Electronics Guide

Cryptanalytic Capabilities in Brief

Risk assessment rests on a short summary of what quantum computers can actually break. Shor's algorithm, published in 1994, factors large integers and solves the discrete logarithm problem in polynomial time, which breaks RSA, finite-field Diffie-Hellman, ECDH, ECDSA, and every other public-key primitive whose security rests on those two problems. Grover's algorithm offers only a quadratic speedup against unstructured search, and it parallelizes poorly, so symmetric ciphers and hash functions survive with conservative parameters: AES-256, SHA-384, and SHA-512 remain sound choices, and NIST assesses that Grover's algorithm confers little practical benefit against AES-256.

That asymmetry shapes the entire assessment. Public-key cryptography must be replaced, symmetric cryptography needs only a parameter review, and the sections below therefore concentrate on finding, ranking, and scheduling the public-key dependencies across an organization's estate. The mechanics of the attacks, including the period-finding structure of Shor's algorithm, the circuit-depth limit that bounds Grover's search, the hidden subgroup problem, the relative cost of attacking elliptic curves and RSA, and the physical qubit counts a fault-tolerant attack would demand, are treated in Quantum Computing Threats. Cryptanalysis of the replacement schemes continues in parallel, which is one reason cryptographic agility belongs in every migration plan.

Vulnerable Cryptographic Systems

Public-key cryptography based on factoring and discrete logarithms faces an existential threat from quantum computers. RSA key transport and digital signatures, deployed throughout internet protocols and enterprise systems, will be completely broken. Elliptic curve cryptography, widely adopted for its efficiency advantages over RSA, is equally vulnerable; published resource estimates for attacking a 256-bit curve and a 2048-bit RSA modulus are now close enough that neither family should be assumed to fall appreciably later than the other. Diffie-Hellman key exchange in all its variants, including ECDH, will no longer provide secure key agreement.

The impact extends throughout the security infrastructure. TLS connections protecting web traffic use RSA or ECDH for key exchange and RSA or ECDSA for authentication. Virtual private network (VPN) connections similarly depend on vulnerable key exchange and authentication. Code signing, document signing, and email encryption using S/MIME or PGP rely on RSA or elliptic curve signatures. Certificate authorities and the entire public key infrastructure (PKI) hierarchy are built on these vulnerable algorithms.

Symmetric cryptography and hash functions call for review rather than replacement. The inventory should still record symmetric key sizes and hash output lengths, so that uses carrying long confidentiality requirements can be raised to 256-bit keys and longer digests on an ordinary refresh cycle instead of being treated as a migration emergency. The symmetric components of a system are not the primary concern for quantum migration.

A separate family of algorithms is designed specifically for quantum resistance. Lattice-based, code-based, hash-based, and multivariate constructions rely on problems not known to be efficiently solvable by quantum computers. These post-quantum algorithms are no longer research proposals: NIST published its first three finalized standards on August 13, 2024, comprising FIPS 203 for ML-KEM key encapsulation, FIPS 204 for ML-DSA signatures, and FIPS 205 for SLH-DSA hash-based signatures. NIST selected HQC in March 2025 as a code-based backup key-encapsulation mechanism whose security rests on a different mathematical problem than ML-KEM, and a standard for the FALCON signature scheme, to be designated FN-DSA, remains in preparation. Replacements therefore exist for every quantum-vulnerable public-key function in common use.

Assessment of current deployments should identify where quantum-vulnerable algorithms are used and plan for their replacement. Attention is warranted for cryptography that is easy to overlook: key exchange negotiated inside proprietary protocols, signatures verified by bootloaders and secure elements, keys burned into device fuses at manufacture, and long-lived certificates whose validity extends past the planned migration window. Embedded and industrial equipment is the hardest case, because its cryptography is often fixed in mask ROM or in firmware that no longer receives vendor updates.

Harvest-Now-Decrypt-Later Threat

The harvest-now-decrypt-later (HNDL) threat fundamentally changes the timeline for quantum risk. Adversaries can capture and store encrypted communications today, retaining them until quantum computers capable of decryption become available. Data with long-term confidentiality requirements is therefore already at risk, even though practical quantum computers may be years away.

State-level adversaries have both the willingness and the capability to collect encrypted traffic at scale. Signals intelligence agencies routinely intercept and store communications that cannot currently be decrypted, anticipating future cryptanalytic advances. The cost of storing encrypted data is modest compared with the potential intelligence value of eventually accessing the secrets of foreign governments, corporations, and individuals.

