The state of the field and post-quantum crypto

Strip away the press releases and one consequence of this whole subject lands squarely in ordinary software engineering: the public-key cryptography protecting today's internet has an expiry date, and the clock is already running even though no code-breaking quantum computer exists yet. This lesson is where the theory becomes a migration ticket.

Play with the deadline

The timeline below has two knobs: the year a code-breaking quantum computer arrives, and how long the data you encrypt today must stay secret. Slide them and watch the red band. That band is your exposure - the years during which recorded traffic can be decrypted before your secrets have gone stale.

Which algorithms fall, and which stand

The damage is not uniform, and the split follows exactly the two algorithms you have already met. Shor's algorithm attacks the hidden structure that public-key cryptography is built on. RSA rests on the hardness of factoring; elliptic-curve cryptography rests on a discrete-logarithm problem with the same kind of periodic structure. Shor demolishes both.^[1] See the mechanism in Shor's algorithm and the death of RSA.

Symmetric cryptography survives, because it has no such structure to exploit - only Grover's unstructured search applies. Grover turns a brute-force key hunt over $2^{256}$ keys into about $2^{128}$ steps, which halves the effective key strength. A 128-bit effective attack on AES-256 is still hopeless in practice, so AES-256 is fine; you just would not rely on a 128-bit key anymore. The remedy for symmetric crypto is embarrassingly simple: use longer keys.

The replacement for the broken public-key schemes is post-quantum cryptography, or PQC: new public-key algorithms whose hardness rests on problems with no known efficient quantum attack, chiefly structured lattices. In 2024 NIST standardized the first of them - ML-KEM (Kyber) for key exchange and ML-DSA (Dilithium) for signatures.^[2] They run on the classical computers you already own; migration is a software project, not a hardware wait.

Where the field actually is

The largest processors today hold on the order of a thousand noisy physical qubits, and error rates are only just crossing the threshold where error correction starts to help. Breaking RSA-2048 with Shor is estimated to need millions of high-quality physical qubits sustained for hours - a gap of several orders of magnitude that nobody knows how to close on a firm timeline.^[3] The honest summary: a code-breaking quantum computer is not here, is not obviously near, and yet the harvest-now risk makes migration a present-tense decision for anything that must stay secret into the 2030s and beyond.

def effective_bits(key_bits):
    # Grover searches 2^k keys in about 2^(k/2) steps, so the effective
    # security is halved. Shor does NOT apply to symmetric ciphers.
    return key_bits // 2

for k in (128, 256):
    print(f"AES-{k}: {effective_bits(k)}-bit effective security under Grover")

# AES-128 -> 64-bit effective (too weak), AES-256 -> 128-bit (still safe).
# Public-key (RSA, ECC) is a different story: Shor breaks it outright,
# so those get REPLACED by lattice PQC (ML-KEM, ML-DSA), not lengthened.

Check yourself