A cryptographically relevant quantum computer (CRQC) is a quantum computer large and reliable enough to break the public key cryptography in common use, such as RSA and elliptic curve schemes. No one can say when one will exist. Teams plan now because data and systems outlive the algorithms that protect them.
Why does a quantum computer threaten encryption?
Public key cryptography rests on math problems that are hard for ordinary computers: factoring large numbers and computing discrete logarithms. Shor's algorithm, published in 1994, shows that a sufficiently large quantum computer could solve both efficiently. That would break RSA, Diffie Hellman and elliptic curve cryptography, which protect web connections, software signatures, VPNs and identity systems.
Symmetric cryptography, such as AES, is affected less. A different quantum algorithm gives a smaller speedup against symmetric keys, so the usual response is to use adequately long keys and hash outputs.
The key word in CRQC is relevant. Quantum computers exist today, but they are small and noisy and cannot run attacks on real world key sizes. Whether and when one will is an open question where experts disagree, so treat any specific date you read as a forecast, not a fact.
Why act before it exists?
Two reasons. First, harvest now, decrypt later: an adversary can record encrypted traffic today and decrypt it when a CRQC arrives. Data that must stay secret for many years, such as health, legal or state secrets, is exposed from the moment it is recorded.
Second, migration is slow. Cryptography is embedded in protocols, hardware, firmware, certificates and contracts. Replacing it across an organization takes years, and the work should start before the deadline is visible.
What has NIST done?
NIST published its first post quantum standards on 13 August 2024. FIPS 203 specifies ML-KEM, a key encapsulation mechanism used to establish shared secret keys, with three parameter sets, ML-KEM-512, ML-KEM-768 and ML-KEM-1024. The standard says ML-KEM is believed to be secure even against adversaries who possess a quantum computer. FIPS 204 specifies ML-DSA, a digital signature algorithm. FIPS 205 specifies SLH-DSA, a stateless hash based signature algorithm.
NIST also released a report, NIST IR 8547, on 12 November 2024 as an initial public draft. It describes NIST's expected approach to transitioning from quantum vulnerable cryptographic algorithms to post quantum signature and key establishment schemes, and identifies the standards that products and services will need to move away from and toward. Because it is a draft, read the current version of the report for its timeline.
What should you do first?
Find where you use public key cryptography. That means more than TLS on your website. Look at code signing, internal certificate authorities, VPNs, SSH keys, embedded devices, JWT signing, and libraries inside your dependencies. This inventory is the hard part, and it overlaps with a software bill of materials, since cryptographic libraries show up there.
Constructed example: the firmware signing key
A device maker signs firmware with an RSA key and ships devices with a ten year expected life. The root verification key is burned into hardware at the factory. If a CRQC appeared during that life, an attacker could forge updates, and the device cannot swap the key. The lesson is to design new products so the signature algorithm can be changed in the field, and to include post quantum options in the roadmap. A cryptographic inventory would have flagged this product early.
How to check or apply this
- Build a cryptographic inventory: algorithms, key sizes, libraries, owners and data lifetimes.
- Rank systems by how long their data must stay confidential and by how hard they are to change.
- Ask vendors for their post quantum plans and support for the NIST standards.
- Design new systems for crypto agility, meaning the algorithm can be replaced without a redesign.
- Pilot hybrid key exchange where your stack supports it, and track what standards bodies publish.
- Check your dependencies for cryptographic libraries and track their updates. Safeguard's dependency scanning and software bill of materials views help list them.
Quick check
Does a CRQC exist today?
No public evidence shows one exists. Current quantum computers cannot break real world RSA or elliptic curve keys.
Is AES broken by quantum computers?
No. Symmetric ciphers are affected far less than public key schemes, and longer keys are the usual answer.
Sources
- NIST FIPS 203, Module Lattice Based Key Encapsulation Mechanism Standard
- NIST FIPS 204, Module Lattice Based Digital Signature Standard
- NIST FIPS 205, Stateless Hash Based Digital Signature Standard
- NIST IR 8547 (initial public draft), Transition to Post Quantum Cryptography Standards
Last reviewed: 18 October 2026.
