Every time you log in to a bank, buy something online or install a software update, your device quietly performs a piece of mathematics that would take a classical supercomputer longer than the age of the universe to undo. A large quantum computer could undo it in hours or days. That single fact has set off one of the largest planned upgrades in the history of computing.

How today's encryption works

Two strangers on the internet need a shared secret key before they can talk privately, yet anyone may be listening. Public-key cryptography, invented in the 1970s (Diffie-Hellman in 1976, RSA in 1977), solves this. Public-key encryption lets strangers set up a shared secret over an open network, and its security rests on math problems, such as factoring large numbers, that are hard for classical computers. Public-key methods also make digital signatures, which prove a software update really came from its maker. Shor's algorithm breaks RSA and its elliptic-curve cousins. Symmetric encryption such as AES, used for the bulk of data once a key is agreed, is in better shape: Grover's algorithm only weakens it, so doubling key length, for example by using AES-256, is considered enough to protect symmetric encryption.

Harvest now, decrypt later

Why worry before the machine exists? Adversaries can record encrypted traffic today and store it until a quantum computer can decrypt it, a threat called "harvest now, decrypt later." Medical records, diplomatic cables and trade secrets may matter for decades. The Canadian researcher Michele Mosca offered a rule of thumb. If the years data must stay secret plus the years needed to switch systems are more than the years until a capable quantum computer exists, the data is already at risk. Nobody knows the last number. A 2025 estimate by Craig Gidney of Google suggested that breaking 2048-bit RSA might take under a million noisy qubits running for under a week, far fewer than earlier estimates, though still far beyond any existing machine.

Quantum key distribution

One answer uses quantum physics itself. In 1984 Charles Bennett and Gilles Brassard proposed sending a key as single photons in randomly chosen polarization states, a scheme known as BB84. In quantum key distribution, an eavesdropper who measures the photons unavoidably disturbs them, so the two parties can detect spying by comparing a sample of their results. A 1991 version by Artur Ekert uses entanglement; see QUAN 201. China launched the Micius satellite in 2016 and in 2017 used it to share keys for a video call between Beijing and Vienna. Yet QKD has real limits. Photons are lost in fiber, so links reach only a few hundred kilometers without relay stations that must themselves be trusted. It needs special hardware, an authenticated ordinary channel alongside it, and real devices have been hacked through flaws in their detectors rather than in the physics. The US National Security Agency and the UK's National Cyber Security Centre have advised against relying on QKD for government security, favoring post-quantum cryptography instead.

Post-quantum cryptography

The other answer is new mathematics: ordinary software built on problems believed to be hard even for quantum computers, such as finding short vectors in vast high-dimensional grids called lattices. The US National Institute of Standards and Technology (NIST) opened a public competition in 2016 and received dozens of submissions from around the world. In August 2024 NIST published its first three post-quantum standards: ML-KEM for setting up keys, and two digital signature schemes, ML-DSA and SLH-DSA. ML-KEM grew out of a design called CRYSTALS-Kyber. In 2025 NIST chose a backup method, HQC, built on different math. NIST has also proposed phasing out RSA and elliptic-curve methods by 2030 and disallowing them by 2035.

New math can fail

In 2022 a scheme called SIKE, still under consideration in NIST's process, was broken in about an hour on a single ordinary computer, a reminder that new cryptography needs years of public scrutiny. For this reason, many early deployments are hybrid, combining a classical method with a post-quantum one so that an attacker must break both. Web browsers and messaging apps such as Signal and Apple's iMessage began adding hybrid post-quantum protection in 2023 and 2024. Experts also urge crypto agility, building systems so algorithms can be swapped without rebuilding everything.

Worked example: a hospital's migration plan

A regional hospital stores patient records that must stay confidential for a lifetime and exchanges data with labs and insurers. Apply Mosca's rule: the secrecy period is decades, migration across hundreds of vendors might take ten years, and the arrival date of a capable quantum computer is unknown. The data is plausibly at risk now. A sensible plan starts with an inventory of where public-key encryption is used, including old medical devices that cannot be updated. It ranks systems by how long their data must stay secret. It asks vendors when they will support ML-KEM, turns on hybrid modes where available, and makes sure new contracts require crypto agility. It does not need quantum hardware at all: the defense against quantum attack runs on the computers the hospital already owns. QKD would make little sense here; software upgrades do the job more cheaply and over any distance.