News from Quantum Realm

Grover's algorithm is the quantum attack type that people usually refer to when they ask whether quantum computers can break the Advanced Encryption Standard (AES), a widespread method for encrypting electronic data. The short answer isn’t cut and dried. You could say that it weakens AES, but doesn’t put AES-256 within practical reach of hackers. Specifically, Grover’s algorithm speeds up the brute-force search for a secret key, but only by a square-root factor, so a 256-bit key remains far out of range of any known attack.

Lattice-based cryptography is set to carry much of the post-quantum transition. Its security rests on hard problems in high-dimensional mathematical lattices, and no known classical or quantum algorithm solves them efficiently at cryptographic sizes. This property makes lattice-based cryptography the leading answer to Shor's algorithm, which tears through the factoring and discrete-log problems behind today's public-key systems.

Shor's algorithm is the quantum method that threatens most of the public-key cryptography protecting internet communications and crypto accounts today. Once a capable enough quantum computer appears on the scene, this algorithm will be able to factor large numbers and solve certain discrete logarithm problems in polynomial time, and those two problems are the foundation of most of the public-key systems in use today.

Y2Q, short for "years to quantum," is a commonly used term in cybersecurity to describe the approaching day when a quantum computer will be able to break public-key systems like RSA and elliptic-curve cryptography. It’s not by accident that it sounds a lot like Y2K, as both refer to large-scale migration deadlines that reward slow, undramatic preparation. That said, similarities end when we reach the reasons why Y2Q is more serious.

No one can pin a year. In this article, Q-Day refers to the day a quantum computer will be able to recover a private key from a common elliptic-curve public key fast enough to threaten crypto funds. It’s a forecast about a machine no one has built yet, so the answer is a probability, not a date. Expert estimates are spread across the 2030s and 2040s, with a smaller near-term chance and some reaching past 2045.

Post-quantum cryptography is the set of public-key algorithms designed to stay secure against a future quantum computer strong enough to break existing encryption. This collection of algorithms runs on ordinary hardware today, but the point is the underlying math, chosen so that the shortcuts a quantum computer offers won't apply.

‘Harvest now, decrypt later’ is a strategy to gain access to sensitive information with a long delay built in. An adversary records and stores encrypted data today, and waits for a quantum computer that can break the encryption (the so-called ‘Q-Day'). The data might not look worth stealing this year, but it could be valuable the moment Q-Day arrives and makes it readable.

There's no single answer to this question. Every number you'll see belongs to one architecture, and moves when the architecture does.

Bitcoin has carried quantum risk from the time of its first blocks because the earliest coins published their public keys straight on-chain. Ever since, the number of disclosed keys has continued to grow. But the risk isn't a simple running total. How much BTC sits behind an exposed key rises and falls as coins are created, reused, moved, and spent, and it won't wait for a quantum computer to arrive before it becomes a problem.

Q-Day is the day a quantum computer becomes strong enough to break the public-key cryptography that secures almost everything online, from bank logins and encrypted messaging to the signatures on your crypto wallet. It hasn't happened yet, and no publicly known machine still comes close.