Lecture 17
Cryptographic Impact: Resource Estimates, Q-Day, and the PQC Transition

Week 9  |  what is broken, what is weakened, how to read a resource estimate, and why the migration has to start before the machine exists  |  reading: Gidney (2025), abstract, introduction and conclusion; FIPS 203, §1–3

Lectures 11–16 built the two quantum attacks on cryptography: Grover's quadratic speedup for search, and Shor's polynomial-time algorithms for factoring and discrete logarithms. This lecture, the end of Block II, asks what they mean in practice. By the end you should be able to sort a cryptographic primitive into broken, weakened or believed resistant and say why; list the quantities a resource estimate depends on and read one critically; explain harvest-now-decrypt-later with Mosca's inequality; and describe the NIST post-quantum standards and the migration timeline at the level a policy memo needs.

1 — Broken, weakened, or resistant

The classification follows from the mathematics of the previous lectures, not from the name of the algorithm. Ask: what problem does the primitive's security rest on, and what is the best quantum algorithm for that problem?

Two lessons. First, for public-key schemes based on factoring or discrete logs, no key size helps: Shor's cost grows polynomially, so doubling the key multiplies the attack cost by about 8, not by \(2^{\text{something}}\). The only fix is a different problem. Second, for symmetric schemes the fix is a parameter change: 256-bit keys and 384-bit hashes restore comfortable margins (Lecture 12). HW9 asks you to classify six specific primitives in the same way.

2 — Anatomy of a resource estimate

Today's machines are nowhere near this: the largest gate-based devices have on the order of a hundred to a thousand physical qubits, with two-qubit error rates around \(10^{-3}\) at best, and they run small error-corrected experiments, not long computations. Every claim about Q-Day therefore rests on a resource estimate: a calculation of what a hypothetical machine would need. An estimate has two layers, and you should always know which numbers come from which.

Logical layer (the algorithm, as in Lectures 15–16):

• the number of logical qubits, the error-corrected qubits the algorithm uses;
• the number of non-Clifford gates (Toffoli or \(T\) gates, Lecture 7), which are the expensive ones on an error-corrected machine, and their depth.

Physical layer (the machine and its error-correcting code, Lectures 21–23):

• the physical error rate \(p\) of each gate and measurement;
• the code and its distance \(d\), which set how many physical qubits each logical qubit costs and how small its error is;
• the cycle time (one round of error detection) and the reaction time (how fast classical decoding can feed back into the circuit, which limits how fast \(T\) gates can run in sequence);
• the connectivity (nearest neighbours on a 2-D grid, or long-range links);
• the number of magic-state factories, which produce the \(T\) or Toffoli states, and the routing space between everything.

For the surface code, a useful rule of thumb (Lecture 23 makes it precise) is that each logical qubit costs about \(2d^2\) physical qubits and fails per cycle with probability about \(0.1\,(p/p_{\text{th}})^{(d+1)/2}\), with threshold \(p_{\text{th}}\approx1\%\). The distance must make the whole computation succeed: logical qubits times time steps times the per-step error must stay below, say, 10%. The second code box in Section 8 runs these numbers for 1,000 logical qubits and \(10^9\) steps: at \(p=10^{-3}\) it needs \(d=23\) and about a million physical qubits for the data alone, and at \(p=10^{-4}\) only about a quarter as many. This is not any paper's method, but it shows the structure: the physical error rate enters exponentially, through the distance.

3 — Case study: twenty million qubits, then one million

The most cited estimate for RSA-2048 is Gidney and Ekerå (2019, published in Quantum in 2021). Its assumptions are stated up front, which is the first thing to look for:

• physical gate error rate \(10^{-3}\) (0.1%), uniform across the device;
• surface-code cycle time of 1 μs and a classical reaction time of 10 μs;
• a square grid of qubits with nearest-neighbour connections only.

Under these assumptions they estimated 20 million noisy qubits for 8 hours, down from the hundreds of millions to a billion of earlier estimates. Most of the savings came from the arithmetic: windowed modular exponentiation (looking up several exponent bits at once), oblivious carry runways (cutting long carry chains into short parallel pieces), coset representations of modular integers, and a careful layout of the surface code on the chip.

In 2025 Gidney revised the estimate, keeping the same hardware assumptions: fewer than one million noisy qubits, in less than a week. HW9 asks you to read the paper's abstract, introduction and conclusion and identify the three main ideas behind the reduction. Two observations need no reading:

• The headline is a trade, not only a saving: 20 times fewer qubits, about 20 times longer runtime. Their space–time volumes are almost equal, about \(1.6\times10^8\) and \(1.7\times10^8\) qubit-hours.
• Both are upper bounds on cost under stated assumptions. They say nothing about when hardware meeting those assumptions will exist.

