Electronics Guide

Quantum Algorithm Capabilities

Quantum computers derive their cryptanalytic power from specific algorithms that exploit quantum mechanical phenomena to solve certain mathematical problems far faster than classical computers. Understanding these algorithms, and the problems they solve, is essential for identifying which cryptographic systems are threatened and which remain secure.

Shor's algorithm, published by Peter Shor in 1994, factors large integers and solves the discrete logarithm problem in polynomial time on a quantum computer. This directly threatens RSA encryption and signatures, which rely on the difficulty of factoring products of large primes. It equally threatens Diffie-Hellman key exchange and elliptic curve cryptography, which depend on the discrete logarithm problem in multiplicative groups and elliptic curve groups respectively. A sufficiently large, fault-tolerant quantum computer running Shor's algorithm could break these systems in hours or days rather than the astronomical times required classically.

Grover's algorithm provides a quadratic speedup for searching an unstructured space, which reduces the effective preimage resistance of symmetric algorithms and hash functions by roughly half. A 256-bit AES key offers on the order of 128 bits of security against a brute-force quantum search, and SHA-256 retains roughly 128 bits of preimage resistance. In practice the advantage is smaller than the bare quadratic figure suggests: Grover's search is inherently sequential and parallelizes poorly, so distributing it across many machines erodes the speedup, and NIST assesses that Grover's algorithm provides little practical benefit against AES-256. The collision resistance of a hash function is governed by the birthday bound, which already places SHA-256 at about 128 bits classically; quantum collision-finding offers at most a modest further reduction and is not considered a practical threat. The upshot is that symmetric cryptography and hashing remain secure with conservative parameter choices, in stark contrast to the catastrophic impact Shor's algorithm has on public-key cryptography.

Additional quantum algorithms may threaten specific constructions. Quantum algorithms for the hidden subgroup problem underlie Shor's results and could, in principle, attack other schemes built on related group structures. Research continues into quantum attacks on lattice-based and other post-quantum systems, though no practical break has been demonstrated. Ongoing cryptanalysis ensures that the quantum threat landscape continues to evolve, which is one reason cryptographic agility matters.

Vulnerable Cryptographic Systems

Public-key cryptography based on factoring and discrete logarithms faces an existential threat from quantum computers. RSA key transport and digital signatures, deployed throughout internet protocols and enterprise systems, will be completely broken. Elliptic curve cryptography, widely adopted for its efficiency advantages over RSA, is equally vulnerable, and in fact requires fewer quantum resources to attack at comparable classical strength. Diffie-Hellman key exchange in all its variants, including ECDH, will no longer provide secure key agreement.

The impact extends throughout the security infrastructure. TLS connections protecting web traffic use RSA or ECDH for key exchange and RSA or ECDSA for authentication. Virtual private network (VPN) connections similarly depend on vulnerable key exchange and authentication. Code signing, document signing, and email encryption using S/MIME or PGP rely on RSA or elliptic curve signatures. Certificate authorities and the entire public key infrastructure (PKI) hierarchy are built on these vulnerable algorithms.

Symmetric cryptography and hash functions face a reduced and manageable quantum impact. AES, ChaCha20, and other symmetric ciphers remain secure at standard key sizes, with 256-bit keys recommended for long-term assurance. SHA-2 and SHA-3 provide adequate security with output sizes chosen for the required margin; SHA-384 or SHA-512 are sensible choices where long-term preimage resistance matters. HMAC and other symmetric authentication codes maintain security with appropriate parameters. The symmetric components of a system are not the primary concern for quantum migration.

A separate family of algorithms is designed specifically for quantum resistance. Lattice-based, code-based, hash-based, and multivariate constructions rely on problems not known to be efficiently solvable by quantum computers. These post-quantum algorithms have now been standardized and can replace vulnerable schemes (see the development timeline below). Assessment of current cryptographic deployments should identify where quantum-vulnerable algorithms are used and plan for their replacement.

Harvest-Now-Decrypt-Later Threat

The harvest-now-decrypt-later (HNDL) threat fundamentally changes the timeline for quantum risk. Adversaries can capture and store encrypted communications today, retaining them until quantum computers capable of decryption become available. Data with long-term confidentiality requirements is therefore already at risk, even though practical quantum computers may be years away.

