# A Cryptography Engineer's Perspective on Quantum Computing Timelines

# A Cryptography Engineer's Perspective on Quantum Computing Timelines

**By Filippo Valsorda**
**Published: April 6, 2026**

Source: https://words.filippo.io/crqc-timeline

---

Valsorda announces a significant shift in his assessment of quantum computing threats to cryptography. Recent research papers have dramatically accelerated timelines for cryptographically-relevant quantum computers (CRQCs), prompting urgent migration to post-quantum cryptography standards.

## Key Developments

Two major papers published in early April 2026 prompted this reassessment:

1. Google's Research: Dramatically revised estimates downward for logical qubits and gates needed to break 256-bit elliptic curves (NIST P-256, secp256k1), making attacks feasible in minutes on superconducting qubit architectures. The critical implication involves practical WebPKI man-in-the-middle attacks.

2. Oratomic Paper: Demonstrated 256-bit elliptic curves breakable with as few as 10,000 physical qubits using non-local connectivity (neutral atoms), leveraging superior error correction. While slower, even one broken key monthly poses catastrophic risk.

## Timeline Urgency

Google's Heather Adkins and Sophie Schmieg set an aggressive deadline of 2029 — 33 months away — for quantum migration. This marks the first such aggressive public timeline from major cryptographic authorities.

Valsorda notes: "quantum frontiers may be closer than they appear" and references Scott Aaronson's comparison to nuclear fission research suddenly halting in public between 1939-1940 as an indicator of imminent breakthroughs.

The joke that quantum computers have been "10 years away for 30 years" no longer applies — timelines have begun advancing measurably.

## Risk Assessment Framework

Rather than debating certainty of CRQC arrival, Valsorda reframes the question: "are you 100% sure a CRQC will NOT exist in 2030?" He argues this shifts burden appropriately: decision-makers cannot responsibly bet users' security on contrarian skepticism.

## Concrete Migration Requirements

### Asymmetric Cryptography

Key Exchange: ML-KEM migration progressing adequately, but any non-post-quantum key exchange now constitutes potential active compromise. Non-interactive key exchanges (NIKEs) should be deprioritized; only KEMs available in current PQ toolkit.

Authentication: Immediate transition to pure ML-DSA-44 without hybrid classical schemes. Rationale: hybrid signatures waste precious implementation time and complexity budget. Two years of Kyber deployment has built significant confidence in Module-Lattice schemes. Composite signature standards (18+ types) introduce interoperability friction.

### Symmetric Encryption

No changes required. Common misconceptions about Grover's algorithm requiring 256-bit keys rest on oversimplified analysis. Actual security characterization: breaking 128-bit keys via Grover requires circuit size of 2^106 — no algorithmic progress achieved despite decades of research.

### Hardware & Infrastructure

TEEs (Intel SGX, AMD SEV-SNP) and hardware attestation systems critically undermined. No PQ-resistant alternatives in deployment pipeline. Must downgrade to defense-in-depth role only.

Cryptographic Identity Ecosystems: Platforms like atproto and blockchain systems must migrate immediately. CRQC arrival before migration completion forces choosing between user compromise or system bricking.

File Encryption: Store-now-decrypt-later attacks create urgency. PQ recipients only recently added to age (version 1.3.0).

## Implementation Confidence

Valsorda expresses qualified confidence in ML-KEM and ML-DSA based on: expert mathematical consensus, NSA approval at Top Secret classification level, implementation accessibility (lattice algorithms simpler to implement securely than ECC), and enhanced testing infrastructure.

## Ecosystem Impact

Go standard library faces unprecedented upheaval: "half the cryptography packages in the Go standard library" becoming insecure simultaneously. Previous migrations (SHA-1 to SHA-256) pale in comparison.

Teaching implications: Valsorda's new PhD cryptography course at University of Bologna treats RSA, ECDSA, and ECDH exclusively as legacy algorithms.