4 — Reading new claims critically

Since 2025 new estimates arrive every few months, many as preprints with press releases. Two from 2026 illustrate the questions to ask.

• Pinnacle (Webster et al., Iceberg Quantum, February 2026, preprint): RSA-2048 with "fewer than one hundred thousand physical qubits, given a physical error rate of \(10^{-3}\), code cycle time of 1 microsecond and a reaction time of 10 microseconds", using quantum LDPC codes instead of the surface code. The error and timing assumptions match Gidney's; the connectivity does not, since LDPC codes need long-range couplings that a nearest-neighbour grid lacks. The runtime is longer, around a month near 100,000 qubits by secondary accounts of the paper's trade-off curve.
• Elliptic curves (Babbush et al., Google Quantum AI with collaborators, March 2026, preprint): 256-bit elliptic-curve discrete logs with fewer than 1,200 logical qubits and fewer than \(9\times10^7\) Toffolis, "in minutes using fewer than half a million physical qubits" at error rate \(10^{-3}\) with planar connectivity. The circuits were not published; a zero-knowledge proof certifies that they exist.

Applying these questions does not mean dismissing the claims. The trend in the figure is real and steep: four orders of magnitude in fifteen years, mostly from better algorithms and codes rather than better hardware. A sensible reading is that the hardware bar is coming down to meet the hardware, and that the date is uncertain.

5 — Harvest now, decrypt later

An adversary can record encrypted traffic today and store it until a CRQC exists. Key exchange is the vulnerable step: once the shared key is recovered from a recorded RSA or Diffie–Hellman handshake, every message protected by that key can be read, years later. Michele Mosca turned this into a simple inequality.

Harvest-now-decrypt-later affects confidentiality, so key exchange and encryption must move first. Signatures are different: a forged signature is only useful while the signature is being checked, so a signature scheme can be replaced up to Q-Day itself. The exceptions are long-lived trust anchors, such as firmware signing keys and root certificates burned into devices that will still be in service when a CRQC exists; those need early attention too.

6 — The migration

NIST ran an open competition from 2016. Its first three post-quantum standards were published in August 2024, and further selections followed.

The timeline. NIST's draft transition plan, IR 8547 (initial public draft, November 2024), proposes that quantum-vulnerable public-key algorithms such as RSA, finite-field and elliptic-curve Diffie–Hellman, ECDSA and EdDSA be deprecated after 2030 and disallowed after 2035 in U.S. federal systems. NIST's SP 800-227 (final, September 2025) gives recommendations for using key-encapsulation mechanisms. Deployment is already widespread for key exchange: major browsers and content-delivery networks negotiate a hybrid of X25519 and ML-KEM-768 by default, and messaging apps such as Signal and iMessage have added post-quantum key agreement.

Hybrid key exchange runs a classical and a post-quantum key exchange together and derives the session key from both, so an attacker must break both. It protects against a quantum computer (through ML-KEM) and against an unexpected classical break of the young post-quantum scheme (through X25519). Crypto-agility means building systems so that algorithms can be replaced by configuration rather than by redesign; the main lesson of the RSA-to-ECC and SHA-1 transitions was how long it takes without it.

7 — What a lattice scheme looks like

ML-KEM's security rests on learning with errors (LWE; Regev, 2005). Pick a prime modulus \(q\), a secret vector \(s\in\mathbb Z_q^n\), and publish many noisy linear equations:

where \(A\) is a public random \(m\times n\) matrix and \(e\) is a vector of small random errors. Without \(e\) this is linear algebra: Gaussian elimination recovers \(s\) in polynomial time. With \(e\), elimination mixes the errors together until they fill the whole range mod \(q\), and the best known algorithms, classical or quantum, take time exponential in \(n\). ML-KEM uses a structured version (Module-LWE, with \(n=256\)-coefficient polynomials and \(q=3329\)) for efficiency.

The connection to Lecture 16: Regev's reduction relates such lattice problems to the dihedral hidden subgroup problem, where Fourier sampling has not led to an efficient algorithm. LWE is the problem behind most of the new standards because it has survived that line of attack, has worst-case to average-case reductions, and is fast in practice.

