Quantum Computing Cryptography FAQ: 20+ Questions Answered

This quantum computing cryptography FAQ answers more than 20 of the most-asked questions on how quantum computers threaten classical encryption, which algorithms are at risk, what NIST's post-quantum standards mean in practice, and how crypto holders and developers can prepare. Whether you are a developer evaluating migration paths, an investor assessing portfolio risk, or a curious reader who heard the phrase "Q-day" and wants a clear explanation, you will find accurate, mechanism-level answers below — no hype, no hand-waving.

Part 1: Quantum Computing Fundamentals

What is a quantum computer, and how does it differ from a classical computer?

A classical computer stores information as bits — each bit is either 0 or 1. A quantum computer uses qubits, which exploit two quantum-mechanical properties:

• Superposition: A qubit can represent 0 and 1 simultaneously until it is measured.
• Entanglement: Two or more qubits can be correlated so that the state of one instantly constrains the state of another, regardless of distance.

These properties allow a quantum computer to evaluate a vast number of possible solutions to certain problems in parallel, rather than sequentially. This does not make quantum computers universally faster — they offer specific, dramatic speedups for specific mathematical problem types.

What kinds of mathematical problems can quantum computers solve faster?

Quantum computers provide provable or theoretical speedups for:

The first three rows cover almost every cryptographic primitive in widespread use today — RSA, Diffie-Hellman, and ECDSA (used by Bitcoin and Ethereum).

How many qubits does a quantum computer need to break RSA-2048?

Academic estimates cluster around 4,000 logical (error-corrected) qubits to break RSA-2048 using Shor's algorithm in a reasonable timeframe. Because current hardware operates with noisy physical qubits rather than perfect logical qubits, you need roughly 1,000 physical qubits per logical qubit under leading error-correction schemes — implying millions of physical qubits. As of 2025, the largest publicly disclosed systems have reached thousands of physical qubits, but without the error-correction depth required. The gap remains real, though the trajectory is shortening.

---

Part 2: Threats to Classical Cryptography

Which encryption algorithms are directly broken by Shor's algorithm?

Shor's algorithm efficiently solves the integer factorisation problem and the discrete logarithm problem, which underpin:

• RSA (all key sizes)
• DSA and Diffie-Hellman (finite-field variants)
• ECDSA, ECDH, EdDSA (elliptic-curve variants)

These algorithms protect the majority of TLS connections, SSH sessions, code-signing certificates, hardware security modules, and cryptocurrency transaction signing.

Is AES (symmetric encryption) also broken by quantum computers?

Not directly. Grover's algorithm can search an unstructured space in O(√N) operations, which effectively halves the security level of a symmetric cipher. AES-128 drops to roughly 64-bit effective security. The mitigation is straightforward: upgrade to AES-256, which retains approximately 128-bit post-quantum security. NIST considers 128-bit quantum security adequate for most applications.

What is "Q-day"?

Q-day is the colloquial term for the date on which a sufficiently powerful, error-corrected quantum computer first runs Shor's algorithm against a real-world RSA or ECDSA key and recovers the private key in practical time. No credible public estimate pins Q-day before the early 2030s, and many researchers place it in the 2030–2040 window. The uncertainty itself is the risk: organisations that have not migrated by Q-day will be exposed immediately.

What is the "harvest now, decrypt later" attack?

Adversaries — typically state-level actors — can intercept and store encrypted traffic or signed data today, at low cost, and decrypt it once a cryptographically-relevant quantum computer exists. For long-lived secrets (classified documents, blockchain keys with large balances, private health records), the threat timeline is not Q-day minus some migration window — it is *right now*. CISA, NSA, and the UK NCSC have all published advisories urging immediate inventory and migration planning on this basis.

Are Bitcoin and Ethereum wallets vulnerable?

Yes, under the following conditions:

1. Reused addresses: If a wallet's public key has been published on-chain (which happens when you spend from an address), Shor's algorithm can derive the private key from the public key. Bitcoin P2PK outputs and early P2PKH addresses where the public key is visible are directly at risk once a cryptographically-relevant quantum computer exists.
2. Unspent outputs with exposed public keys: P2WPKH outputs do not expose the public key until the first spend. Funds that have never signed a transaction are somewhat better protected — though not indefinitely.
3. Time-in-mempool attacks: A fast enough quantum computer could derive a private key from a public key during the window between broadcast and confirmation. Current block times (10 minutes for Bitcoin) impose a tight but potentially feasible attack window once hardware matures sufficiently.