State-level adversaries have both the willingness and the capability to collect encrypted traffic at scale. Signals intelligence agencies routinely intercept and store communications that cannot currently be decrypted, anticipating future cryptanalytic advances. The cost of storing encrypted data is modest compared with the potential intelligence value of eventually accessing the secrets of foreign governments, corporations, and individuals.

The HNDL threat means that migration to quantum-resistant cryptography should begin immediately for data whose confidentiality must extend beyond the quantum computing horizon. Classified government information, corporate trade secrets, personal health records, financial data, and other long-lived sensitive information should be protected with quantum-resistant encryption as soon as practical, even at the cost of some performance impact or compatibility complexity.

Authentication systems face different HNDL dynamics, because authentication events are ephemeral. Breaking an authentication exchange years later yields no access if the system has since been updated or the session has long ended. Persistent signed artifacts are the exception: signed documents, code signatures, and similar long-lived authenticated objects may remain valuable targets for future quantum forgery, and root-of-trust signatures embedded in hardware can be especially difficult to update. The distinction between confidentiality and authentication informs how migration efforts are prioritized.

Quantum Computing Development Timeline

Estimating when cryptographically relevant quantum computers (CRQCs) will exist is inherently uncertain, but informed projections guide threat analysis and migration planning. Today's quantum computers, while impressive scientific achievements, remain far from the scale needed to break practical cryptographic systems. Progress continues but faces formidable engineering challenges.

Breaking RSA-2048 requires a fault-tolerant quantum computer with thousands of logical qubits executing on the order of billions of operations. Current systems offer hundreds to a few thousand noisy physical qubits, with error rates far too high for sustained computation. Quantum error correction can synthesize reliable logical qubits from many physical qubits, but the overhead is large. Influential resource estimates illustrate the gap and how quickly it is narrowing: a widely cited 2019 analysis by Gidney and Ekera put the requirement at roughly 20 million noisy physical qubits running for about eight hours, while a 2025 update by Gidney lowered the estimate to fewer than one million physical qubits at the cost of a longer run of several days. Even the reduced figure remains orders of magnitude beyond present hardware.

Quantum computing progress follows neither Moore's law nor a simple exponential trajectory. Hardware advances must address qubit count, coherence time, gate fidelity, and connectivity, each presenting distinct challenges. Software advances in quantum algorithms, error correction, and circuit compilation can sharply change the resources required for cryptographic attacks, as the falling RSA-2048 estimates demonstrate. A breakthrough could accelerate timelines, while unexpected obstacles could delay them.

Expert estimates for cryptographically relevant quantum computers span from optimistic projections of roughly a decade to conservative estimates of twenty years or more. Recent expert surveys, such as the Global Risk Institute's annual Quantum Threat Timeline Report, place meaningful probability within ten years and concentrate the heaviest expectation in the early-to-mid 2030s. Prudent threat analysis should consider scenarios across this range rather than relying on a single point estimate. The consequences of underestimating are severe, because data encrypted with quantum-vulnerable algorithms today may already be compromised under the HNDL scenario.

Risk Assessment Framework

A structured risk assessment framework enables systematic evaluation of quantum threats to organizational systems and data. The framework weighs asset value, threat likelihood, vulnerability to quantum attack, and migration difficulty to prioritize the deployment of quantum-resistant cryptography across an organization's systems.

Asset classification identifies the data and systems that require protection and their confidentiality lifetimes. Long-lived secrets face the most urgent quantum risk because of the HNDL threat. Critical infrastructure may require integrity and availability protection against quantum-enabled attacks. The value of assets to adversaries influences both threat likelihood and the sophistication of the attacks they might employ.

A cryptographic inventory documents where quantum-vulnerable algorithms are deployed. This includes not only obvious uses such as TLS and VPN but also cryptography embedded in applications, databases, backup systems, firmware, and hardware devices. The inventory should record algorithm types, key sizes, certificate lifetimes, and implementation characteristics that affect migration complexity. Automated discovery tools and a cryptographic bill of materials help maintain this inventory as systems change.

Migration complexity assessment evaluates the difficulty of transitioning each system to quantum-resistant cryptography. Some systems need only a configuration change, while others require firmware updates, hardware replacement, or complete redesign. Dependencies between systems create sequencing requirements, and resource constraints limit how quickly migrations can be completed.

Risk scoring combines these factors to prioritize effort. High-value assets protected by quantum-vulnerable cryptography and carrying long confidentiality requirements should migrate first. Systems with complex migration needs may have to begin planning early even when immediate migration is unnecessary. Ongoing monitoring tracks both the organization's migration progress and the advancement of quantum computing.

