Introduction Estimates of the quantum resources required to break public-key cryptography fell sharply across 2025 and 2026, by enough to disturb the assumptions underlying the timing models organizations use to plan cryptographic migration. This review synthesizes published estimates for breaking RSA-2048, an integer-factoring target, and 256-bit elliptic-curve cryptography, a discrete-logarithm target, and examines what the revised figures do and do not imply for Mosca’s inequality, the standard risk-timing framework. Methods Following a protocol adapted from PRISMA 2020 conventions for a technical corpus, and after a search conducted in two rounds, 84 sources were included from preprint servers, standards repositories, and peer-reviewed venues, with 13 core studies charted in a structured extraction matrix of twelve fields that records the assumption set behind every physical-qubit figure. Results The headline physical-qubit estimate for factoring RSA-2048 fell from about one billion in 2012 to 20 million in 2019, to roughly 900,000 in 2025, and to figures between about 11,000 and 471,000 in 2026 depending on the operating point selected. Estimates for 256-bit elliptic-curve keys followed a comparable path. The reductions are attributable to arithmetic and circuit innovations, magic-state techniques, higher-rate quantum error-correcting codes, and changed architectural and hardware assumptions, and these contributions are decomposed separately here instead of being reported as a single trend. A synthesis restricted to peer-reviewed sources alone yields the same direction of travel but a materially weaker magnitude, and this is reported explicitly. Discussion A reduction in required qubits compresses a resource threshold, not a calendar. Because the relationship between a resource requirement and the date a machine meeting it is built depends on fabrication yield, achieved error rates, connectivity, decoder throughput, control systems, and sustained-runtime engineering, this review presents the consequences for Mosca’s inequality as conditional implications and supports them with scenario analysis across plausible confidentiality lifetimes, migration times, and threat horizons in place of a point forecast. The evidence reduces one barrier to feasibility and widens the uncertainty around the threat horizon; on a risk-management basis, not an evidentiary one, that combination favors prioritized migration of long-lived confidential data.
Introduction Estimates of the quantum resources required to break public-key cryptography fell sharply across 2025 and 2026, by enough to disturb the assumptions underlying the timing models organizations use to plan cryptographic migration. This review synthesizes published estimates for breaking RSA-2048, an integer-factoring target, and 256-bit elliptic-curve cryptography, a discrete-logarithm target, and examines what the revised figures do and do not imply for Mosca’s inequality, the standard risk-timing framework. Methods Following a protocol adapted from PRISMA 2020 conventions for a technical corpus, and after a search conducted in two rounds, 84 sources were included from preprint servers, standards repositories, and peer-reviewed venues, with 13 core studies charted in a structured extraction matrix of twelve fields that records the assumption set behind every physical-qubit figure. Results The headline physical-qubit estimate for factoring RSA-2048 fell from about one billion in 2012 to 20 million in 2019, to roughly 900,000 in 2025, and to figures between about 11,000 and 471,000 in 2026 depending on the operating point selected. Estimates for 256-bit elliptic-curve keys followed a comparable path. The reductions are attributable to arithmetic and circuit innovations, magic-state techniques, higher-rate quantum error-correcting codes, and changed architectural and hardware assumptions, and these contributions are decomposed separately here instead of being reported as a single trend. A synthesis restricted to peer-reviewed sources alone yields the same direction of travel but a materially weaker magnitude, and this is reported explicitly. Discussion A reduction in required qubits compresses a resource threshold, not a calendar. Because the relationship between a resource requirement and the date a machine meeting it is built depends on fabrication yield, achieved error rates, connectivity, decoder throughput, control systems, and sustained-runtime engineering, this review presents the consequences for Mosca’s inequality as conditional implications and supports them with scenario analysis across plausible confidentiality lifetimes, migration times, and threat horizons in place of a point forecast. The evidence reduces one barrier to feasibility and widens the uncertainty around the threat horizon; on a risk-management basis, not an evidentiary one, that combination favors prioritized migration of long-lived confidential data.
