Commentary Addressing Risks and Opportunities Through the Life Cycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

Modern encryption relies on mathematical assumptions that quantum computers may soon render obsolete. This technological shift creates new information security and legal risks that demand novel mitigation strategies.

core/paragraph

This is the first in a series of installments examining quantum computing risk from a legal and compliance perspective. Future installments will address legal exposure under cybersecurity, privacy and data protection laws and practical steps organizations should take now.

This post is one part technical primer and one part technical lookahead. A baseline understanding of the underlying technology helps separate real risk from hype. To that end, this post covers several related topics:

It first describes cryptography and its relevance to modern life. It also describes quantum computing, how it differs from classical computing and how it will impact the cryptographic landscape.

core/list-item

This post then defines “Q-Day,” the day when present-day encryption systems fail us. It discusses how quantum computers bring us to Q-Day, when organizations should expect it to occur and what governments recommend organizations do to prepare for it.

core/list

Cryptography: The Infrastructure of Trust

core/heading

Cryptography is the discipline of protecting information by mathematically transforming it from readable “plaintext” to unreadable “ciphertext” to ensure that only authorized recipients can access it. It is the invisible infrastructure underlying virtually every aspect of modern digital operations: from TLS/HTTPS connections to VPNs, user authentication, email encryption, code signing, digital certificates, electronic signatures and blockchain networks.

There are two broad categories of encryption relevant here:

First, symmetric cryptography uses a single, shared key. Like a shared password, anyone with the key can encrypt or decrypt data. Symmetric cryptography’s security benefits come from the shared key’s obscurity. If an attacker does not know the key, there is no clever mathematical method to derive it. If they want to break the encryption, they must look for a needle in a haystack by examining each piece of hay.

Advanced Encryption Standard (AES) is by far the most common symmetric algorithm. Other common symmetric algorithms include ChaCha, Twofish and Serpent. Symmetric encryption is fast and efficient, so it is commonly used to protect bulk data. It is used to protect both data at rest and data in transit once two systems establish a session by agreeing on a shared encryption key. Using a single shared key is risky. To mitigate risk, systems will briefly use asymmetric cryptography (discussed below) to transmit a temporary “session key.” Securing the initial transmission and limiting how long any individual shared key is used mitigates many of the underlying risks.

Second,asymmetric (public-key) cryptography is more like a locked mailbox: anyone can deliver encrypted information using a public key (the mail slot), but only those with the mailbox’s private key can read it. Asymmetric cryptography allows parties to communicate securely, including over insecure or public channels, without having previously shared a key.

To function, it must be easy to generate a public/private key pair – but infeasible to reverse the process and derive the private key from the public key. Modern systems achieve this using mathematical trapdoors: math problems that are easy to compute in one direction but extremely difficult or time-consuming to reverse.

The most widely deployed asymmetric algorithms are Rivest–Shamir–Adleman (RSA), which relies on the computational difficulty of factoring large integers to generate secure key pairs, and Elliptic Curve Cryptography (ECC), which relies on the difficulty of solving the elliptic curve discrete logarithm problem. These algorithms underpin the protocols (e.g., TLS, SSH, S/MIME, DNSSEC) and public key infrastructure (PKI) that make authenticated, encrypted communications and digital signatures possible at scale.

Classical computers include virtually all computers on earth, from phones to laptops, servers and supercomputers. They excel at many modern tasks. But because of how they process information, they have a hard time with problems that require searching through enormous numbers of possibilities.

Quantum computers leverage quantum mechanical phenomena like superposition, entanglement and interference across numerous qubits (quantum bits), to represent many possible states simultaneously. Unlike a classical bit, which is limited to a binary state – yes or no, off or on – qubits can explore multiple paths in parallel, highlighting correct answers and suppressing incorrect ones, rather than sequentially testing each possibility. Fully realized quantum computers will be able to solve computational problems that are intractable on any classical computer, and they are particularly well suited to solve cryptographic problems.

Quantum computers are not science fiction. They exist and work today. But today’s quantum computers lack the scale and stability to solve real-world problems and primarily reside in research laboratories.

The primary bottleneck to practical quantum computing is the extreme fragility of qubits. Even small disruptions, like stray cosmic rays or cooling system vibrations, can cause quantum information to vanish (a phenomenon known as decoherence), disrupting computation. To address this, researchers build logical qubits by bundling together hundreds or thousands of physical qubits, the actual atoms or superconducting loops that store information. This creates redundancy and allows for error correction. But this approach exacerbates other bottlenecks:

Quantum computers need to be kept at near-absolute-zero temperatures to minimize thermal noise and prevent decoherence. But as the number of physical qubits grows, so does the thermal load.

