Quantum Computing Explained | How It Could Change

Quantum computing is creating a long-term cybersecurity problem that organizations cannot safely treat as a distant science-fiction scenario. A sufficiently capable quantum computer could undermine widely used public-key cryptography, including systems based on integer factoring and discrete logarithms.At the same time, the current threat should not be exaggerated. The technology needed to break today’s strongest public-key systems does not yet exist, and there is no reliable date for when a cryptographically relevant quantum computer (CRQC) will arrive.What has changed is the resource estimate and the preparation timeline. In 2025, Google researcher Craig Gidney estimated that a 2048-bit RSA integer could be factored in less than a week using fewer than one million noisy qubits under a specific set of hardware and error-correction assumptions. That was a major reduction from Google’s earlier 2019 estimate of 20 million noisy qubits for an eight-hour attack, but it was a theoretical resource estimate, not a demonstration that a million-qubit attack machine is imminent.

What Makes Quantum Computing a Cryptographic Threat?

Classical computers process information using bits. Quantum computers use qubits and exploit quantum-mechanical effects such as superposition, entanglement, and interference.It is tempting to say that a quantum computer simply “tries every answer at once.” That is not an accurate technical explanation. Quantum speedups come from algorithms that use superposition, interference, and entanglement to solve specific mathematical problems more efficiently than known classical algorithms.For cybersecurity, the most important example is Shor’s algorithm. It provides a polynomial-time quantum algorithm for integer factoring and discrete logarithms, creating a major asymptotic advantage over the best known classical algorithms for those problems.That is why public-key systems based on these mathematical assumptions are a long-term quantum-security concern.

Which Cryptographic Systems Are Most at Risk?

RSA, finite-field Diffie-Hellman, and elliptic-curve cryptography are among the major public-key mechanisms used for authentication, key establishment, and digital signatures. A sufficiently capable quantum computer running Shor’s algorithm could undermine those mechanisms.They are not, however, “the encryption layer for the entire internet.” Modern secure communications also depend heavily on symmetric cryptography, authenticated encryption, hash functions, certificate infrastructure, and hybrid protocol designs.In a typical secure connection, public-key cryptography helps authenticate parties or establish keys, while symmetric cryptography is then used for the bulk encryption of application data.

Why RSA-2048 Matters

RSA-2048 is important because RSA remains embedded in parts of the internet’s trust and authentication infrastructure, including some certificate and signature systems. A quantum attack against RSA-2048 would therefore have consequences far beyond one application.It would not mean that every encrypted internet session would suddenly become readable. The practical impact would depend on which cryptographic mechanisms a system uses and whether vulnerable public-key components remain in its authentication, key-establishment, or signing pathways.

The Google Million-Qubit Estimate: What It Actually Says

In 2025, Google Quantum AI researcher Craig Gidney published a resource estimate showing that a 2048-bit RSA integer could be factored in less than a week using fewer than one million noisy physical qubits.The estimate assumes:

A square grid of qubits with nearest-neighbor connectivity
A uniform gate-error rate of 0.1%
A surface-code cycle time of 1 microsecond
A control-system reaction time of 10 microseconds

The result reduced the estimated qubit requirement from Google’s 2019 estimate of 20 million noisy qubits. The newer paper also reduced the Toffoli count substantially.The key point is that the new result changes the theoretical resource estimate. It does not mean that a million-noisy-qubit machine capable of executing the attack currently exists.NIST likewise says that current quantum computers are far too small and unstable to threaten existing cryptography, while emphasizing that organizations should prepare now because cryptographic migration takes years.

The Quantum Threat Has Multiple Clocks

One reason quantum-security discussions become confusing is that several different timelines are often mixed together.

Clock	What It Means
CRQC / Q-Day probability	An estimate of when a quantum computer capable of breaking relevant cryptography might exist.
PQC migration timeline	The time an organization needs to inventory, redesign, test, deploy, and replace vulnerable cryptographic systems.
Government deadlines	Dates by which specific agencies or regulated systems must meet policy requirements.
Vendor roadmaps	Company-specific targets for making products or infrastructure quantum-resistant.

These clocks do not have to match. A company can set a migration deadline years before it believes a cryptographically relevant quantum computer is likely to exist.

When Could a Cryptographically Relevant Quantum Computer Arrive?