8 — Try it in code

import itertools
import numpy as np

q, n, m = 17, 3, 6                                   # modulus, secret length, number of equations
rng = np.random.default_rng(17)
A = rng.integers(0, q, size=(m, n))                  # public random matrix
s = np.array([5, 11, 2])                             # the secret
e = rng.integers(-1, 2, size=m)                      # small errors in {-1, 0, 1}
b = (A @ s + e) % q                                  # public: (A, b)

def solve_mod(A, b, q):
    """Gauss-Jordan elimination mod a prime q; returns (solution from the first n pivots, leftover residuals)"""
    M = np.concatenate([A % q, (b % q)[:, None]], axis=1).astype(int); rows, cols = M.shape; r = 0
    for c in range(cols - 1):
        piv = next((i for i in range(r, rows) if M[i, c] % q), None)
        if piv is None: continue
        M[[r, piv]] = M[[piv, r]]; M[r] = M[r] * pow(int(M[r, c]), -1, q) % q
        for i in range(rows):
            if i != r and M[i, c]: M[i] = (M[i] - M[i, c] * M[r]) % q
        r += 1
    return M[:cols - 1, -1], M[cols - 1:, -1]

sol, res = solve_mod(A, (A @ s) % q, q)
print("without errors: elimination gives", sol, " leftover equations consistent:", not res.any())
sol, res = solve_mod(A, b, q)
print("with errors:    elimination gives", sol, " leftover residuals:", res, "(inconsistent)")

centered = lambda v: (v + q // 2) % q - q // 2      # represent residues in -8..8
best = min(itertools.product(range(q), repeat=n), key=lambda c: np.abs(centered(A @ np.array(c) - b)).sum())
print(f"brute force over all {q**n} candidates finds", list(best), "(the secret is", s.tolist(), ")")

without errors: elimination gives [ 5 11  2]  leftover equations consistent: True
with errors:    elimination gives [ 3 15  3]  leftover residuals: [5 9 4] (inconsistent)
brute force over all 4913 candidates finds [5, 11, 2] (the secret is [5, 11, 2] )

# A back-of-envelope surface-code budget (illustrative rule of thumb; real estimates are far more detailed)
def distance(p, p_th=1e-2, target=1e-13):
    """smallest odd d with logical error per qubit per step 0.1 (p/p_th)^((d+1)/2) <= target"""
    d = 3
    while 0.1 * (p / p_th) ** ((d + 1) / 2) > target * (1 + 1e-9):
        d += 2
    return d

L, D = 1000, 1e9                       # logical qubits, logical time steps
target = 0.1 / (L * D)                 # allow a 10% chance that anything fails
for p in (1e-3, 3e-4, 1e-4):
    d = distance(p, target=target)
    print(f"physical error {p:.0e}: distance {d:2d}, about {2 * d * d:5d} physical per logical, "
          f"{2 * d * d * L / 1e6:.2f} million physical qubits (data only, no magic-state factories)")

physical error 1e-03: distance 23, about  1058 physical per logical, 1.06 million physical qubits (data only, no magic-state factories)
physical error 3e-04: distance 15, about   450 physical per logical, 0.45 million physical qubits (data only, no magic-state factories)
physical error 1e-04: distance 11, about   242 physical per logical, 0.24 million physical qubits (data only, no magic-state factories)

9 — Summary and exercises

Reading and sources

• C. Gidney, "How to factor 2048 bit RSA integers with less than a million noisy qubits", preprint 2025 (arXiv:2505.15917); C. Gidney and M. Ekerå, "How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits", Quantum 5, 433 (2021) (arXiv:1905.09749).
• P. Webster et al., "The Pinnacle Architecture: reducing the cost of breaking RSA-2048 to 100 000 physical qubits using quantum LDPC codes", preprint 2026 (arXiv:2602.11457); secondary discussion of its runtime trade-offs: PostQuantum.com.
• R. Babbush et al., "Securing elliptic curve cryptocurrencies against quantum vulnerabilities: resource estimates and mitigations", preprint 2026 (arXiv:2603.28846).
• NIST, FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA), August 2024; NIST IR 8547 (initial public draft), "Transition to Post-Quantum Cryptography Standards", November 2024; NIST SP 800-227, "Recommendations for Key-Encapsulation Mechanisms", September 2025; NIST IR 8545 (HQC selection), March 2025. News and documents: NIST PQC project.
• M. Mosca, "Cybersecurity in an era with quantum computers: will we be ready?", IEEE Security & Privacy 16(5) (2018).
• O. Regev, "On lattices, learning with errors, random linear codes, and cryptography", STOC 2005 / J. ACM 56 (2009).

all computed numbers and figures in these notes come from python (verify_L17.py); estimates are quoted from the cited papers; standards status as of October 2026