How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits,” Quantum 5, 433, 2021. arXiv:1706.06752, arXiv:1905.09749 ↩ ↩2 ↩3 ↩4

  4. NIST, “Report on Post-Quantum Cryptography,” NISTIR 8105, April 2016. csrc.nist.gov/pubs/ir/8105/final ↩ ↩2 ↩3 ↩4 ↩5 ↩6

  5. NSA, “Announcing the Commercial National Security Algorithm Suite 2.0,” CSA U/OO/194427-22, September 2022. nsa.gov ↩

  6. Michele Mosca and Marco Piani, “Quantum Threat Timeline Report,” Global Risk Institute and evolutionQ. globalriskinstitute.org ↩ ↩2

  7. NIST, “Transition to Post-Quantum Cryptography Standards,” NIST IR 8547 (initial public draft), 2024. nvlpubs.nist.gov ↩ ↩2 ↩3

  8. NCSC, “Timelines for migration to post-quantum cryptography,” 20 March 2025. ncsc.gov.uk/guidance/pqc-migration-timelines ↩ ↩2

  9. Balaji et al., “Operationalising Post-Quantum TLS,” 2026. arXiv:2605.17955 ↩

  10. Itan Barmes and Bram Bosch, “Quantum computers and the Bitcoin blockchain,” Deloitte. deloitte.com ↩

  11. Divesh Aggarwal, Gavin K. Brennen, Troy Lee, Miklos Santha, Marco Tomamichel, “Quantum attacks on Bitcoin, and how to protect against them,” 2018. arXiv:1710.10377 ↩

  12. NIST, “Module-Lattice-Based Key-Encapsulation Mechanism Standard” (FIPS 203), “Module-Lattice-Based Digital Signature Standard” (FIPS 204), and “Stateless Hash-Based Digital Signature Standard” (FIPS 205), August 2024. csrc.nist.gov ↩

  13. Wouter Castryck and Thomas Decru, “An efficient key recovery attack on SIDH,” EUROCRYPT 2023, IACR ePrint 2022/975. eprint.iacr.org/2022/975 ↩

  14. Anthropic, “Discovering cryptographic weaknesses with Claude,” 2026. anthropic.com; NIST, “Round 3 Additional Signatures,” updated July 29, 2026. csrc.nist.gov ↩

Graph View

Backlinks