Large-scale quantum computers threaten the public-key cryptography that protects enterprise data, communications, and digital identity. Shor's algorithm solves integer factorization and discrete logarithms in polynomial time, which would break RSA, Diffie-Hellman, and elliptic-curve schemes once a cryptographically relevant quantum computer exists. The danger is not only future. Adversaries can record encrypted traffic today and decrypt it later, a tactic known as harvest-now-decrypt-later. In August 2024 the U.S. National Institute of Standards and Technology published its first post-quantum standards: FIPS 203 (ML-KEM, derived from CRYSTALS-Kyber), FIPS 204 (ML-DSA, from CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, from SPHINCS+). This paper presents a practical migration framework for enterprises. It reviews the quantum threat and Mosca's inequality for timing the transition, summarizes the new standards with their key and signature sizes, and proposes a five-phase roadmap built on crypto-agility: discovery and inventory, risk prioritization, agility engineering, hybrid deployment, and validation. Performance trade-offs are analyzed using documented parameter sizes and illustrative TLS handshake figures. ML-KEM-768 carries a 1,184-byte public key against 64 bytes for an elliptic-curve key, while SPHINCS+ signatures can exceed 17 kilobytes. The work does not report a real deployment. It consolidates published parameters and field guidance into an actionable plan, and it highlights open challenges in certificate sizing, hardware support, and long-lived embedded systems.
Large-scale quantum computers threaten the public-key cryptography that protects enterprise data, communications, and digital identity. Shor's algorithm solves integer factorization and discrete logarithms in polynomial time, which would break RSA, Diffie-Hellman, and elliptic-curve schemes once a cryptographically relevant quantum computer exists. The danger is not only future. Adversaries can record encrypted traffic today and decrypt it later, a tactic known as harvest-now-decrypt-later. In August 2024 the U.S. National Institute of Standards and Technology published its first post-quantum standards: FIPS 203 (ML-KEM, derived from CRYSTALS-Kyber), FIPS 204 (ML-DSA, from CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, from SPHINCS+). This paper presents a practical migration framework for enterprises. It reviews the quantum threat and Mosca's inequality for timing the transition, summarizes the new standards with their key and signature sizes, and proposes a five-phase roadmap built on crypto-agility: discovery and inventory, risk prioritization, agility engineering, hybrid deployment, and validation. Performance trade-offs are analyzed using documented parameter sizes and illustrative TLS handshake figures. ML-KEM-768 carries a 1,184-byte public key against 64 bytes for an elliptic-curve key, while SPHINCS+ signatures can exceed 17 kilobytes. The work does not report a real deployment. It consolidates published parameters and field guidance into an actionable plan, and it highlights open challenges in certificate sizing, hardware support, and long-lived embedded systems.
The maturation of quantum computing hardware and algorithms has transformed what was once a theoretical concern into an active planning priority for governments, enterprises, and standards bodies. This paper assesses the current and projected threat that quantum computation poses to classical public-key cryptographic standards, namely RSA, elliptic curve cryptography (ECC), and Diffie-Hellman key exchange, all of which derive their security from mathematical problems that Shor's algorithm renders tractable on a sufficiently large fault-tolerant quantum computer. We synthesize recent hardware progress, algorithmic refinements that have substantially reduced estimated qubit requirements, and the finalization of NIST's post-quantum cryptography (PQC) standards (FIPS 203, 204, and 205) to provide an evidence-based assessment of where the field stands as of mid-2026. Particular attention is given to the widening gap between optimistic resource estimates, including a contested March 2026 claim of a thousand-fold reduction in factoring resources, and the practical reality that no existing quantum computer approaches the logical qubit counts required to threaten deployed encryption. We further examine migration challenges, including performance overhead, cryptographic agility, constraints on embedded and IoT systems, and the harvest-now-decrypt-later threat model that makes migration urgency independent of exact timeline predictions. Drawing on NIST transition guidance and recent G7 coordination targets, we argue that organizations should treat cryptographic migration as a present-tense operational requirement rather than a future contingency, regardless of unresolved disagreement among experts about when a cryptographically relevant quantum computer will exist. The paper concludes with practical recommendations for risk-based migration prioritization and identifies open research questions in cryptographic agility and quantum-resistant system design.
