CRQC Timeline: A Cryptography Engineer's Perspective

Update 2026-05-10: Two concurrent independent papers on PQ-WireGuard landed since this writeup — Hashimoto et al. (pq-wireguard-revisited, IACR 2025/1758) introduce the reinforcing KEM primitive that shrinks server long-term-PK memory 190–390×, and Lafourcade et al. (hybrid-wireguard, USENIX Security 2025) provide a SAPIC+-verified hybrid construction with a Rust implementation. Both fix a UKS attack on the original Hülsing PQ-WireGuard. See pq-wireguard for the comparison. VPN protocol PQ migration is now a near-deployable story, not a research one.

Filippo Valsorda — Go's former crypto lead, now independent cryptography engineer and professor at University of Bologna — announces a major shift in his assessment of quantum threats. Two April 2026 papers collapsed the timeline for cryptographically relevant quantum computers, and Google's own cryptographers set a 2029 deadline for migration to post-quantum-cryptography. Valsorda's post lays out what needs to change and how fast.

The papers that changed the math

Google's paper dramatically reduced the estimated logical qubits and gates needed to break 256-bit elliptic curves (NIST P-256, secp256k1). The revised numbers make attacks feasible in minutes on superconducting qubit architectures. The practical implication: real-time WebPKI man-in-the-middle attacks become possible — intercept a TLS handshake, break the ECDH key exchange, read the traffic.

Oratomic's paper showed 256-bit curves breakable with as few as 10,000 physical qubits using neutral atom architectures with non-local connectivity, which enables better error correction. It's slower — maybe one key per month — but even that rate is catastrophic. One broken CA certificate per month breaks the entire web PKI trust model.

Google's Heather Adkins and Sophie Schmieg set 2029 as the migration deadline — 33 months from publication. This is the first aggressive public timeline from major cryptographic authorities. The "10 years away for 30 years" joke no longer applies.

Valsorda references Scott Aaronson's observation that quantum computing research may be entering a "1939–1940 moment" — the period when nuclear fission publications suddenly went quiet because the work became classified. If breakthroughs are happening behind closed doors, public timelines are lagging.

Risk reframing

Instead of asking "will CRQCs exist by 2030?", Valsorda asks: "are you 100% sure they WON'T?" You can't bet user security on contrarian skepticism. Even if CRQCs remain unlikely, the consequence of being wrong is total compromise of public-key cryptography. The burden of proof falls on those who want to delay migration.

What to migrate

Key exchange → ml-kem

ML-KEM (formerly Kyber) migration is progressing. But any system still doing non-post-quantum key exchange is now a potential active compromise vector — not just a future risk. Valsorda argues browsers and TLS libraries should warn users on non-PQ connections the way they warn on HTTP today.

Non-interactive key exchanges (NIKEs) should be deprioritized. The post-quantum toolkit only has KEMs (interactive key encapsulation). Protocols that depend on NIKEs (like some messaging protocols) need architectural changes, not just algorithm swaps.

Signatures → ml-dsa

Immediate transition to pure ML-DSA-44 (formerly Dilithium). Valsorda argues against hybrid schemes that combine classical + post-quantum signatures:

• Hybrid signatures waste implementation time and add complexity
• Two years of Kyber/ML-KEM deployment has built confidence in Module-Lattice math
• The composite signature standards produced 18+ types, creating interoperability friction
• Every month spent on hybrid is a month not spent on pure PQ

Symmetric encryption → no changes needed

A common misconception is that Grover's algorithm halves symmetric key strength, requiring a jump to 256-bit keys. Valsorda says this is oversimplified. Actually breaking 128-bit keys via Grover requires a quantum circuit of size 2^106. No algorithmic progress has been made on this in decades. AES-128 and ChaCha20 are fine.

TEEs → critically undermined

Intel SGX, AMD SEV-SNP, and hardware attestation systems rely on classical cryptography for their trust chains. There are no PQ-resistant alternatives in the deployment pipeline. TEEs should be downgraded to a defense-in-depth role — useful but no longer a trust boundary.

store-now-decrypt-later

Encrypted data captured today can be decrypted once CRQCs arrive. This makes file encryption urgent even before CRQCs exist — adversaries with storage capacity are presumably already archiving encrypted traffic. The age encryption tool added PQ recipients in version 1.3.0, but ecosystem adoption is just starting.

Identity systems → migrate or brick

Blockchain systems and protocols like atproto depend on classical public-key cryptography for identity. If CRQCs arrive before migration completes, the choice is between user compromise (keys are broken) or system bricking (reject all classical signatures, invalidating every existing identity).

Implementation confidence

Valsorda trusts ML-KEM and ML-DSA based on:

• Expert mathematical consensus on lattice security (citing Sophie Schmieg's assessment)
• NSA approval at Top Secret classification level
• Implementation simplicity — lattice algorithms are easier to implement correctly than ECC
• Better testing infrastructure catching more implementation bugs

Ecosystem impact

"Half the cryptography packages in the Go standard library" become insecure simultaneously. Previous migrations (SHA-1 → SHA-256) were gradual and SHA-1 retained utility for non-collision-resistant uses (HMAC, HKDF). This migration has no such fallback — RSA and ECDSA become fully broken, not merely weakened.

Valsorda's new PhD course at Bologna teaches RSA, ECDSA, and ECDH exclusively as legacy algorithms. The next generation of cryptographers will learn post-quantum first.