Quantum gates, the way quantum computers perform operations on qubits, increase in complexity as the number of underlying qubits grows. Each quantum gate is a carefully timed pulse of energy, and even tiny errors in timing, power or frequency can lead to gate errors (e.g., leaking and nudging a neighboring qubit) or decoherence.

Likely in part due to the complexity of the field, at time of writing, strikingly few compelling applications for quantum computers have emerged. There is exciting research in many areas, but there are also significant technical hurdles. Many computational problems do not map nicely to the specialized, interference-based operations required to extract a quantum advantage. Nevertheless, as quantum computers advance and become more widely available, it’s reasonable to expect further innovation. Some expected applications include optimization and material sciences research.

One field of computing, however, is widely expected to see significant impacts from quantum computing: cryptography.

The entire asymmetric cryptography ecosystem on which modern secure communication depends is potentially vulnerable to quantum computing. Asymmetric algorithms are at high risk, while symmetric algorithms face less dramatic vulnerabilities. There are two primary quantum algorithms of note:

Shor’s algorithm presents a highly efficient solution to the otherwise intractable math problems at the heart of RSA (integer factorization) and ECC (discrete logarithm). It threatens to undermine asymmetric cryptography. The algorithm uses modular arithmetic to identify potential solutions, which can then be checked for correctness. Quantum computers perform this process exponentially faster than classical computers. A sufficiently powerful quantum computer running Shor’s algorithm would break RSA, ECC, Diffie-Hellman key exchange, and DSA/ECDSA digital signatures, eliminating their security benefits.

Grover’s algorithm provides a more modest speedup for unstructured search problems, the problems at the heart of symmetric key encryption. This algorithm halves the search process by using heuristics to evaluate many key candidates simultaneously. Because the speedup is only quadratic, AES and other symmetric algorithms can maintain current security levels by doubling their key length. This represents a negligible processing increase for encryption and decryption. For example, against Grover’s algorithm, AES-128 would provide only 64-bit effective security, which is extremely weak. But a system could implement AES-256 to retain adequate security at 128 effective bits.

A cryptographically relevant quantum computer is a quantum computer capable of running Shor’s algorithm at the scale needed to break real-world asymmetric cryptographic systems. Existing quantum computers are still far too small and error-prone to do this. The critical question is: when will quantum computers be good enough?

Q-Day is what cryptography researchers have dubbed the answer to that question. Until recently, most expert estimates placed this threat somewhere in the range of 2035-2065. But that consensus is rapidly shifting forward. Researchers have made significant advancements in the scale and stability of quantum computers. And at the same time, researchers have made significant improvements upon Shor’s algorithm, reducing the number of qubits and quantum gates required. Thus, the gap is narrowing faster than expected from both sides: quantum computers are becoming stronger faster than expected, and the threshold for quantum computers to become cryptographically relevant is lower than expected. Present indications are that the pace of improvement is continuing to accelerate.

Major companies warn Q-Day could arrive in 2029. Earlier this year, Google published <a href="https://research.google/blog/safeguarding-cryptocurrency-by-disclosing-quantum-vulnerabilities-responsibly/">research</a> demonstrating that breaking the 256-bit elliptic curve discrete logarithm problem – the basis of ECDSA, used in most TLS connections and every major blockchain network – could be accomplished with fewer than 500,000 physical qubits, representing a roughly 20-fold reduction from prior estimates. A further <a href="https://www.caltech.edu/about/news/caltech-team-finds-useful-quantum-computers-could-be-built-with-as-few-as-10000-qubits">estimate</a> for neutral-atom architecture quantum computers suggests that breaking ECC-256 may require as few as 10,000 qubits. Most recently, IBM has <a href="https://www.linkedin.com/pulse/quantum-timeline-elliptic-curve-cryptography-just-jumped-osborne-k1oae/">warned</a> of quantum “moonshot attacks” on high-value targets as early as 2029, and leading technology companies have tightened their timelines to secure against quantum attacks.

In practice, Q-Day may unfold gradually as the technology diffuses from secret, slow and expensive government laboratories to eventual widespread commercial availability. The basic message, however, is clear: without adequate preparation, critical cryptographic systems will break almost simultaneously on Q-Day.

Important Timeline Caveats: Harvest Now, Decrypt Later; Secrecy

There are two other important considerations when making decisions based on the timeline to achieve cryptographically relevant quantum computers:

First, sophisticated adversaries (primarily select nation-state actors) are already exploiting the quantum threat using a Harvest Now, Decrypt Later (HNDL) strategy – collecting and storing vast troves of encrypted data for later decryption. For data with a long shelf life – health records, trade secrets, government communications and other data that may remain sensitive for decades – the threat is already present. We will address the legal risks presented by HNDL strategies in our subsequent posts.