This preprint presents a systematic review of how quantum computing impacts the security of classical cryptography and what mitigation strategies are available. The review synthesises key survey papers, standards reports and transition guidelines on post-quantum cryptography (PQC) and quantum-safe security published between 2015 and 2025. First, the paper summarises the impact of Shor’s and Grover’s algorithms on widely deployed public-key schemes, symmetric ciphers and hash functions, highlighting in particular the existential break of RSA, Diffie–Hellman and elliptic-curve cryptography, and the reduced security margins for symmetric and hash-based constructions. It then examines major quantum-resilient responses, including lattice-, code-, multivariate- and hash-based PQC, quantum key distribution (QKD), hybrid classical–PQC schemes and crypto-agile architectures. Building on Mosca’s x, y, z risk-timing model, the review discusses cross-cutting themes such as harvest-now-decrypt-later threats and sector-specific implications for government and defence, finance and blockchain, healthcare, cloud providers and critical infrastructure. It identifies several research gaps, including the lack of quantitative migration-cost data, limited coverage of small and resource-constrained organisations, and few system-scale evaluations comparing PQC-only, hybrid and QKD-based designs. The paper concludes by arguing that planning and investment in quantum-resilient cryptography need to start now, before migration time and data shelf-life push critical systems into the risky regime.
Abstract A cryptographically relevant quantum computer (CRQC) would break the public-key algorithms that protect most digital communication, but the risk does not begin when such a machine is switched on. Under the harvest-now-decrypt-later (HNDL) threat model, an adversary records encrypted traffic now and decrypts it once a CRQC exists, so any data whose confidentiality must outlast the machine’s arrival is exposed from the moment it is transmitted. This scoping review maps documented data-confidentiality lifetimes, charted by data category, against post-quantum migration readiness, documented by custodian sector, and applies Mosca’s inequality to reason about which data categories are most exposed. Following the Arksey and O’Malley framework, Joanna Briggs Institute guidance, and the PRISMA Extension for Scoping Reviews, 42 sources spanning peer-reviewed literature, standards bodies, government documents, and labeled grey literature were charted. Documented confidentiality lifetimes reach decades or are effectively perpetual for national-security records, health and genomic data, biometric identifiers, and privileged legal communications, and span years to decades for financial records. Migration-readiness evidence is uneven: most developed for government and defense and for cross-industry surveys, partial for finance and telecommunications, and largely absent for health care, genomics, and the legal sector. Reasoning through Mosca’s inequality, data categories with multi-decade or indefinite confidentiality requirements are, by that logic, already exposed to HNDL, because credible expert estimates place a meaningful probability of a CRQC within the same horizon; these exposure assessments are reasoned inferences rather than measurements. The central finding is a structural mismatch between long confidentiality obligations and immature migration, compounded by a readiness evidence gap that is itself a risk.
This paper evaluates quantum and AI-accelerated risks to TLS 1.3 cryptographic dependencies under an evidence-tiered model, distinguishing mechanism-backed threats (Shor algorithm against RSA and ECC) from contingency-backed risks to lattice-based post-quantum cryptography (PQC) and hypothesis-only risks to hash-based and symmetric primitives. We do not identify any known breaks of ML-KEM, ML-DSA, SLH-DSA, or AES-256. Instead, we use explicit scenario assumptions, organized as a four-scenario capability model with parameters and pseudocode for reproducibility, to stress-test migration timelines accompanied by parameter sensitivity analysis and explicit falsification analysis. The primary methodological contribution is a reproducible scenario-estimation instrument together with its explicit update mechanics: every parameter is a named, anchored quantity that can be varied and the model rerun; a stated protocol maps observed conformance to, or deviation from, the modeled curves onto revisions of specific parameters, so progressive refinements can be tested against accumulating historical data. The paper is a methodological companion to quantum resource-estimation studies and to expert-elicitation timeline surveys such as the Global Risk Institute quantum threat reports, with its revision rules stated explicitly. As of mid-2026, the model does not show any NIST-approved algorithms as broken. Instead, the vulnerability spectrum under different scenarios shows RSA risk crossing the 50% threshold between 2030-2032 and the PQC risk becoming a non-zero risk after 2032-2035 under contingency scenarios conditional on the unproven dimension-collapse. We urge PQC migration as mandatory per the 2030 and 2031 federal deadlines and by Mosca HNDL reasoning, and that crypto-agility and hybrid cryptographic deployment be considered necessary complements to any PQC migration efforts.