Quantum cryptanalysis means using quantum algorithms to break cryptography. Shor's algorithm would defeat RSA and elliptic curve systems if a large enough quantum computer were built, while Grover's algorithm only weakens symmetric ciphers and hashes by a square root factor. Nobody can say when such a machine will exist, so the planning question is migration.
What do the two famous algorithms do?
In 1994 Peter Shor published polynomial-time quantum algorithms for prime factorization and discrete logarithms. Those two problems underpin RSA, Diffie-Hellman and elliptic curve cryptography. On a sufficiently large, error-corrected quantum computer, they could be solved efficiently, which would break the public-key systems that protect most key exchange and digital signatures today.
Lov Grover's 1996 paper describes a quantum search algorithm that finds an item in an unsorted space in roughly the square root of the number of steps a classical search needs. For symmetric ciphers, that means a key search gets a quadratic speedup, not an exponential one. Doubling the key length restores the margin, which is why 256-bit symmetric keys are the common planning choice.
The difference matters. Public-key systems need replacing. Symmetric systems need larger parameters.
Does that mean encryption is broken today?
No. Nobody has demonstrated a quantum computer able to run Shor's algorithm against real-world key sizes. This post makes no prediction of when one will exist, and you should be wary of anyone who gives a firm date.
The concern for organizations is more subtle. Data encrypted today and recorded by an adversary could be decrypted later if the key exchange used a vulnerable algorithm. Anything that must stay confidential for many years, such as health records, state secrets or long-term contracts, is in scope today, even though the machine is not.
What has NIST done about it?
NIST published its first three final post-quantum cryptography standards on 13 August 2024: FIPS 203, a lattice-based key encapsulation mechanism called ML-KEM; FIPS 204, the lattice-based signature standard ML-DSA; and FIPS 205, the hash-based signature standard SLH-DSA. NIST selected a further key encapsulation algorithm, HQC, for standardization on 11 March 2025, and the Falcon signature algorithm is also in the standardization process.
NIST's PQC page says organizations should begin migrating, identify where vulnerable algorithms are used, and plan replacement. It states that under the transition timeline in NIST IR 8547, NIST will deprecate and ultimately remove quantum-vulnerable algorithms from its standards by 2035, with high-risk systems moving much earlier. IR 8547 is described as a draft transition plan, so check the current status before relying on specific dates.
A constructed example
A hospital's archive system exchanges keys with RSA and stores patient images that must remain private for decades. Its team inventories cryptography and finds RSA in the VPN, in two internal certificate authorities, in code signing, and in a vendor appliance. They rank the archive link first, because of the long confidentiality life, and ask the appliance vendor for a post-quantum roadmap. The inventory took three weeks. It was the hardest step, and the one with the most value.
What should you do now?
Start with a cryptographic inventory, since you cannot migrate what you have not found. Then prioritize by how long the data must stay secret and how hard the system is to change. Ask vendors for their plans. Design new systems so algorithms can be swapped, a property sometimes called crypto agility, instead of being hard-coded.
How to check or apply this
- List where you use public-key cryptography: TLS, VPNs, code signing, certificates, SSH, and stored keys.
- Record for each system how long its data must stay confidential.
- Rank systems by confidentiality life and difficulty of change.
- Ask each supplier for a dated post-quantum plan in writing.
- Prefer libraries and protocols that can switch algorithms through configuration.
- Pilot ML-KEM in a non-critical system and measure effects on handshake size and latency.
- Track NIST updates, especially IR 8547, and revisit your plan twice a year.
Quick check
Is AES broken by quantum computers?
No. Grover's algorithm gives a square root speedup against key search, so larger keys, such as 256 bits, keep a comfortable margin.
What is harvest now, decrypt later?
It is the risk that an adversary stores encrypted traffic today to decrypt it once a capable quantum computer exists. It matters for data with a long confidentiality life.
Sources
- Shor, Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer
- Grover, A fast quantum mechanical algorithm for database search
- NIST Post-Quantum Cryptography project
- NIST IR 8547, Transition to Post-Quantum Cryptography Standards
Last reviewed: 18 October 2026.