Ethereum uses ECDSA on the secp256k1 curve — same vulnerability profile as Bitcoin.

---

Part 3: Post-Quantum Cryptography (PQC)

What is post-quantum cryptography?

Post-quantum cryptography (PQC) refers to classical (non-quantum) cryptographic algorithms that are believed to be secure against both classical and quantum adversaries. These algorithms run on ordinary hardware and do not require quantum communication infrastructure. They replace the vulnerable asymmetric primitives (RSA, ECDSA) with problems for which no efficient quantum algorithm is known.

What mathematical problems do post-quantum algorithms rely on?

The main families are:

• Lattice-based: Hard problems include Learning With Errors (LWE), Ring-LWE, and Short Integer Solution (SIS). These underpin NIST's primary PQC standards.
• Hash-based: Security reduces solely to the properties of a cryptographic hash function. XMSS and SPHINCS+ are examples.
• Code-based: Relies on the hardness of decoding random linear codes (McEliece, 1978). Very large key sizes.
• Multivariate polynomial: Solving systems of multivariate quadratic equations over finite fields.
• Isogeny-based: Was considered promising; SIDH/SIKE was broken classically in 2022, largely removing this family from contention.

What did NIST standardise in its PQC process?

NIST completed its multi-year post-quantum standardisation process and published three final standards in August 2024:

A fourth standard, FN-DSA (FALCON), was finalised shortly after. NIST explicitly recommends organisations begin transitioning to these algorithms now.

What is lattice-based cryptography, specifically?

A lattice is a regular grid of points in high-dimensional space. The hard problem underpinning lattice cryptography is that, given a "bad" (non-orthogonal) basis for a lattice, finding the shortest vector or a vector closest to a given point is computationally infeasible at high dimensions — even for quantum computers. The best known quantum algorithms (including variants of the quantum approximate optimisation algorithm) offer negligible advantage over classical algorithms for well-parameterised lattice problems. This is why lattice schemes form the core of NIST's PQC standards.

How do ML-KEM (Kyber) key sizes compare to RSA?

The larger key and ciphertext sizes are acceptable for most applications. Network bandwidth and storage overhead are modest at modern speeds.

---

Part 4: Migration, Implementation, and Crypto Asset Implications

What is "hybrid cryptography" and why is it recommended during migration?

Hybrid cryptography combines a classical algorithm (e.g., ECDH) with a post-quantum algorithm (e.g., ML-KEM) in a single key exchange or signature scheme. The combined security is at least as strong as the stronger of the two components. NIST, ETSI, and the BSI (German federal cybersecurity agency) all recommend hybrid schemes during the transition period, because:

• PQC algorithms are newer and have shorter cryptanalytic track records.
• A flaw discovered in the PQC component would not expose data if the classical component remains unbroken.
• Hybrid deployments allow progressive rollout without abandoning battle-tested primitives prematurely.

How should developers begin migrating to post-quantum standards?

A practical migration checklist:

1. Inventory: Catalogue every place asymmetric cryptography is used — TLS certificates, code-signing, API authentication, key derivation, and data-at-rest encryption.
2. Prioritise by data lifetime: Long-lived secrets and high-value keys migrate first.
3. Adopt hybrid schemes in TLS: Modern versions of OpenSSL and BoringSSL support X25519+ML-KEM hybrid key exchange. Enable it in your server configuration.
4. Replace signature schemes: Evaluate ML-DSA or FALCON for JWT signing, document signing, and firmware attestation.
5. Update certificate pipelines: Work with your CA to obtain ML-DSA certificates when the Web PKI supports them.
6. Test performance: Benchmark on your target hardware. Lattice signatures are larger; hash-based signatures (SLH-DSA) are slower to generate but fast to verify.
7. Engage hardware vendors: HSMs and smart cards need firmware or hardware updates to support new algorithms.