Second, once quantum progress reaches a certain threshold, governments and other sophisticated actors may stop disclosing their true capabilities. At the end of last year, Scott Aaronson, a leading quantum computing researcher, <a href="https://scottaaronson.blog/?p=9425">observed</a>, “[A]t some point, the people doing detailed estimates of how many physical qubits and gates it’ll take to break actually deployed cryptosystems using Shor’s algorithm are going to stop publishing those estimates, if for no other reason than the risk of giving too much information to adversaries. Indeed, for all we know, that point may have been passed already.” When Google researchers provided their new, lower estimates in April of this year, they published their research as a zero-knowledge proof, a cryptographic method that allows others to validate their findings without disclosing the actual attack vectors that make the lower estimates possible.

PQC – sometimes called quantum-resistant or quantum-safe cryptography – refers to cryptographic algorithms designed to be secure against both classical and quantum attacks. It achieves security through mathematical problems believed to be hard even for quantum computers, such as lattice-based problems, hash-based constructions and code-based problems. PQC protects data from attacks by both classical and quantum computers and is designed to run on classical computers. This is the distinguishing factor between PQC and quantum cryptography, which seeks to encrypt information using quantum mechanics and hardware.

In 2016, the U.S. National Institute of Standards and Technology (NIST) launched a global competition to standardize PQC, as it has done for AES, SHA and other cryptographic algorithms. After eight years of evaluation, NIST finalized its first three PQC standards in August 2024:

FIPS 203 (“ML-KEM,” based on CRYSTALS-Kyber): the primary standard for general encryption and key encapsulation, used to establish shared secrets in protocols like TLS.

FIPS 204 (“ML-DSA,” based on CRYSTALS-Dilithium): the primary standard for digital signatures.

FIPS 205 (“SLH-DSA,” based on SPHINCS+): a secondary digital signature standard based on hash functions rather than lattices, providing algorithmic diversity as a backup.

A fourth standard, FIPS 206 – “FN-DSA,” based on FALCON – is still in development. And in March 2025, NIST selected HQC, a code-based algorithm, as a fifth backup algorithm for key encapsulation, providing diversification in case weaknesses are discovered in lattice-based schemes.

The NIST process has not been without setbacks. Most notably, in 2022, one of the finalists for standardization was broken by a classical attack. There have also been side-channel weaknesses in certain implementations of Kyber/ML-KEM and compatibility issues with legacy devices. Even a rigorous, multiyear evaluation process can miss vulnerabilities, and it remains to be seen whether the standardized algorithms will fall to classical or quantum attacks in the future. Successful migration to PQC requires a carefully planned approach with validated implementations and ongoing monitoring and flexibility for newly identified weaknesses.

In November 2024, NIST released <a href="https://csrc.nist.gov/pubs/ir/8547/ipd">draft guidance</a> urging the adoption of PQC standards now, while also establishing a formal transition roadmap:

Deprecated by 2030: RSA, ECDSA, EdDSA, Diffie-Hellman, and ECDH at 112-bit security levels – i.e., RSA-2048, ECC P-256 – should no longer be used in new systems.

Disallowed after 2035: All classical public-key algorithms should be prohibited.

EU guidance largely aligns. The June 2025 <a href="https://digital-strategy.ec.europa.eu/en/library/coordinated-implementation-roadmap-transition-post-quantum-cryptography">Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography</a>, developed by the NIS Cooperation Group with European Commission support, calls for critical infrastructure to complete PQC migration no later than end of 2030 and full migration of remaining systems by end of 2035.

In light of recent developments, however, these timelines may not be aggressive enough, and leading technology companies, including <a href="https://blog.google/innovation-and-ai/technology/safety-security/cryptography-migration-timeline/">Google</a> and <a href="https://blog.cloudflare.com/post-quantum-roadmap/">Cloudflare</a>, have set 2029 as internal targets to secure against cryptographically relevant quantum computers.

For any organization, the timeline ultimately depends on three factors: the timeline for the arrival of cryptographically relevant quantum computers, the time required to migrate to PQC, and the length of time for which encrypted data must remain secure. For most organizations, that means PQC migration efforts should begin now if not already underway. Nevertheless, a majority of all websites with TLS still use RSA-2048 and, where ECDSA or ECDH is used, P-224 is still in widespread use – despite looming deadlines.

The quantum threat to cryptography is structural, not speculative, and the timeline is compressing. We are monitoring quantum computing and cryptographic developments and are ready to help assess exposure and build mitigation strategies. In the next installment, we explore the legal and compliance implications of this exposure.

What In-House Counsel Should Know About Quantum Risk: The Quantum Threat