The Quantum Threat

The Quantum Threat

The intersection point on this graph is the end of the world as we know it.

The security of the internet, based on the cryptography we have had since day one, will be permanently over. Military, banking, private messaging, identity, medical and legal records: all exposed. Only post-quantum encryption algorithms will save us.

Still no solid plan for this from any major corporation or institution, let alone any government. The unsolved P vs NP problem no longer even matters.

I put the graph up in December 2024. It is the whole argument.

Log(power) against time. Classical is the gold line — exponential growth drawn on a log axis, the shape we have lived inside since the transistor. Quantum is the cyan line. It starts underneath. Then it goes vertical. “TODAY” is still below the crossing. The crossing is the event.

That is not a metaphor for “computers get faster.” It is a change of machine. The internet’s secrets were locked with problems that are too expensive for the gold line. The cyan line is not a faster gold line. When it crosses, those locks are not locks.

The world that ends

Public-key cryptography is how strangers on an open network agree a secret and prove who they are. RSA, Diffie–Hellman, every elliptic-curve scheme in production, Bitcoin’s secp256k1: the same two problems, factoring and discrete log, restated. They have been the security of the internet since there was an internet worth securing. TLS, SSH, VPNs, signed software, certificate authorities, “zero-trust,” the identity of every bank and hospital website — all of it hangs from that.

Shor’s algorithm, 1994, is the named way a quantum machine opens those two problems in polynomial time. You do not need a new theory of hardness. You need the cyan line to cross. After that, a recorded session is readable. A signature is forgeable. A coin whose public key is on-chain is spendable by whoever ran the machine.

Military traffic. Bank records. Private messages. Identity. Medical files. Legal files. Not “the handshake layer, technically.” Those things are the ciphertext and the signatures. When the cryptography they were stored under is over, they are exposed. Permanently, for anything already written down. You cannot un-send 2020.

Symmetric ciphers do not rescue this. The session was wrapped in AES because the handshake delivered the AES key. Break the handshake, open the archive. That is the internet we actually built.

Only post-quantum algorithms close it: cryptography whose hardness is not factoring or discrete log. There is no third option. Bigger RSA is not an option. Waiting is not an option.

Still no solid plan

Naming an algorithm is not a plan.

NIST published FIPS 203, 204, and 205 in August 2024 — ML-KEM, ML-DSA, SLH-DSA. The NSA wrote exclusive-use dates toward 2030–2035. Chrome will offer a hybrid handshake. Cloudflare will terminate one. Signal and Apple can ratchet a messenger. That is what a standards process and a browser vendor look like when they move.

It is not a plan for the list.

A plan would be: the military radios, the hospital records, the bank cores, the identity systems, the twenty-year certificate hierarchies, the devices that cannot take an update, the ciphertext already sitting on disk — actually migrated, or accepted as burned. No major corporation has done that. No institution has done that. No government has done that. A 2035 “disallow” date is a calendar entry. The cyan line does not read calendars, and anyone who can store traffic is already storing it.

Harvest now, decrypt later is the present tense of “no plan.” You do not need the machine to lose a secret that must still be secret in 2035. You need a disk. The recording is the exposure. The crossing is only the open().

Bitcoin is the same fact with a balance attached. Coins that have already shown a public key — old pay-to-pubkey, reused addresses, Taproot outputs that publish the key on purpose — cannot take a Chrome update. Consensus would have to change. It has not. That is not a special case. It is the internet’s security model with the money still in the addresses.

P vs NP no longer even matters

Computer science hung a large part of the story of cryptographic hardness on one unsolved question: does P equal NP? The millennium problem. The thing you were supposed to understand if you wanted to talk about why secrets stay secret.

That question is about classical machines. Turing machines. The gold line.

The cyan line is a different kind of machine. When it crosses, the secrets fall whether or not P equals NP, whether or not anyone ever collects the prize. Factoring and discrete log do not wait on the polynomial hierarchy. They wait on the crossing.

You can leave P vs NP unsolved for the rest of the century. It no longer even matters. The security of the internet was never going to be decided by that problem. It is going to be decided by the graph.

The intersection

The estimates for what the cyan line costs keep falling. A billion physical qubits to factor RSA-2048, then twenty million, then under a million — same physical assumptions, better algorithms and error correction, six years. Lab machines are not there. The slope is.

People will wait for a press conference. The graph is not a press conference. It is power against time, and the intersection is the end of the cryptographic world we have actually run. After that, military, banking, messaging, identity, medical and legal records are not “at risk.” They are exposed, unless they were already under post-quantum algorithms.

Those algorithms are the save. They are not the plan. There is still no solid plan.

The unsolved P vs NP problem no longer even matters.

References