Sector-Specific Threat Considerations

Different sectors face distinct quantum threat profiles shaped by their data characteristics, regulatory requirements, and adversary interests. Sector-specific analysis ensures that threat assessments reflect the actual risk environment rather than generic assumptions.

Government and defense sectors face nation-state adversaries with substantial resources for both quantum computing development and encrypted traffic collection. Classified information often requires protection for decades, making HNDL threats particularly acute. Government systems also face mandates that set timelines for quantum-resistant cryptography adoption; in the United States, for example, national security memoranda and Office of Management and Budget guidance direct federal agencies to inventory vulnerable cryptography and plan migration.

Financial services handle highly valuable data that attracts sophisticated attackers. While the confidentiality of an individual transaction may be short-lived, accumulated transaction data enables valuable analysis, and authentication forgery could undermine the integrity of payments. Financial regulators increasingly expect institutions to consider emerging technological threats, including quantum computing. Payment networks and interbank systems also present critical-infrastructure concerns.

Healthcare organizations protect patient information whose legal confidentiality may extend for a patient's lifetime and beyond. Medical research data can retain scientific value for decades. Healthcare environments often include legacy and embedded equipment with limited cryptographic upgrade capability. Regulatory frameworks such as HIPAA require protection appropriate to data sensitivity.

Critical infrastructure sectors, including energy, telecommunications, and transportation, face integrity and availability threats in addition to confidentiality concerns. Operational technology systems may have extremely long deployment cycles with limited upgrade capability. The potential for physical harm from a compromised control system elevates the severity of the risk.

Adversary Capability Assessment

Threat analysis must consider which adversaries might develop or access quantum computing capabilities and what they would target. Different adversary classes present different threat levels and call for different defensive measures.

Nation-state adversaries invest heavily in quantum computing research and development. Major national programs exist in the United States, China, the European Union, Japan, and elsewhere. These adversaries have the resources for large-scale encrypted-traffic collection and indefinite storage. The intelligence priorities of foreign governments should inform an assessment of which organizational data might be targeted.

Advanced persistent threats (APTs) associated with nation-states would likely gain access to quantum capabilities through their state sponsors. Their established presence in victim networks could enable targeted collection of encrypted traffic for later decryption. APTs have already demonstrated sophisticated cryptographic capabilities in their tooling and tradecraft.

Criminal organizations currently lack the resources to develop quantum computers but might eventually access such capabilities as the technology matures, perhaps through cloud services. Ransomware operators and financial criminals would find quantum decryption valuable for unlocking previously exfiltrated victim data. The timeline for criminal quantum capability is likely longer than for state actors.

Corporate espionage actors might reach quantum capability through state sponsors, commercial cloud services, or their own development. Competitors with nation-state backing are already suspected of economic espionage by cyber means. Trade secrets and competitive intelligence would be attractive targets for quantum-enabled decryption.

Supply Chain Considerations

Quantum threat analysis must extend beyond an organization's own systems to its supply chain dependencies. Cryptographic vulnerabilities in supplier systems can expose organizational data even when internal systems are quantum-resistant. Supply chain assessment identifies where third-party quantum vulnerability creates risk.

Cloud service providers handle substantial organizational data and must themselves implement quantum-resistant cryptography. Assessment should evaluate provider migration plans and timelines. Data stored or processed in provider systems may be captured by adversaries targeting the provider rather than the organization directly.

Software and hardware suppliers embed cryptography in their products. Organizational systems may depend on supplier implementations that the organization cannot directly upgrade. Assessment should identify such dependencies and evaluate supplier plans for quantum-resistant updates. Long-lived embedded systems may require replacement rather than upgrade.

Business partners with whom data is shared present similar concerns. Encrypted transmissions to partners may be captured for HNDL attacks, and partner systems that store organizational data must implement appropriate quantum protections. Contracts may need to specify partner obligations for quantum migration.

Certificate authorities and PKI infrastructure underpin trust relationships throughout the digital ecosystem. Compromise of certificate authority keys through a quantum attack could enable widespread man-in-the-middle attacks and certificate forgery. The quantum resistance of PKI therefore affects every dependent system.

Migration Strategy Development

Quantum threat analysis directly informs migration strategy by identifying priorities, constraints, and appropriate approaches for transitioning to quantum-resistant cryptography. The strategy must balance security urgency against the practical constraints of cost, compatibility, and implementation complexity.