What does post-quantum security mean for cryptocurrency wallets?

A post-quantum cryptocurrency wallet replaces ECDSA key generation and transaction signing with a PQC-aligned scheme — typically a lattice-based digital signature algorithm such as ML-DSA or FALCON. This ensures that even if a cryptographically-relevant quantum computer is available, an adversary cannot derive a private key from the on-chain public key. Projects building such wallets face two compounding challenges: selecting algorithms with sufficient cryptanalytic maturity and maintaining compatibility with existing blockchain transaction formats.

BMIC.ai is one example of a project building a quantum-resistant wallet using lattice-based, NIST PQC-aligned cryptography, targeting exactly this threat surface for token holders.

Can existing Bitcoin or Ethereum holdings be "migrated" to quantum-safe addresses?

In principle, yes, for any blockchain that supports a soft or hard fork to new signature schemes. Practically:

• Bitcoin: The Bitcoin community has discussed P2QRH (Pay to Quantum-Resistant Hash) proposals, but no BIP has been merged. Migration would require users to voluntarily move funds to new address types.
• Ethereum: The Ethereum Foundation has acknowledged the quantum threat. EIP proposals for quantum-safe account abstraction (e.g., EIP-7573 and related drafts) are under active discussion.
• User action: Until protocol-level migration ships, the safest near-term step is to use addresses whose public keys have never been published on-chain, and to move funds promptly after each spend.

Is quantum key distribution (QKD) the same as post-quantum cryptography?

No. They are distinct approaches:

• Quantum Key Distribution (QKD) uses the physical properties of quantum particles (photons) to establish a shared secret. Any eavesdropping disturbs the quantum state and is detectable. QKD requires specialised optical hardware and is currently limited to point-to-point links of a few hundred kilometres without trusted repeaters.
• Post-Quantum Cryptography (PQC) uses classical mathematics on classical hardware, but selects hard problems that quantum computers cannot solve efficiently. PQC requires no new hardware and can be deployed as a software update.

For internet-scale and blockchain applications, PQC is the practical migration path. QKD is relevant for high-security government and financial backbone links.

How long does it realistically take an organisation to complete a PQC migration?

CISA's 2023 guidance estimates five to fifteen years for large organisations with complex legacy systems. Key variables include:

• Number of distinct cryptographic dependencies
• Hardware refresh cycles (embedded systems, smart cards, network gear)
• Regulatory certification requirements (e.g., FIPS validation for government use)
• Supply-chain and vendor readiness

Given the "harvest now, decrypt later" threat, the recommended posture is to begin immediately with highest-priority systems, even if full migration takes years.

Are there any known attacks against NIST's finalised PQC algorithms?

As of mid-2025, no practical attacks against ML-KEM, ML-DSA, SLH-DSA, or FN-DSA have been published. However:

• Kyber (ML-KEM) and Dilithium (ML-DSA) have been subjected to extensive public cryptanalysis since their submission in 2017. No structural weaknesses have survived.
• Side-channel attacks (timing, power analysis) against naive implementations remain a concern. Use vetted, constant-time implementations from libraries such as liboqs, Bouncy Castle PQC, or the CIRCL library.
• Parameter selection matters: using NIST security level 1 (128-bit quantum security) is adequate for most commercial applications; level 3 (192-bit) or level 5 (256-bit) for high-assurance use cases.

---

Part 5: Staying Current

Where can I track the latest PQC developments?

• NIST PQC project page: csrc.nist.gov/projects/post-quantum-cryptography
• IETF PQC working groups: Drafts for hybrid TLS, X.509 PQC certificates, and OpenPGP PQC
• ETSI Quantum Safe Cryptography (QSC) working group: Enterprise and telecom migration guidance
• Open Quantum Safe project (openquantumsafe.org): Open-source liboqs library and test integrations
• CISA Post-Quantum Cryptography Initiative: US-government-focused migration advisories and roadmaps

Monitoring IETF draft publication and NIST special publications (SP 800-208 for hash-based signatures, forthcoming SP 800-227 for KEM guidance) is the most reliable way to stay current with production-ready recommendations.