The HNDL threat means that migration to quantum-resistant cryptography should begin immediately for data whose confidentiality must extend beyond the quantum computing horizon. Classified government information, corporate trade secrets, personal health records, financial data, and other long-lived sensitive information should be protected with quantum-resistant encryption as soon as practical, even at the cost of some performance impact or compatibility complexity.

Authentication systems face different HNDL dynamics, because authentication events are ephemeral. Breaking an authentication exchange years later yields no access if the system has since been updated or the session has long ended. Persistent signed artifacts are the exception: signed documents, code signatures, and similar long-lived authenticated objects may remain valuable targets for future quantum forgery, and root-of-trust signatures embedded in hardware can be especially difficult to update. The distinction between confidentiality and authentication informs how migration efforts are prioritized.

Planning Timelines and Deprecation Dates

Estimating when cryptographically relevant quantum computers (CRQCs) will exist is inherently uncertain, yet migration planning needs dates rather than probabilities. Deployed hardware remains orders of magnitude short of the thousands of high-fidelity logical qubits and the billions of sequential logical operations that an attack on RSA-2048 would demand, while the published resource estimates for such an attack have fallen sharply as error correction and modular arithmetic have improved. Quantum Computing Threats examines that hardware progress and those estimates in detail. What matters for threat analysis is that the estimates move, and that they have moved downward, so a migration schedule anchored to a single projected arrival date is fragile by construction.

Expert estimates for cryptographically relevant quantum computers span from optimistic projections of roughly a decade to conservative estimates of twenty years or more. The Global Risk Institute's annual Quantum Threat Timeline Report, which surveys a few dozen quantum computing researchers, is the most widely cited longitudinal source. Its recent editions put the averaged expert probability of a cryptographically relevant quantum computer appearing within ten years at roughly 28 to 49 percent, depending on how the responses are aggregated, and within fifteen years at roughly 51 to 70 percent. Successive editions have shifted toward shorter timelines rather than longer ones.

Policy has begun to supply planning dates where the science supplies only probabilities, and those dates now bind more tightly than the physics. The draft NIST Internal Report 8547 on transitioning to post-quantum cryptography standards proposes deprecating quantum-vulnerable public-key algorithms rated at 112 bits of security, such as RSA-2048 and ECDSA over P-256, after 2030, and disallowing all quantum-vulnerable public-key cryptography after 2035. For most organizations the compliance horizon therefore arrives before the cryptanalytic one, and migration schedules should be built around it. Prudent threat analysis still considers scenarios across the full range rather than relying on a single point estimate, because the consequences of underestimating are severe: data encrypted with quantum-vulnerable algorithms today may already be compromised under the HNDL scenario.

Quantifying Time to Quantum Risk

Michele Mosca proposed a simple inequality that converts the abstract quantum threat into a concrete planning question. Let X be the number of years a given secret must remain confidential, Y the number of years the organization needs to migrate its systems to quantum-resistant cryptography, and Z the number of years until a cryptographically relevant quantum computer exists. If X plus Y exceeds Z, then secrets protected today will be exposed before the migration is complete, and the organization is already behind.

The inequality is useful because two of its three terms are under organizational control and are far easier to estimate than the third. X follows from data classification, regulation, and contract: a session cookie has an X measured in hours, a mortgage application in years, a patient record or a classified program in decades. Y follows from the cryptographic inventory, the number of dependent systems, and the pace at which the organization has historically completed comparable transitions. Enterprise-scale cryptographic migrations, such as the retirement of SHA-1 or the move from 1024-bit to 2048-bit RSA, took the better part of a decade even with mature replacements and broad vendor support, so a Y of five to ten years is realistic for a large estate with embedded and third-party dependencies.

Only Z is genuinely uncertain, and the inequality shows that the uncertainty matters less than intuition suggests. A worked example makes this plain. Consider records that must stay confidential for fifteen years, held by an organization that estimates a seven-year migration. X plus Y is twenty-two years, which exceeds even conservative estimates of Z. The conclusion does not depend on picking the right year for the arrival of a quantum computer; it holds across the entire plausible range, and the correct response is to start now. The same arithmetic applied to a system whose data has a one-year confidentiality requirement and a two-year migration path yields the opposite and equally defensible conclusion: that system can wait for a standard refresh cycle.

Applying the inequality per data class rather than organization-wide is what makes it actionable. A single enterprise will hold assets whose X spans four orders of magnitude, and treating them uniformly either wastes effort on ephemeral data or leaves long-lived secrets unprotected. The output of the exercise is a ranked list of data classes for which X plus Y already exceeds the low end of the estimated range for Z, and that list is the input to the risk assessment that follows.

