When will a quantum computer break encryption? It’s the question most people ask when quantum comes up. RSA, ECC and Diffie-Hellman are the plumbing under payments, health records, government data and supply chains, and some of it has to stay confidential for years. By the end you’ll be able to tell a cryptographically relevant quantum computer from today’s noisy machines, know which encryption is at risk, and see post-quantum migration as a sequenced, inventory-first programme. For the wider strategic context, see the commercial reality check.
What is a cryptographically relevant quantum computer (CRQC) and when will it arrive?
A cryptographically relevant quantum computer (CRQC) is a quantum machine reliable enough to run Shor’s algorithm against real RSA-2048, ECC-256 and Diffie-Hellman. That is not what today’s NISQ devices are. They run a few hundred to a few thousand noisy physical qubits and still factor tiny numbers like 15 and 21, the same figures demonstrated decades ago. The gap is fault tolerance. Breaking RSA-2048 means holding roughly 1,400 error-corrected logical qubits through millions of operations. Each logical qubit is built from hundreds or thousands of physical qubits, pushing the total toward a million. More on fault tolerance.
So when? The honest answer is a range. A 2023 Global Risk Institute survey found most experts estimated a better-than-50% chance of a CRQC by 2035, and Citi’s 2026 report puts the odds of widespread public-key breaking at 19-34% by 2034, rising to 60-82% by 2044. AI-assisted cryptanalysis could compress that timeline. For planning, fixed deadlines around 2029 and 2030 matter more than any predicted Q-Day. The arrival date matters because of what happens before it.
What is “harvest now, decrypt later” and why does it make quantum risk urgent today?
Harvest now, decrypt later (HNDL, or store now, decrypt later) is a two-phase attack: adversaries collect and store encrypted traffic today, then decrypt it once a CRQC exists. It is a present-day risk. Passive interception leaves no trace in your organisation’s logs. The urgency comes from data lifetime. A health record or financial history that must stay confidential for a decade can be harvested today and broken later, so its deadline is now.
BGP hijacking is a documented example: researchers found China Telecom redirecting US, Canadian and Scandinavian traffic through Chinese infrastructure between 2016 and 2019, consistent with a long-term collection strategy. Bitcoin public keys, SWIFT and card payments all face the same exposure. The 2026 commercial reality shows this becoming a budget-line problem, already visible in one market.
Why are BlackRock, Fidelity and Coinbase funding the Bitcoin Security Consortium?
BlackRock, Fidelity and Coinbase are founders of the Bitcoin Security Consortium, which pledged $15 million over three years for Bitcoin security research, including post-quantum cryptography. The money isn’t pooled; each member directs its own contribution. The motivation is plain. Roughly a quarter of bitcoins sit in addresses whose public keys are already exposed, worth roughly $470 billion. Bitcoin is the most visible case of quantum downside, and institutions are paying to contain it. The cluster overview covers the wider picture.
Quantum attacks come in two types.
How does Grover’s algorithm affect the security of existing encryption?
Grover’s algorithm gives a quadratic speedup on brute-force search, halving symmetric key strength. AES-256 drops to about 128 bits of security, still fine; AES-128 drops to about 64 bits, which is not. The practical fix is to double key sizes or default to AES-256. The break risk is elsewhere: Shor’s algorithm breaks RSA, ECC and Diffie-Hellman. So migration targets public-key cryptography. Audit for weak keys and legacy cipher suites, and leave AES alone.
Post-quantum cryptography migration vs cryptographic agility: how do the approaches differ?
Post-quantum cryptography (PQC) migration means replacing RSA and ECC with quantum-resistant algorithms NIST has standardised: ML-KEM (FIPS 203) for key establishment, ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for signatures. You’ll find them on NIST’s PQC pages, with CNSA 2.0 as the companion guidance. Cryptographic agility is the standing ability to swap algorithms without redesigning systems, with configurable settings and standardised key rotation. Migration is the destination; agility is what makes it repeatable. The practical sequence is to build agility first, then migrate high-priority systems, using hybrid key exchange like X25519MLKEM768 as a bridge while standards mature, as the adoption roadmap lays out.
How do you scope a cryptographic inventory to prepare for post-quantum migration?
The hard part is knowing where cryptography already lives. A cryptographic bill of materials (CBOM) records every algorithm, protocol, key size, library and certificate in use, plus what each protects. ASD’s LATICE framework calls this the Locate phase, with milestones to a 2026 plan, 2028 start and 2030 completion. A CBOM combines automated discovery with developer reporting, then ranks systems by data value and lifetime. Offline-attackable key exchange and long-lived data go first, signatures next, symmetric encryption last. The sequence is inventory, prioritise, migrate, validate, and it sits within the wider cluster.
How do you evaluate whether critical suppliers have credible post-quantum transition plans?
