> The Clock Is Already Ticking

Every encrypted message you've ever sent — every WhatsApp chat, every Signal message, every TLS connection to your bank — is stored somewhere. Servers log it. Backups archive it. Five Eyes intelligence agencies collect it under programs like UPSTREAM and PRISM. They can't read it today. Your encryption holds.

But what if they could read it tomorrow?

This is the quantum threat: a sufficiently powerful quantum computer could break the cryptographic algorithms that protect virtually all digital communication. Not in theory — in mathematics. The attack isn't hypothetical. It's inevitable. The only question is when.

And the attackers don't need to wait. They just need to collect now, decrypt later.

⚛️> Classical vs Quantum Computing

A classical computer uses bits — 0 or 1. A quantum computer uses qubits, which can exist in a state of superposition: both 0 and 1 simultaneously. This isn't a metaphor. It's a physical property of quantum mechanics.

If that sounds weird, it's because it is. Quantum mechanics has been confusing physicists for over a century. But the practical implication is straightforward: certain mathematical problems that are astronomically hard for classical computers become tractable for quantum ones.

Quantum computers don't speed up every computation. They're not "faster computers" in the way a new CPU is faster. They operate on fundamentally different physics, and they excel at specific mathematical problems — two of which happen to be the foundation of modern cryptography.

💀> Shor's Algorithm — The Killer

In 1994, Peter Shor — a mathematician at Bell Labs — published an algorithm that could factor large integers efficiently on a quantum computer. This sounds innocuous. It isn't. Factoring large integers is exactly the mathematical problem that RSA encryption relies on being impossibly hard.

RSA works because multiplying two large prime numbers is easy, but factoring the product back into those primes is computationally infeasible for classical computers. Shor's algorithm turns "infeasible" into "trivial" — given a large enough quantum computer.

Shor's algorithm also breaks elliptic curve cryptography (ECC) — the system used by Signal, Bitcoin, SSH, and most modern applications. ECC keys are shorter than RSA for equivalent security, but Shor's algorithm handles both. Different math, same fate.

📊> Grover's Algorithm — The Weakening

While Shor's algorithm outright breaks asymmetric cryptography, Grover's algorithm weakens symmetric cryptography. It doesn't break it entirely — but it effectively halves the key length.

📥> Harvest Now, Decrypt Later

Here's the part that should keep you up at night:

Adversaries don't need a quantum computer today to exploit your data today. They just need to store it. Every encrypted TLS session that transits an internet exchange they monitor. Every diplomatic cable. Every encrypted email stored on a server they've compromised. All of it — collected, archived, and waiting.

When the quantum computer arrives — 5 years, 10 years, 20 years — they go back to the archive and decrypt it all. Retroactively. Your secrets from 2024 become transparent in 2034.

This isn't paranoia. NIST, the NSA, and the British GCHQ have all issued formal advisories about "harvest now, decrypt later" attacks. The NSA published a memorandum in 2022 urging national security systems to transition to post-quantum algorithms by 2035. When intelligence agencies publicly announce timelines for replacing their own crypto, you should listen.

🛡️> Post-Quantum Cryptography (PQC)

The good news: cryptographers have been preparing. In 2016, NIST launched a public competition to select post-quantum cryptographic algorithms — mathematical problems that are believed to be hard even for quantum computers.

In August 2024, NIST published the first finalized PQC standards:

A fourth algorithm, FN-DSA (Falcon), was still undergoing standardization as of late 2024. Additional algorithms are being evaluated as backup candidates — because in cryptography, trusting a single approach is dangerous.

> Where Are We Now?

Quantum computers exist today. IBM, Google, IonQ, Quantinuum, and others have built functional machines with hundreds of physical qubits. But these are noisy qubits — prone to errors that require extensive error correction. A single stable "logical" qubit might require 1,000+ physical qubits to maintain.

To break RSA-2048, you need roughly 4,000 logical qubits — which translates to perhaps 4-20 million physical qubits depending on the error correction scheme. Today's machines have hundreds. The gap is enormous.

Estimates for when a cryptographically relevant quantum computer might appear range from 10 to 30 years. Some researchers think it could come sooner due to unexpected breakthroughs in error correction. Others think it may take much longer. The honest answer: nobody knows.

But here's the thing about worst-case planning in security: you prepare for the earliest plausible timeline, not the average one. Because the cost of being wrong — retroactive decryption of everything — is catastrophic and irreversible.

> What You Can Do

• Use AES-256 — already quantum-resistant. If you're using AES-128, upgrade.
• Support PQC deployment — Signal has already rolled out ML-KEM in its PQXDH protocol. Cloudflare supports post-quantum TLS. Use services that prioritize the migration.
• Hybrid key exchange — the transitional approach. Combine classical (X25519) with post-quantum (ML-KEM). If either remains secure, the connection is secure. This is what Signal and Chrome do today.
• Audit long-term secrets — identify what data needs protection for 10+ years. That data is already at risk via harvest-now-decrypt-later.
• Don't panic, but move — the sky isn't falling today. But the migration timeline is measured in years, and starting late means some of your data will be in the harvest cache when the quantum hammer falls.

// the future is already here // it's just not evenly distributed // - william gibson