Quantum computing is a different kind of threat
Classical computers process information in bits — zero or one. Quantum computers use qubits, which can exist in superposition: representing zero, one, or any combination of both at once, until measured. Combined with entanglement, quantum computers can explore an enormous number of possible solutions in parallel rather than sequentially.
For most computing tasks, that provides no meaningful advantage. But one class of problem becomes tractable on a quantum computer that is intractable on any classical machine, no matter how many processors you run in parallel — and breaking RSA encryption is one of them.
In 1994, Peter Shor published an algorithm that solves integer factorisation exponentially faster on a quantum computer than any known classical method. The question isn't whether RSA falls. It's when.
physical qubits estimated to break RSA-2048 in 8 hours.
Gidney & Ekerå, 2019revised estimate — a 20-fold reduction from algorithmic improvements, not hardware.
Gidney, arXiv 2505.15917, 2025qubits in IBM's Condor processor — current hardware sits at thousands, not millions.
IBM, 2023Google's Willow chip, announced December 2024, demonstrated meaningful progress on the error-correction problem that has historically limited quantum computing's practical utility. No expert consensus exists on an exact date — estimates range from 2030 at the early end to 2040 and beyond at the conservative end. What isn't in reasonable dispute: the trajectory is toward capability, not away from it.
Which algorithms are at risk — and which aren't
The distinction matters for prioritisation. The urgent problem is asymmetric cryptography. Symmetric key length is a medium-term concern. Hash functions need the least immediate attention.
RSA & Elliptic Curve Cryptography (ECC)
Vulnerable to Shor's Algorithm on a sufficiently powerful quantum computer. Used pervasively: HTTPS, TLS, SSH, digital certificates, code signing, VPNs, enterprise authentication. All key sizes in current use — RSA-2048, RSA-4096, ECC-256 — offer no meaningful additional protection.
AES symmetric encryption
Threatened by Grover's Algorithm, which roughly halves effective key length. AES-128 provides ~64 bits of quantum security — insufficient. AES-256 provides ~128 bits — considered adequate by current standards.
Hash functions (SHA-256, SHA-3)
Not significantly threatened by currently known quantum algorithms. Doubling output size — SHA-512 where SHA-256 is used now — is considered adequate mitigation by most standards bodies.
The threat is active, not future
The assumption that there's no urgency because quantum computers don't yet exist misses something fundamental about the threat model. Data encrypted today with RSA or ECC, and captured today, can be stored and decrypted later — once the capability exists.
Harvest now, decrypt later: nation-state adversaries are already collecting encrypted data — health records, legal documents, financial data, intellectual property — for decryption once a cryptographically relevant quantum computer exists.
The NCSC, CISA, ASD, and NSA have all issued guidance acknowledging this explicitly. The NSA's CNSA 2.0 guidance, published in 2022, specifically cites harvest-now-decrypt-later as justification for beginning transitions immediately — not when quantum computers become available. For any data requiring confidentiality beyond ten to fifteen years, the threat is present now.
The NIST standardisation process is complete
In August 2024, after an eight-year evaluation, NIST finalised the first three post-quantum cryptographic standards. Organisations don't need to wait for further guidance to start planning — the algorithms are already available in major cryptographic libraries.
ML-KEM
Key encapsulation mechanism — the primary replacement for RSA and ECDH in protocols like TLS.
✓ Already in Chrome & CloudflareML-DSA
Digital signature algorithm — replaces RSA and ECDSA for code signing and authentication.
✓ Available in major crypto librariesSLH-DSA
Hash-based signature algorithm — a conservative choice where long-term trust is critical.
✓ Conservative, high-assurance useFN-DSA
A compact lattice-based signature scheme, useful in bandwidth-constrained environments.
⟳ Finalisation pendingThe Australian position
In its 2024 update to the Information Security Manual, ASD categorises quantum-vulnerable cryptography — specifically RSA and ECC — as algorithms organisations should begin planning to replace, with a target of completing transitions before 2030 for systems protecting data that needs long-term confidentiality.
The guidance is consistent with the broader Five Eyes posture — the NSA, NCSC, CCCS, and GCSB have all published aligned guidance directing organisations to begin transition planning now. Organisations that haven't started their cryptographic inventory are already behind the guidance curve: the transition isn't a single change, it requires identifying every system using quantum-vulnerable algorithms, prioritising by data sensitivity, and executing across often-complex infrastructure. That takes years, not months.
What to take into your next risk conversation
Quantum threatens asymmetric encryption, not all encryption
RSA and ECC — protecting most encrypted communications and authentication — are vulnerable to Shor's Algorithm. AES-256 and hash functions are not equivalently threatened.
The timeline has been compressed, not extended
The qubit requirement to break RSA-2048 dropped from 20 million to under one million — a 20-fold improvement from algorithmic advances, not hardware.
"Harvest now, decrypt later" is an active risk today
Data encrypted today is being collected by nation-state adversaries for future decryption. Anything requiring confidentiality beyond 10 years is exposed right now.
The standards are finalised, and ASD has issued guidance
NIST published ML-KEM, ML-DSA, and SLH-DSA in August 2024. ASD targets transition before 2030. Organisations that haven't started their inventory are already behind.
Why Your Encryption Works — And Why Quantum Breaks It
The transition is technical. The decisions that drive it are made by people.
Understanding post-quantum risk — what to prioritise, what to ask vendors, what "transition planning" actually means — starts with awareness. Click or Flick Corporate builds that awareness at every level of your organisation, from technical teams to the board.