No one knows.NIST says expert estimates range from a few years to a few decades. The Global Risk Institute’s 2025 survey provides a more structured view: its 26 experts estimated a 28% to 49% probability within 10 years and a 51% to 70% probability within 15 years for a cryptographically relevant quantum computer.Those percentages are expert-elicitation estimates, not engineering forecasts with a guaranteed arrival date. They also should not be simplified into a single “2030–2040 consensus window.”The uncertainty is exactly why migration planning matters. Organizations cannot safely schedule their security transition around a date nobody can establish with confidence.

Harvest Now, Decrypt Later Is a Current Risk Model

A powerful quantum computer is not required for the “Harvest Now, Decrypt Later” problem.The threat model is straightforward: an adversary can capture encrypted information today and retain it with the intention of decrypting it later if quantum capabilities become sufficient.NIST explicitly identifies this as a reason to begin the transition to post-quantum cryptography now.This matters most for information with a long confidentiality lifetime, such as:

Government and defense information
Long-lived corporate intellectual property
Medical and patient records
Financial information
Legal and contractual records
Research data with long-term commercial value

It is more precise to describe HNDL as a current risk model than to claim that every organization is actively being targeted or that mass harvesting is already occurring against all sensitive data.

Organizations Are Still Struggling to Prepare

ISACA’s 2025 Quantum Computing Pulse Poll found that 67% of surveyed European IT professionals were worried that quantum computing could increase or shift cybersecurity risks, while only 4% said their organizations had a defined quantum-computing strategy.Its global poll also found that only 7% of respondents said they had a strong understanding of the new NIST standards.These numbers highlight a practical problem: awareness can increase much faster than an organization’s ability to inventory legacy cryptography and execute a large migration program.

Why Cryptographic Migration Takes Years

Post-quantum migration is not simply a matter of replacing one algorithm in one application.An organization may need to identify vulnerable public-key cryptography across:

Applications and APIs
TLS and other network protocols
Public-key infrastructure and certificates
Cloud services
Embedded devices
Firmware
Legacy software
Third-party products
Hardware security modules
Identity and authentication systems

NIST notes that moving from standardization to full integration of new cryptographic algorithms has historically taken 10 to 20 years. The exact duration for a particular organization depends on its size, technology stack, vendor dependencies, hardware lifecycle, regulatory environment, and ability to implement cryptographic agility.Some enterprise studies estimate shorter windows for specific organizations, but those should be treated as context rather than universal migration durations.

What NIST Actually Standardized in 2024

One of the most important corrections to the original article is the number of finalized NIST PQC standards.In August 2024, NIST finalized three post-quantum cryptography standards:

FIPS 203: ML-KEM, a key-encapsulation mechanism for key establishment
FIPS 204: ML-DSA, a digital-signature standard
FIPS 205: SLH-DSA, a stateless hash-based digital-signature standard

These are the first finalized NIST standards for post-quantum cryptography.NIST also selected HQC in March 2025 as a backup key-establishment algorithm to complement ML-KEM. NIST expects a finalized HQC standard in 2027.Separately, the FALCON-derived signature algorithm is being developed as FIPS 206. It was selected for standardization earlier, but it was not one of the three finalized standards published in August 2024.

What PQC Algorithms Actually Replace

The new standards provide standardized building blocks for replacing vulnerable public-key mechanisms, but they are not simple “drop-in replacements” for every existing RSA or elliptic-curve deployment.A real migration can require:

Protocol changes
Certificate and PKI updates
Software changes
Hardware and firmware updates
Interoperability testing
New cryptographic libraries
Key-management changes
Crypto-agility improvements

For that reason, organizations should think in terms of migration architecture rather than a single algorithm swap.

Hybrid Cryptography and Crypto Agility

During migration, organizations may use hybrid approaches that combine classical and post-quantum mechanisms while compatibility is established and systems are updated.Crypto agility is equally important. A crypto-agile architecture makes it easier to replace or add cryptographic algorithms without redesigning the entire application or hardware system.Google’s 2026 PQC roadmap explicitly emphasizes cryptographic agility and a staged transition rather than a single replacement event.

Google’s 2029 PQC Migration Target

Google announced in March 2026 that it was setting a 2029 timeline for its own post-quantum cryptography migration. In August 2026, Google Cloud published a more detailed roadmap and said it plans to achieve full PQC readiness by 2029, while continuing some work into the 2030s.Google’s 2029 target should not be interpreted as a prediction that Q-Day will occur in 2029. It is a migration target that reflects Google’s assessment of the work required to protect infrastructure against a future CRQC and the risk of store-now-decrypt-later attacks.This is one of the clearest examples of why threat probability and migration deadlines must be kept separate.