Your migration inherits your suppliers’ timelines; SaaS, payments and cloud providers often run the cryptography you depend on. Ask for their roadmap: which NIST algorithms they support, when support ships, and how they manage long-lived keys. ASD has a list of questions to put to your vendors. Require evidence: a current CBOM, hybrid TLS support, and conformance to FIPS 203/204/205 and CNSA 2.0. Raise it at procurement and renewal, and prioritise suppliers who hold long-lived, high-value data. Red flags: opaque crypto, deferred timelines, PQC as a premium add-on. The adoption roadmap links supplier readiness to the wider sequence.
The arrival-date question mostly dissolves once you look at data lifetime. A CRQC will land somewhere in the 2030s to 2040s, but long-lived data can be harvested today and broken later. The response is making cryptography changeable: inventory, prioritise, migrate, validate, enabled by agility and extended to suppliers. Shor’s breaks public-key cryptography; Grover’s only halves symmetric strength, so AES-256 covers that side. Start the inventory now, because the clock on your data started when it was stored. For the broader context, return to the cluster overview.
Frequently Asked Questions
What actually happens on Q-Day?
Q-Day is the moment a cryptographically relevant quantum computer becomes able to break RSA, ECC and Diffie-Hellman as they are actually deployed. It is not a single global outage but the point at which any un-migrated system becomes decryptable. The first failures will hit key agreement and signatures that still rely on those algorithms, especially where long-lived data has already been harvested.
How would I know if my data has already been harvested?
You generally cannot know. Harvest-now-decrypt-later interception is passive, so it leaves no trace in your own logs or on your own systems. That invisibility is exactly what makes the attack hard to detect. The practical response is to assume any long-lived, high-value data is already exposed and to migrate the cryptography that protects it early, rather than waiting for evidence of interception.
Why can’t researchers give a precise arrival date for a CRQC?
Because a cryptographically relevant quantum computer depends on engineering milestones that have not yet been proven, chiefly fault-tolerant hardware, qubit quality and quantum error correction. Estimates therefore sit in a range, commonly the 2030s to 2040s, rather than on a single date. For planning purposes, regulatory deadlines around 2029 and 2030 are more useful than any predicted Q-Day, because they give organisations a fixed target.
What are ML-KEM, ML-DSA and SLH-DSA, and how do I choose between them?
They are the three quantum-resistant algorithms NIST has standardised as FIPS 203, FIPS 204 and FIPS 205. ML-KEM is for key establishment, while ML-DSA and SLH-DSA are for digital signatures. You do not usually pick one in isolation. Most systems will pair ML-KEM with a signature scheme, and some organisations choose SLH-DSA where they want the more conservative option despite larger signatures.
Does quantum risk affect my personal banking and health records, or only governments?
It affects them directly. The public-key cryptography that protects payments, banking and health records is the same RSA, ECC and Diffie-Hellman that Shor’s algorithm breaks. Long-lived records are the core exposure. A health record or financial history that must stay confidential for decades can be harvested now and decrypted later, so migration matters well beyond government and defence.
Should small and mid-sized organisations start now, or can they wait?
They should start now on the foundational and inexpensive step: a cryptographic inventory. The urgency comes from data lifetime, not from organisation size. Even a small organisation holds long-lived customer, financial or health data that suppliers encrypt on its behalf, and that data can be harvested today. Starting the inventory now costs little, reveals where the exposure sits and lets migration be sequenced before the 2030 deadlines.
How long does a realistic post-quantum migration actually take?
For most organisations it is a multi-year program, measured in years rather than months. The bulk of the effort is discovery and testing, not the algorithm swap itself. ASD’s milestones reflect that reality: refine a plan by 2026, commence migration by 2028 and complete it by 2030. Large estates and supplier dependencies can stretch the timeline further, which is why the inventory starts now rather than later.
What is a CBOM and how is it different from an SBOM?
A CBOM is a cryptographic bill of materials, the cryptography-focused equivalent of a software bill of materials (SBOM). It records every algorithm, protocol, key size, library and certificate in use, plus what each protects. Where an SBOM lists software components, a CBOM lists the cryptographic choices those components make. That discovery layer is what a post-quantum migration is built on.
Is hybrid key exchange safe to use now?
Yes, and it is the pragmatic bridging approach. Hybrid key exchange combines a classical scheme such as X25519 with a post-quantum scheme such as ML-KEM, so the connection remains secure if either one is later broken. An example is X25519MLKEM768. Hybrid designs let organisations introduce quantum-resistant key agreement now without waiting for every dependency to complete a full replacement.
Will these new post-quantum algorithms stay secure, or will they need replacing again?
There is no permanent guarantee, which is precisely why cryptographic agility matters. FIPS 203, FIPS 204 and FIPS 205 are the first standardised post-quantum algorithms, and they may evolve as cryptanalysis and standards mature. Treating them as a final answer repeats the current mistake. Building systems that can swap algorithms makes any future change routine rather than another forced migration.
