Why We Need Quantum-Safe Security Today, Not in 2030

“Powerful quantum computers are still a decade away, why worry now?” I hear this reaction often when the topic of quantum threats to encryption comes up, and it is a fairly dangerous misunderstanding. The timeline below explains why.

From theory to a real threat

The story starts in the 1980s, when Richard Feynman and David Deutsch laid the theoretical groundwork for quantum computation. The original idea was fairly simple: use a quantum system to simulate other quantum systems, a task classical computers handle very inefficiently.

The real turning point came in 1994, with Shor’s algorithm. It proved, at least in theory, that a sufficiently powerful quantum computer could factor large integers in polynomial time, while a classical computer needs exponential time for the same task. This genuinely shook the cryptography community, because RSA’s security, along with many other public-key schemes, rests entirely on integer factorization being computationally hard.

In 2019, Google announced Sycamore, demonstrating what is called quantum supremacy: completing a specific computation far faster than the most powerful classical supercomputer of the time. That computation had no practical use, but it was hardware proof that quantum computing was actually advancing, not just a theoretical exercise. Several industry and academic roadmaps now place 2030 to 2035 as the window in which quantum computers could have enough qubits and enough error correction to run Shor’s algorithm at a scale that breaks widely deployed RSA and ECC keys.

What RSA and AES actually depend on

Nearly all of today’s digital security, from HTTPS and VPNs to online banking and digital signatures, depends on the computational hardness of two problems: factoring large integers for RSA, and the discrete logarithm problem on elliptic curves for ECC. On a classical computer, both problems are practically unsolvable within any useful timeframe. Shor’s algorithm breaks precisely that assumption, not because RSA or ECC are weak, but because the underlying computational model changes entirely.

AES, a symmetric cipher, is far less affected. Grover’s algorithm only speeds up brute-force search by a square root factor, so doubling the key length, using AES-256 instead of AES-128, is enough to compensate. RSA and ECC are where the real vulnerability sits.

Harvest now, decrypt later

This is why the quantum threat is not a distant problem. An attacker with resources, whether a nation-state or a well-funded organization, can harvest and store encrypted data right now, even without being able to read it, and simply wait until a quantum computer capable of decrypting it exists.

This strategy is especially dangerous for data with long-term value: medical records, defense secrets, intellectual property, sensitive financial information. If a piece of data needs to stay protected for the next fifteen or twenty years, waiting until quantum computers actually arrive before taking action is already too late. Data harvested today may already be sitting in an attacker’s hands, waiting for its decryption day.

This is the motivation behind two lines of defense being developed in parallel today: Post-Quantum Cryptography, which upgrades software on infrastructure that already exists, and Quantum Key Distribution, which builds security infrastructure grounded in physical law itself. I break down the differences and the complementary role of each in PQC vs. QKD: Two Lines of Defense Against Quantum Computers.