What the June 2026 U.S. Executive Order Changed

The federal policy landscape changed substantially in June 2026.On June 22, 2026, the White House issued Executive Order 14412, “Securing the Nation Against Advanced Cryptographic Attacks.”The order directs federal agencies to accelerate migration to NIST-approved PQC standards and requires agencies to designate PQC migration leads and develop migration plans.For high-value assets and high-impact systems, the order calls for:

PQC for key establishment by December 31, 2030
PQC for digital signatures by December 31, 2031

The order also directs work toward a federal acquisition rule that would require covered contractors to comply with applicable NIST FIPS incorporating PQC-compliant algorithms by December 31, 2030.These are federal policy deadlines for specified systems and covered requirements. They are not a universal deadline telling every private company in every industry that its entire infrastructure must be quantum-safe by 2030.

Department of War PQC Deadlines

The Department of War’s 2026 Post Quantum Cryptography Strategy is more specific about its own systems.The strategy states that, no later than:

December 31, 2030: all Department of War systems must support PQC or be phased out.
December 31, 2031: all Department of War systems must use PQC, unless otherwise noted.

These dates should not be generalized to every U.S. private-sector organization, but they show how national-security systems are moving toward explicit implementation deadlines.

What NIST’s 2035 Target Means

NIST’s current PQC migration materials say that quantum-vulnerable algorithms are expected to be deprecated and ultimately removed from NIST standards by 2035, with high-risk systems transitioning earlier.The exact 2030/2035 transition table originated in the initial public draft of NIST IR 8547, so it should not be described as though every detail is a final binding regulation.The safer current framing is that the United States is working toward staged migration away from quantum-vulnerable public-key cryptography, with high-risk federal systems on earlier schedules and a broader NIST objective of removing vulnerable algorithms by 2035.

What a Quantum-Compromised Internet Would Actually Look Like

A cryptographically relevant quantum computer would not simply “turn off the internet.” The consequences would depend on which public-key systems a service uses, what keys or signatures are exposed, how certificates are managed, and whether the affected systems have been migrated.Potential impacts could include:

Forgery of digital signatures using compromised public-key systems
Compromise of certain key-establishment mechanisms
Retrospective decryption of harvested encrypted traffic
Loss of trust in vulnerable certificates or identity systems
Exposure of long-lived encrypted archives

Symmetric encryption and hash functions are not threatened in the same way as RSA or elliptic-curve public-key cryptography. Organizations therefore need a cryptographic inventory that identifies where each class of cryptography is used rather than assuming every security control must be replaced at once.

What Organizations Should Do Now

1. Build a Cryptographic Inventory

Identify where RSA, finite-field Diffie-Hellman, elliptic-curve cryptography, and other public-key mechanisms are used.Inventory applications, certificates, devices, libraries, APIs, HSMs, cloud services, embedded systems, and third-party dependencies.

2. Identify Long-Lived Sensitive Data

Prioritize data whose confidentiality or integrity must remain protected for many years. This is where the HNDL model is especially important.

3. Assess Vendor Readiness

Ask critical vendors whether they support NIST’s finalized PQC standards, hybrid deployments, crypto agility, and future certificate changes.

4. Test PQC in Real Protocols

Do not stop at laboratory demonstrations. Test the algorithms in the systems where they will actually be deployed, including network protocols, certificates, authentication, key management, and hardware.

5. Prioritize High-Risk Systems First

Systems with long-lived secrets, large attack surfaces, national-security relevance, sensitive personal data, or difficult hardware replacement cycles deserve earlier attention.

6. Track Policy Deadlines Separately

Maintain a timeline that distinguishes your internal risk deadline, NIST’s broader transition goals, federal requirements, defense deadlines, and vendor roadmaps.

The 2026 Quantum-Security Timeline at a Glance

Date	Development
2024	NIST finalized FIPS 203, FIPS 204 and FIPS 205.
2025	NIST selected HQC for future standardization; Google published the sub-one-million-qubit RSA-2048 resource estimate.
March 2026	Google announced a 2029 target for PQC migration.
June 22, 2026	Executive Order 14412 established accelerated federal PQC migration requirements.
2029	Google Cloud targets full PQC readiness.
Dec. 31, 2030	Federal high-value/high-impact systems must use PQC for key establishment under EO 14412; Department of War systems must support PQC or be phased out.
Dec. 31, 2031	Federal high-value/high-impact systems must use PQC for digital signatures; Department of War systems must use PQC, subject to stated exceptions.
2035	NIST’s transition work anticipates ultimate removal of quantum-vulnerable algorithms from its standards, with high-risk systems transitioning earlier.

