In 1994, American mathematician Peter Shor developed a quantum algorithm with the potential to dismantle major cryptography schemes. If realized in quantum hardware, Shor’s algorithm would factor large integers at incomprehensible speeds. Some cryptography circles refer to this milestone as “Q-day,” that is, the quantum encryption apocalypse.
For context, cryptographic algorithms, like RSA encryption, essentially “scramble” our data to protect sensitive information. Not even the world’s best supercomputers are capable of cracking these encryptions. But quantum computers are poised to outperform their classical counterparts—incidentally, with regard to the exact mathematical problems that secure encryption algorithms, such as the integer factorization problem, the discrete logarithm problem, and the elliptic-curve discrete logarithm problem.
The very prospect of the quantum apocalypse has driven various stakeholders to consider what that could be like and how to prepare for Q-day. For instance, in 2015, the U.S. National Institute of Standards and Technology (NIST) initiated programs to develop post-quantum cryptography (PQC) standards.
To be clear, no existing quantum computer has definitively proven it runs Shor’s algorithm. But last week saw two “bombshell” independent announcements about quantum encryption from Google and a Caltech spinoff startup. The results, both preprints, have yet to weather independent verification and empirical testing. Still, they present a clear message: the quantum encryption apocalypse might come sooner than we think.
But it’s difficult to immediately grasp what all of this means. So we asked the experts. In this Giz Asks, physicists, engineers, and mathematicians in quantum computing discuss the looming quantum encryption apocalypse. Will such a thing even happen? If so, when and how? Most importantly, how should we prepare for Q-day?
The following responses may have been lightly edited and condensed for clarity.
Henry Yuen
Theoretical computer scientist, Columbia University.
It is difficult to make high-confidence predictions about when quantum computers capable of running Shor’s algorithm will come online. For industry, governments, financial institutions, and society, the pertinent question should be, “Can one be highly confident that Shor’s algorithm won’t come online in the next five years?” If not, then we need to move with great urgency to secure our digital infrastructure to be secure against quantum attack. This will require enormous coordinated effort between industry, academia, and government.
Although NIST has recommended replacement cryptosystems that are conjectured to be secure against quantum attack, we should not view the matter of having quantum-safe cryptography as being a solved problem. All it takes is one brilliant quantum algorithm—a Shor 2.0, if you will—that might put us back at square one. We will need to spend more time stress-testing the recommended post-quantum encryption schemes, as well as coming up with alternative cryptosystems, in order to maximize the chances that we can defend ourselves against quantum attacks.
Paul Davies
Theoretical physicist, Arizona State University; author of Quantum 2.0, a book that describes “the copious good news concerning quantum information technology.”
Quantum mechanics undermines many popular cryptographic methods. But it also contains the solution. Exploiting entanglement, information can be teleported from A to B with complete security because any attempt to eavesdrop irreversibly and detectably corrupts the transmitted data and thus gives the game away. Importantly, the inescapable data mutilation isn’t merely a technical disruption but a law of nature, so there is no evading it.
However, it is not necessary to use fancy quantum cryptography technology such as entanglement to avoid the looming quantum apocalypse. There are many quantum-proof encryption protocols, an obvious example being the one-time pad. They may not be as convenient as current methods but they can be secure for all practical purposes.
What none of these considerations address is the vulnerability of existing and past data that, if vacuumed up by a bad actor, sits like a time bomb awaiting the advent of a quantum computer to break into that vast database and uncover many secrets. The scope for intimidation, blackmail, and cyberwarfare is obvious. For the individual, my advice is to permanently erase as much past data as you can, e.g., that’s stored in the cloud, and copy all essential data onto storage devices that never again connect to the internet.
Tim Palmer
Theoretical physicist at Oxford University who devised the alternative model Rational Quantum Mechanics (RaQM).
The ability to break RSA encryption assumes that the quantum advantage of Shor’s algorithm will continue on computers with thousands of (error-corrected) qubits. This in turn assumes quantum mechanics itself holds at these scales. I believe it doesn’t.
Although the public thinks of quantum mechanics as a wildly discontinuous theory (think “quantum jump” and “quantum leap”), it turns out that quantum mechanics depends on the continuum of numbers more vitally than does classical physics. RaQM is a much simpler theory than quantum mechanics, without the deep mysteries of superposition and nonlocality. It achieves this by banishing the continuum from quantum physics. As a result, RaQM reveals the information content of the wavefunction explicitly: in particular, when more than a few hundred qubits are entangled, there is not enough information in the quantum wavefunction to allocate even one bit of information to each Hilbert Space dimension. When this happens, the quantum advantage of Shor’s algorithm will saturate and cannot be improved by entangling more qubits.
So the reason I am excited by the Google announcement is because it will hasten the day that quantum mechanics may be shown, experimentally, to fail. If this happens, I will have a much simpler theory to take its place—one where the mysteries of quantum mechanics are explained by simple number theory.
Sophie Schmieg
Senior staff cryptography engineer at Google.
The encryption currently used to keep information confidential and secure could be broken by a large-scale quantum computer in coming years. We can mitigate this quantum threat to encryption by taking the necessary migration steps now. With NIST and IETF having published their PQC standards, we have a way to protect our computing infrastructure before a quantum computer is ready. Many widely used cryptographic libraries have implemented these algorithms in the last few years, even if some gaps that need to be addressed by cryptography engineers remain.
We now need to empower general software engineers to undertake the transition. Hardcoded TLS ciphers need to be swapped to their PQC counterpart (X25519MLKEM768), SSH versions need to be updated, configurations for access token signatures need to be changed from ECDSA to MLDSA, and more. Policymakers and regulators can support this transition by clearly communicating the urgency of the PQC migration for their systems, for critical infrastructure, and for the private sector. They can also play a key role by providing resources and guidance to ease the PQC migration. And, of course, researchers need to continue to study these schemes to ensure that they are secure and to find more efficient replacement algorithms where possible.
Dustin Moody
Mathematician at NIST who manages NIST efforts for PQC development.
See More
