A Cryptography Engineer's Perspective on Quantum Computing Timelines

By Filippo Valsorda Published: April 6, 2026

Source: https://words.filippo.io/crqc-timeline

Valsorda announces a significant shift in his assessment of quantum computing threats to cryptography. Recent research papers have dramatically accelerated timelines for cryptographically-relevant quantum computers (CRQCs), prompting urgent migration to post-quantum cryptography standards.

Key Developments

Two major papers published in early April 2026 prompted this reassessment:

Google's Research: Dramatically revised estimates downward for logical qubits and gates needed to break 256-bit elliptic curves (NIST P-256, secp256k1), making attacks feasible in minutes on superconducting qubit architectures. The critical implication involves practical WebPKI man-in-the-middle attacks.
Oratomic Paper: Demonstrated 256-bit elliptic curves breakable with as few as 10,000 physical qubits using non-local connectivity (neutral atoms), leveraging superior error correction. While slower, even one broken key monthly poses catastrophic risk.

Timeline Urgency

Google's Heather Adkins and Sophie Schmieg set an aggressive deadline of 2029 — 33 months away — for quantum migration. This marks the first such aggressive public timeline from major cryptographic authorities.

Valsorda notes: "quantum frontiers may be closer than they appear" and references Scott Aaronson's comparison to nuclear fission research suddenly halting in public between 1939-1940 as an indicator of imminent breakthroughs.

The joke that quantum computers have been "10 years away for 30 years" no longer applies — timelines have begun advancing measurably.

Risk Assessment Framework

Rather than debating certainty of CRQC arrival, Valsorda reframes the question: "are you 100% sure a CRQC will NOT exist in 2030?" He argues this shifts burden appropriately: decision-makers cannot responsibly bet users' security on contrarian skepticism.

Concrete Migration Requirements

Asymmetric Cryptography

Key Exchange: ML-KEM migration progressing adequately, but any non-post-quantum key exchange now constitutes potential active compromise. Non-interactive key exchanges (NIKEs) should be deprioritized; only KEMs available in current PQ toolkit.

Authentication: Immediate transition to pure ML-DSA-44 without hybrid classical schemes. Rationale: hybrid signatures waste precious implementation time and complexity budget. Two years of Kyber deployment has built significant confidence in Module-Lattice schemes. Composite signature standards (18+ types) introduce interoperability friction.

Symmetric Encryption

No changes required. Common misconceptions about Grover's algorithm requiring 256-bit keys rest on oversimplified analysis. Actual security characterization: breaking 128-bit keys via Grover requires circuit size of 2^106 — no algorithmic progress achieved despite decades of research.

Hardware & Infrastructure

TEEs (Intel SGX, AMD SEV-SNP) and hardware attestation systems critically undermined. No PQ-resistant alternatives in deployment pipeline. Must downgrade to defense-in-depth role only.

Cryptographic Identity Ecosystems: Platforms like atproto and blockchain systems must migrate immediately. CRQC arrival before migration completion forces choosing between user compromise or system bricking.

File Encryption: Store-now-decrypt-later attacks create urgency. PQ recipients only recently added to age (version 1.3.0).

Implementation Confidence

Valsorda expresses qualified confidence in ML-KEM and ML-DSA based on: expert mathematical consensus, NSA approval at Top Secret classification level, implementation accessibility (lattice algorithms simpler to implement securely than ECC), and enhanced testing infrastructure.

Ecosystem Impact

Go standard library faces unprecedented upheaval: "half the cryptography packages in the Go standard library" becoming insecure simultaneously. Previous migrations (SHA-1 to SHA-256) pale in comparison.

Teaching implications: Valsorda's new PhD cryptography course at University of Bologna treats RSA, ECDSA, and ECDH exclusively as legacy algorithms.