Prioritization based on threat analysis ensures that the highest-risk systems receive attention first. Long-lived confidential data facing HNDL threats should migrate immediately where practical. Critical infrastructure and other high-value systems follow. Lower-risk systems can migrate on standard refresh cycles without acceleration.

Hybrid cryptographic approaches provide quantum resistance while preserving compatibility during the transition. Combining a classical algorithm with a post-quantum algorithm keeps a connection secure even if one family is later broken, which is valuable while the post-quantum schemes accumulate cryptanalytic scrutiny. Hybrid key exchange has accordingly become the default approach for early deployments and is already shipping in major web browsers and TLS libraries.

Cryptographic agility enables future algorithm updates without wholesale system replacement. Systems designed with abstracted cryptographic interfaces can adopt new algorithms as standards evolve and new threats emerge. This is especially important given the relative immaturity of post-quantum cryptography compared with classical algorithms that have decades of analysis behind them.

Testing and validation ensure that migration does not introduce new vulnerabilities or break functionality. Post-quantum algorithms have different performance characteristics; larger keys and signatures can stress bandwidth, memory, and protocol size limits. Interoperability testing confirms that migrated systems work correctly with their intended communication partners, and security testing verifies that implementations resist both quantum and classical attacks, including side channels.

Monitoring and Reassessment

Quantum threat analysis is not a one-time exercise; it requires ongoing monitoring and periodic reassessment as the threat landscape evolves. Both quantum computing capabilities and post-quantum cryptography continue to develop, prompting updates to threat assumptions and migration plans.

Quantum computing progress should be tracked through several indicators. Qubit counts and error rates provide technical metrics. Research publications reveal algorithmic advances that may reduce the resources needed for cryptographic attacks. Industry announcements and expert assessments offer additional perspective on development timelines.

Developments in post-quantum cryptography may reveal new vulnerabilities or provide new options. NIST continues to standardize additional algorithms beyond its first finalized set, broadening the toolkit and adding mathematical diversity. Cryptanalytic research may also expose weaknesses in deployed schemes, as it did for several candidates during standardization, while implementation advances can improve performance and widen the range of constrained applications in which post-quantum cryptography is feasible.

Organizational changes affect quantum threat exposure. New systems, data types, or business relationships may introduce quantum-vulnerable cryptography or raise the value of assets at risk. Changes in adversary activity or regulatory requirements may shift threat priorities. Migration progress should be tracked against planned timelines.

Periodic reassessment should update threat timelines, asset valuations, and migration priorities as information accumulates. Annual or more frequent reviews keep the quantum security strategy aligned with evolving threats and organizational circumstances. Triggers for an unscheduled reassessment include significant quantum computing announcements, cryptographic breakthroughs, and major organizational changes.

Summary

Quantum threat analysis provides the foundation for informed decision-making about cryptographic security in the face of advancing quantum computing. Understanding quantum algorithm capabilities, particularly the threat Shor's algorithm poses to public-key cryptography, identifies which systems require migration to quantum-resistant alternatives, while Grover's algorithm imposes only a manageable cost on symmetric cryptography. The harvest-now-decrypt-later threat means that long-lived secrets are already at risk, demanding immediate attention despite uncertain quantum computing timelines.

Systematic risk assessment evaluates organizational exposure by weighing asset value, cryptographic inventory, adversary capabilities, and migration complexity. Sector-specific considerations ensure that the analysis reflects actual risk environments, and supply chain dependencies extend its scope beyond organizational boundaries. The resulting assessment guides migration strategy, prioritizing effort where risk is greatest and enabling informed resource allocation. With NIST's first post-quantum standards now finalized, organizations can move from planning to deployment, while ongoing monitoring and reassessment keep their security strategy aligned with the evolving quantum threat landscape.

Related Topics

• Quantum Computing Threats - how quantum hardware and algorithms undermine classical cryptography
• Post-Quantum Algorithms - the lattice-, code-, and hash-based schemes that replace vulnerable cryptography
• Hybrid Cryptographic Systems - combining classical and post-quantum algorithms during the transition
• Cryptographic Agility - designing systems to swap algorithms as standards and threats evolve
• Quantum-Safe Protocols - migrating TLS, VPN, and other protocols to quantum resistance
• Standards and Certification for Quantum Resistance - NIST standards and conformance for post-quantum cryptography