News from Quantum Realm

If you've been reading about quantum computers and what their advent means for your crypto, a quantum-safe wallet sounds like a good fix. You merely move your coins into the right app and the quantum threat goes away. If only it were that easy. A wallet by itself can't change the signature rules on which a blockchain runs. It signs with whatever the chain's native accounts require, so on a chain that uses ECDSA today, the wallet signs with ECDSA, quantum weakness and all.

No blockchain is guaranteed to be immune to every future attack, so the phrase ‘quantum-proof crypto' promises more than any system can deliver today. Most major chains still run the quantum-vulnerable signatures they always ran, though a few newer ones have already started to use post-quantum signatures. If you’re a crypto holder, you should cut specific exposure now and move toward quantum-safe options as they mature.

SPHINCS+ is the hash-based backup in NIST's post-quantum signature toolkit. NIST's primary post-quantum signature standard, ML-DSA, rests on structured lattice problems, and so does the still unfinalized FN-DSA. Meanwhile, SPHINCS+ takes a different route and bases its security on the well-studied properties of hash functions. This gives NIST a fallback that a lattice breakthrough wouldn’t drag down, though its signatures are much bigger.

ML-KEM is the post-quantum algorithm you may already be using. It protects the key exchange behind encrypted connections, and it's rolling out as we speak, from web browsers to messaging apps. NIST standardized it in 2024 as FIPS 203, based on the scheme once called Kyber.

Dilithium is the digital signature scheme that the U.S. National Institute of Standards and Technology (NIST) chose as its main defense mechanism for the post-quantum era. In 2024, it became an official standard, ML-DSA in FIPS 204, and NIST recommends it as the general-purpose signature for most systems. Its security rests on hard problems in module lattices, which no efficient classical or quantum attack is known to solve, including Shor's algorithm.

Grover's algorithm is the quantum attack type that people usually refer to when they ask whether quantum computers can break the Advanced Encryption Standard (AES), a widespread method for encrypting electronic data. The short answer isn’t cut and dried. You could say that it weakens AES, but doesn’t put AES-256 within practical reach of hackers. Specifically, Grover’s algorithm speeds up the brute-force search for a secret key, but only by a square-root factor, so a 256-bit key remains far out of range of any known attack.

Lattice-based cryptography is set to carry much of the post-quantum transition. Its security rests on hard problems in high-dimensional mathematical lattices, and no known classical or quantum algorithm solves them efficiently at cryptographic sizes. This property makes lattice-based cryptography the leading answer to Shor's algorithm, which tears through the factoring and discrete-log problems behind today's public-key systems.

Shor's algorithm is the quantum method that threatens most of the public-key cryptography protecting internet communications and crypto accounts today. Once a capable enough quantum computer appears on the scene, this algorithm will be able to factor large numbers and solve certain discrete logarithm problems in polynomial time, and those two problems are the foundation of most of the public-key systems in use today.

Y2Q, short for "years to quantum," is a commonly used term in cybersecurity to describe the approaching day when a quantum computer will be able to break public-key systems like RSA and elliptic-curve cryptography. It’s not by accident that it sounds a lot like Y2K, as both refer to large-scale migration deadlines that reward slow, undramatic preparation. That said, similarities end when we reach the reasons why Y2Q is more serious.

No one can pin a year. In this article, Q-Day refers to the day a quantum computer will be able to recover a private key from a common elliptic-curve public key fast enough to threaten crypto funds. It’s a forecast about a machine no one has built yet, so the answer is a probability, not a date. Expert estimates are spread across the 2030s and 2040s, with a smaller near-term chance and some reaching past 2045.