Risk Assessment Framework

A structured risk assessment framework enables systematic evaluation of quantum threats to organizational systems and data. The framework weighs asset value, threat likelihood, vulnerability to quantum attack, and migration difficulty to prioritize the deployment of quantum-resistant cryptography across an organization's systems.

Asset classification identifies the data and systems that require protection and their confidentiality lifetimes. Long-lived secrets face the most urgent quantum risk because of the HNDL threat. Critical infrastructure may require integrity and availability protection against quantum-enabled attacks. The value of assets to adversaries influences both threat likelihood and the sophistication of the attacks they might employ.

A cryptographic inventory documents where quantum-vulnerable algorithms are deployed. This includes not only obvious uses such as TLS and VPN but also cryptography embedded in applications, databases, backup systems, firmware, and hardware devices. The inventory should record algorithm types, key sizes, certificate lifetimes, the location and protection of each key, and the implementation characteristics that affect migration complexity. Building it requires several complementary techniques, because no single method finds everything: passive network observation reveals negotiated protocol parameters, active scanning enumerates certificates and endpoints, static analysis of source and binaries finds calls into cryptographic libraries, and vendor questionnaires cover closed products. Each method has blind spots, and data at rest, offline systems, and cryptography in silicon are frequently missed.

A cryptographic bill of materials (CBOM) records the results in machine-readable form so the inventory can be maintained rather than repeated. The CycloneDX specification added cryptographic asset support for this purpose, allowing algorithms, protocols, certificates, and related material to be tracked alongside the software bill of materials that many organizations already produce. Treating the inventory as a continuously updated artifact rather than a one-time survey is what makes reassessment practical, since systems and their dependencies change faster than any manual audit cycle.

Migration complexity assessment evaluates the difficulty of transitioning each system to quantum-resistant cryptography. Some systems need only a configuration change, while others require firmware updates, hardware replacement, or complete redesign. Dependencies between systems create sequencing requirements, and resource constraints limit how quickly migrations can be completed.

Risk scoring combines these factors to prioritize effort. High-value assets protected by quantum-vulnerable cryptography and carrying long confidentiality requirements should migrate first. Systems with complex migration needs may have to begin planning early even when immediate migration is unnecessary. Ongoing monitoring tracks both the organization's migration progress and the advancement of quantum computing.

Sector-Specific Threat Considerations

Different sectors face distinct quantum threat profiles shaped by their data characteristics, regulatory requirements, and adversary interests. Sector-specific analysis ensures that threat assessments reflect the actual risk environment rather than generic assumptions.

Government and defense sectors face nation-state adversaries with substantial resources for both quantum computing development and encrypted traffic collection. Classified information often requires protection for decades, making HNDL threats particularly acute. Government systems also operate under mandates that convert the threat into dated obligations. In the United States, National Security Memorandum 10 and the Quantum Computing Cybersecurity Preparedness Act of 2022 first directed federal agencies to inventory vulnerable cryptography and plan migration, and subsequent executive direction and Office of Management and Budget guidance have set firm milestones for civilian high-value assets, requiring migration of key establishment ahead of digital signatures and full migration of remaining systems by 2035. For national security systems, the National Security Agency's Commercial National Security Algorithm Suite 2.0 sets its own staged adoption schedule, with software and firmware signing transitioning first because signed artifacts are the hardest to replace later.

The practical consequence for government suppliers is that these mandates propagate through acquisition. Federal contractors and product vendors are increasingly required to demonstrate conformance with the post-quantum standards, which pulls migration deadlines into commercial product roadmaps well ahead of any cryptanalytic threat. Organizations that sell into government markets should treat the regulatory timeline, not the quantum computing timeline, as their binding constraint.

Financial services handle highly valuable data that attracts sophisticated attackers. While the confidentiality of an individual transaction may be short-lived, accumulated transaction data enables valuable analysis, and authentication forgery could undermine the integrity of payments. Financial regulators increasingly expect institutions to consider emerging technological threats, including quantum computing. Payment networks and interbank systems also present critical-infrastructure concerns.

Healthcare organizations protect patient information whose legal confidentiality may extend for a patient's lifetime and beyond. Medical research data can retain scientific value for decades. Healthcare environments often include legacy and embedded equipment with limited cryptographic upgrade capability. Regulatory frameworks such as HIPAA require protection appropriate to data sensitivity.

Critical infrastructure sectors, including energy, telecommunications, and transportation, face integrity and availability threats in addition to confidentiality concerns. Operational technology systems may have extremely long deployment cycles with limited upgrade capability. The potential for physical harm from a compromised control system elevates the severity of the risk.

