Quantum and Crypto Security: 20 Questions Answered

Shor's algorithm lets a quantum computer find the hidden structure behind RSA and elliptic curve keys, turning problems that are infeasible for classical machines into feasible ones. It needs a large, error-corrected machine.

No. No quantum computer today can break RSA or elliptic curve cryptography at real key sizes. Public demonstrations have factored only tiny numbers. The concern is about future machines, which is why preparation starts early.

Q-Day is the informal name for the day a quantum computer can break widely used public-key cryptography. Nobody knows when or whether it will arrive, and expert opinions vary. See Q-Day explained.

A 2025 paper by Craig Gidney of Google estimated that RSA-2048 could be factored with fewer than a million noisy qubits in under a week, a big drop from earlier estimates. Today's machines are far smaller. See the estimate history.

It is the idea that someone could record encrypted data today and decrypt it years later when quantum computers exist. It matters most for secrets that must stay private for decades, which is why key exchange is being upgraded first. See the explainer.

Not in the same way. Grover's algorithm gives only a square-root speedup, so doubling key length restores the margin. AES-256 is widely regarded as comfortable against quantum attacks. See Grover's algorithm.

Hash functions are affected only modestly. Grover-style attacks reduce their effective security level by about half in bits, which is manageable with standard output sizes. See hash functions and quantum.

In August 2024, NIST finalised FIPS 203 (ML-KEM for key exchange), FIPS 204 (ML-DSA for signatures) and FIPS 205 (SLH-DSA, a hash-based signature). Further standards, such as FN-DSA (based on Falcon) and HQC, were still being drafted or finalised when we last checked, so check NIST for current status. See standards status.

ML-KEM, formerly called Kyber, is a lattice-based method for two parties to agree on a shared secret key safely, even against quantum computers. It is already used in some browser and server connections. See ML-KEM explained.

A hybrid combines a classical method and a post-quantum one, so a connection stays safe unless both are broken. It is a cautious way to roll out new cryptography. See hybrid key exchange.

No. Post-quantum cryptography is ordinary software built on maths believed to resist quantum attacks. Quantum key distribution uses quantum physics and special hardware. Most agencies favour the software route for general use. See QKD vs PQC.

In theory, a large quantum computer could forge the elliptic curve signatures Bitcoin uses, mainly for coins whose public keys are exposed. No such computer exists, and developers are discussing upgrades. See BIP-360 and BIP-361.

Generally those where the public key is already visible on the chain, for example from reused addresses or certain old output types. Addresses that have never revealed their key are better protected for now. See exposed public keys.

Both use signature schemes that a large quantum computer could attack in theory, and both communities have published research and roadmaps for quantum-resistant upgrades. See Ethereum and Solana plans.

They are many times larger than today's signatures, so blocks fit fewer transactions unless designs compress or aggregate them. It is a cost problem that engineers are actively working on. See signature sizes and block space.

A seed phrase is a secret number, and quantum computers do not make it guessable. The risk is to the signatures made with the keys derived from it. Keep your phrase private and offline as usual. See seed phrases.

There is no need to panic. Follow your wallet and chain upgrade guidance, avoid address reuse, and keep software current. This is not financial advice, and we do not predict what any asset will do. See what individuals can do.

Make a list of where public-key cryptography is used, prioritise long-lived secrets, and build the ability to swap algorithms, called crypto agility. Then test and roll out standardised post-quantum options. See the migration checklist.

Yes. The United States, the United Kingdom, the European Union and others have published migration timelines that run through the 2030s. See government deadlines.

Be skeptical. The label is easy to use and hard to verify, and many such pitches are marketing or outright scams. Look for audited code and clear technical documentation. See quantum-proof coin scams. This is not financial advice.