Conclusion: The Time to Start PQC Migration Is Now, Not Because Q-Day Is Predictable, but Because Migration Is Slow

The quantum threat to public-key cryptography is real, but it is often communicated too dramatically.Google’s 2025 resource estimate shows that the theoretical cost of factoring RSA-2048 has fallen sharply, from the company’s earlier estimate of 20 million noisy qubits to less than one million under a specific set of assumptions. But that does not mean a practical million-qubit RSA-breaking machine currently exists.The more important 2026 message is organizational. NIST has already finalized three PQC standards, HQC is moving through a second-stage standardization process, governments are establishing migration deadlines, and major technology providers such as Google are setting their own PQC readiness targets.The Global Risk Institute’s 2025 expert survey puts the probability of a cryptographically relevant quantum computer at 28%–49% within 10 years and 51%–70% within 15 years. Those are uncertain expert estimates, not dates to place on a calendar.The practical urgency comes from the mismatch between that uncertainty and the long time required to inventory and replace cryptography. NIST notes that cryptographic transitions can historically take 10–20 years, while current federal and defense programs are already operating on earlier deadlines.For organizations with long-lived sensitive data or complex infrastructure, delaying the inventory and migration program can materially reduce the available safety margin.The correct strategy is neither panic nor wait-and-see. It is disciplined preparation: inventory vulnerable cryptography, prioritize sensitive systems, test NIST-approved PQC, build crypto agility, and align the migration program with both organizational risk and applicable deadlines.

Frequently Asked Questions

Can a quantum computer really break RSA-2048 with fewer than one million qubits?

Google researcher Craig Gidney estimated in 2025 that a 2048-bit RSA integer could be factored in less than a week using fewer than one million noisy physical qubits under specific assumptions about error rates, connectivity, surface-code cycles, and control response time. It is a theoretical resource estimate, not a demonstration of a machine that can perform the attack today.

Why does the article say “less than a week” instead of “hours”?

Google’s 2025 paper explicitly estimates less than one week. The earlier 2019 Google estimate used 20 million noisy qubits for an eight-hour attack. The two figures should not be combined into a single runtime estimate.

Will quantum computers break all internet encryption?

No. The main concern is public-key cryptography based on mathematical problems vulnerable to Shor’s algorithm, including RSA and discrete-log-based systems. Symmetric cryptography and hash functions face different quantum considerations.

How many post-quantum standards did NIST finalize in 2024?

NIST finalized three: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). HQC was selected in 2025 for future standardization, and the FALCON-derived signature standard is still in development.

What is the current U.S. federal deadline for PQC?

Executive Order 14412, issued June 22, 2026, directs high-value and high-impact federal systems to use PQC for key establishment by December 31, 2030 and for digital signatures by December 31, 2031. The order also directs work on contractor requirements.

What are the Department of War’s PQC deadlines?

The 2026 Department of War PQC strategy requires all Department of War systems to support PQC or be phased out by December 31, 2030, and to use PQC by December 31, 2031, subject to stated exceptions.

What does the Global Risk Institute say about Q-Day timing?

Its 2025 survey of 26 experts estimated a 28%–49% probability of a cryptographically relevant quantum computer within 10 years and 51%–70% within 15 years. These are expert probability estimates, not a fixed forecast date.

What is Harvest Now, Decrypt Later?

It is a threat model in which attackers collect encrypted information now and store it for possible decryption after quantum computers become capable of breaking the underlying public-key cryptography.

Does a company need to migrate everything to PQC immediately?

Organizations should begin the migration program now, but implementation should be prioritized by risk. Start with a cryptographic inventory, identify long-lived sensitive data and high-impact systems, assess vendor readiness, and build a staged transition plan.

Are NIST’s PQC standards drop-in replacements for RSA and ECC?

Not in a universal sense. The standards provide cryptographic building blocks, but implementation can require protocol changes, certificates, software, hardware, interoperability testing, and crypto-agility work.

Is 2029 the date when quantum computers will break encryption?

No. Google uses 2029 as its own PQC migration target. It is a migration deadline, not a prediction that a cryptographically relevant quantum computer will arrive in 2029.

Sources

Last updated: August 25, 2026. Quantum-computing capabilities, threat estimates, standards, and government policies can change. This article is general cybersecurity information, not a guarantee about future quantum capabilities or a substitute for a formal cryptographic risk assessment.