Adversary Capability Assessment

Threat analysis must consider which adversaries might develop or access quantum computing capabilities and what they would target. Different adversary classes present different threat levels and call for different defensive measures.

Nation-state adversaries invest heavily in quantum computing research and development. Major national programs exist in the United States, China, the European Union, Japan, and elsewhere. These adversaries have the resources for large-scale encrypted-traffic collection and indefinite storage. The intelligence priorities of foreign governments should inform an assessment of which organizational data might be targeted.

Advanced persistent threats (APTs) associated with nation-states would likely gain access to quantum capabilities through their state sponsors. Their established presence in victim networks could enable targeted collection of encrypted traffic for later decryption. APTs have already demonstrated sophisticated cryptographic capabilities in their tooling and tradecraft.

Criminal organizations currently lack the resources to develop quantum computers but might eventually access such capabilities as the technology matures, perhaps through cloud services. Ransomware operators and financial criminals would find quantum decryption valuable for unlocking previously exfiltrated victim data. The timeline for criminal quantum capability is likely longer than for state actors.

Corporate espionage actors might reach quantum capability through state sponsors, commercial cloud services, or their own development. Competitors with nation-state backing are already suspected of economic espionage by cyber means. Trade secrets and competitive intelligence would be attractive targets for quantum-enabled decryption.

Supply Chain Considerations

Quantum threat analysis must extend beyond an organization's own systems to its supply chain dependencies. Cryptographic vulnerabilities in supplier systems can expose organizational data even when internal systems are quantum-resistant. Supply chain assessment identifies where third-party quantum vulnerability creates risk.

Cloud service providers handle substantial organizational data and must themselves implement quantum-resistant cryptography. Assessment should evaluate provider migration plans and timelines. Data stored or processed in provider systems may be captured by adversaries targeting the provider rather than the organization directly.

Software and hardware suppliers embed cryptography in their products. Organizational systems may depend on supplier implementations that the organization cannot directly upgrade. Assessment should identify such dependencies and evaluate supplier plans for quantum-resistant updates. Long-lived embedded systems may require replacement rather than upgrade.

Business partners with whom data is shared present similar concerns. Encrypted transmissions to partners may be captured for HNDL attacks, and partner systems that store organizational data must implement appropriate quantum protections. Contracts may need to specify partner obligations for quantum migration.

Certificate authorities and PKI infrastructure underpin trust relationships throughout the digital ecosystem. Compromise of certificate authority keys through a quantum attack could enable widespread man-in-the-middle attacks and certificate forgery. The quantum resistance of PKI therefore affects every dependent system.

Migration Strategy Development

Quantum threat analysis directly informs migration strategy by identifying priorities, constraints, and appropriate approaches for transitioning to quantum-resistant cryptography. The strategy must balance security urgency against the practical constraints of cost, compatibility, and implementation complexity.

Prioritization based on threat analysis ensures that the highest-risk systems receive attention first. Long-lived confidential data facing HNDL threats should migrate immediately where practical. Critical infrastructure and other high-value systems follow. Lower-risk systems can migrate on standard refresh cycles without acceleration.

Hybrid cryptographic approaches provide quantum resistance while preserving compatibility during the transition. Combining a classical algorithm with a post-quantum algorithm keeps a connection secure even if one family is later broken, which is valuable while the post-quantum schemes accumulate cryptanalytic scrutiny. Hybrid key exchange has accordingly become the default approach for early deployments: TLS 1.3 named groups that pair X25519 with ML-KEM-768 are enabled by default in major web browsers and supported by mainstream TLS libraries, so a substantial share of web traffic is already protected against harvest-now-decrypt-later collection. Regulators have generally accepted hybrid constructions, and NIST's draft transition guidance does not disallow a hybrid mode merely because it retains a classical component.

Cryptographic agility enables future algorithm updates without wholesale system replacement. Systems designed with abstracted cryptographic interfaces can adopt new algorithms as standards evolve and new threats emerge. This is especially important given the relative immaturity of post-quantum cryptography compared with classical algorithms that have decades of analysis behind them.

Testing and validation ensure that migration does not introduce new vulnerabilities or break functionality. Post-quantum algorithms have markedly different size characteristics, and the numbers explain most of the integration difficulty. An ML-KEM-768 encapsulation key occupies 1,184 bytes and its ciphertext 1,088 bytes, against 32 bytes for an X25519 public key; an ML-DSA-65 signature runs to 3,309 bytes against 64 bytes for Ed25519; and SLH-DSA signatures range from roughly 8,000 bytes to nearly 50,000 depending on the parameter set. Those increases push a TLS handshake past the size that once fit in a single network packet, inflate certificate chains, and can exceed fixed buffer sizes in embedded firmware, in hardware security module APIs, and in protocols with hard-coded field widths.

