"quantum computers will break all encryption"

cryptographysecurity

Shor's algorithm threatens today's public-key math (RSA, elliptic curves) on a large fault-tolerant quantum computer - which does not yet exist. Symmetric ciphers and hashes mostly just double their key sizes.

NIST published post-quantum standards in 2024 (FIPS 203, 204, 205) precisely so migration happens before such machines do; 'harvest now, decrypt later' is the real present-day risk.

A sufficiently large quantum computer would break the public key cryptography that secures key exchange and digital signatures today, because Shor's algorithm solves factoring and discrete logarithms efficiently. That is genuinely serious and it is not the same as breaking everything.

Symmetric cryptography and hash functions are affected far less. Grover's algorithm offers a square-root speedup against brute-force search, which halves effective key strength, so AES-256 behaves like AES-128 against a quantum adversary and remains entirely adequate. Doubling a symmetric key size restores the margin; there is no equivalent rescue for RSA or elliptic curves, which is the actual asymmetry.

The timeline is genuinely uncertain and the urgency does not depend on it. Harvest now, decrypt later means traffic recorded today can be read whenever a capable machine exists, so anything needing decades of confidentiality is already exposed. That is why NIST standardized post-quantum algorithms and why deployments pair them with classical ones in hybrid mode. The honest position is neither imminent catastrophe nor a distant problem: it is a migration with a long tail that should start with the data whose secrecy has to outlive the uncertainty.

Disputed / commonly mistold A popular version of this story is inaccurate - see the note above.

← All glossary entries