Interoperability testing confirms that migrated systems work correctly with their intended communication partners, including middleboxes and inspection appliances that may reject unfamiliar handshake sizes or algorithm identifiers. Performance testing should measure handshake latency and memory footprint on the most constrained device in the deployment rather than on server hardware. Security testing verifies that implementations resist both quantum and classical attacks, with particular attention to side channels: the arithmetic in lattice-based schemes offers new opportunities for timing and power leakage, and several published attacks have targeted implementation flaws rather than the underlying mathematics.

Monitoring and Reassessment

Quantum threat analysis is not a one-time exercise; it requires ongoing monitoring and periodic reassessment as the threat landscape evolves. Both quantum computing capabilities and post-quantum cryptography continue to develop, prompting updates to threat assumptions and migration plans.

Quantum computing progress should be tracked through indicators that actually correlate with cryptanalytic capability. Physical qubit counts are the most publicized figure and the least informative; logical qubit counts, logical error rates, the physical-to-logical overhead ratio, and the circuit depth a machine can sustain before failure are the metrics that determine whether an attack is feasible. Research publications reveal algorithmic advances that may sharply reduce the resources required, as the fall in RSA-2048 estimates between 2019 and 2025 demonstrated. Vendor roadmaps and independent expert assessments provide context, but roadmaps are commercial documents and should be weighted accordingly.

Developments in post-quantum cryptography may reveal new vulnerabilities or provide new options. NIST continues to standardize algorithms beyond its first finalized set, broadening the toolkit and adding mathematical diversity so that a break in one family does not leave the ecosystem without alternatives. That diversity is not a theoretical precaution. During standardization, classical cryptanalysis destroyed candidates that had survived years of review: the Rainbow multivariate signature scheme was broken by a practical classical attack in 2022, and the isogeny-based SIDH and SIKE schemes fell to a classical key-recovery attack later the same year, after SIKE had advanced to an alternate-candidate round. Both were broken by conventional computers, not quantum ones, which is a reminder that the nearest-term risk to a post-quantum deployment is a flaw in the new mathematics rather than the arrival of a quantum computer. Implementation advances, meanwhile, continue to improve performance and widen the range of constrained applications in which post-quantum cryptography is practical.

Organizational changes affect quantum threat exposure. New systems, data types, or business relationships may introduce quantum-vulnerable cryptography or raise the value of assets at risk. Changes in adversary activity or regulatory requirements may shift threat priorities. Migration progress should be tracked against planned timelines.

Periodic reassessment should update threat timelines, asset valuations, and migration priorities as information accumulates. Annual or more frequent reviews keep the quantum security strategy aligned with evolving threats and organizational circumstances. Triggers for an unscheduled reassessment include significant quantum computing announcements, cryptographic breakthroughs, and major organizational changes.

Conclusion

Quantum threat analysis turns an uncertain cryptanalytic future into an ordered program of work. The cryptanalytic facts are simple enough to state in a paragraph: public-key cryptography must be replaced, while symmetric cryptography needs only conservative parameters. The difficulty lies in finding every place the vulnerable algorithms are used, deciding which uses cannot wait, and scheduling the remainder. The harvest-now-decrypt-later threat means that long-lived secrets are already at risk, demanding immediate attention despite uncertain quantum computing timelines.

Systematic risk assessment evaluates organizational exposure by weighing asset value, cryptographic inventory, adversary capabilities, and migration complexity. Mosca's inequality reduces that assessment to a decision rule: where the confidentiality lifetime of a secret plus the time required to migrate exceeds the time until a capable quantum computer exists, action is already overdue. Sector-specific considerations ensure that the analysis reflects actual risk environments, and supply chain dependencies extend its scope beyond organizational boundaries.

The practical situation has shifted from anticipation to execution. Standardized replacements exist for every quantum-vulnerable public-key function in common use, hybrid key exchange is deployed by default across much of the web, and regulatory deadlines now arrive before any credible estimate of a cryptographically relevant quantum computer. For most organizations the binding constraint is therefore the pace of their own migration rather than the pace of quantum hardware, and the value of threat analysis lies in directing limited effort to the assets where the arithmetic of risk is least forgiving. Ongoing monitoring and periodic reassessment keep that direction current as both the hardware and the cryptanalysis continue to develop.

Related Topics