Myths And Facts About The Quantum Threat

Discussion of quantum computing and security swings between two poles. One camp says all encryption is about to collapse. The other says the whole issue is decades off and safe to ignore. Both positions lead to poor decisions, and both contain claims that public guidance from security agencies contradicts.

This article takes six beliefs that come up often in boardrooms and project meetings and checks each against primary sources. The table gives the short version; the sections below explain the reasoning.

Myth 1: Quantum Computers Will Break AES

Grover’s search algorithm gives a quantum computer at most a square-root speed-up against brute-force key search.¹ That weakens symmetric ciphers but does not break them. NIST’s draft transition guidance says its symmetric standards are significantly less exposed to quantum attack than public-key ones, and that it does not expect to move away from them as part of this transition. Only a few 112-bit options will be disallowed, in 2030.² The Shor And Grover article explains why.

Myth 2: Longer RSA Keys Will Keep Us Safe

This is the mirror image of the first myth. Doubling a symmetric key restores its margin, so it is tempting to assume the same for RSA. It does not work. Shor’s algorithm solves factoring and discrete logarithms in polynomial time, so the cost grows modestly as keys grow.³ NIST’s plan treats every RSA, Diffie-Hellman and elliptic curve key size as quantum-vulnerable, with all of them proposed for disallowance after 2035 regardless of strength.²

Myth 3: Quantum Key Distribution Is The Answer

Quantum key distribution (QKD) uses quantum physics, sent over special equipment and dedicated links, to share keys in a way that can reveal an eavesdropper.⁴ It is real and it works over suitable links. The question is whether it is the right defence against quantum computers, and the agencies that have published positions say no.

The UK National Cyber Security Centre, in a paper published in August 2025, points out that QKD provides no authentication on its own, says it will not support QKD for government or military use, and names post-quantum cryptography as the best mitigation.⁵ In January 2024 France’s ANSSI, Germany’s BSI, the Netherlands’ NLNCSA and Sweden’s National Communications Security Authority published a joint position paper. The four agencies judge that QKD is too restricted and too immature for general use. In their view it fits only a few specialised cases, it cannot run without its own physical network, and its security has not yet been proven to the level they would want, so organisations should put post-quantum cryptography first.⁶

Myth 4: The Threat Is Certainly Decades Away

Nobody can give a date, and claiming certainty in either direction is the mistake. The most recent Global Risk Institute survey, published in March 2026, found experts rate a cryptographically relevant quantum computer within 10 years as quite possible, at 28 to 49 percent, and within 15 years as likely, at 51 to 70 percent. The report says expert timelines have accelerated compared with earlier editions.⁷

Engineering estimates point the same way. In 2019 Gidney and Ekerå estimated that RSA-2048 could be factored in eight hours with 20 million noisy qubits. In 2025 Gidney cut that to under one million qubits in under a week.⁸ Neither figure describes a machine that exists, but the trend is downward. The Q-Day article shows how to plan under this uncertainty.

Myth 5: Nothing Needs Doing Until A Quantum Computer Exists

Two facts undercut this. The first is harvest now, decrypt later: data recorded today can be read once a quantum computer exists, so long-lived secrets are exposed already.² The second is time. NIST notes that past cryptographic migrations took more than a decade.² Governments have set dates accordingly. NIST proposes deprecating 112-bit public-key algorithms after 2030 and disallowing all quantum-vulnerable ones after 2035,² and the NCSC asks organisations to finish discovery and planning by 2028.⁹ Details are in What Governments Expect.

Myth 6: Signatures Face The Same Harvest Risk As Encryption

Signatures and encryption face different risks. A forged signature only helps if it is produced and accepted while it still matters, which needs a quantum computer at that moment. NIST notes that, unlike encryption, authentication stays secure as long as the algorithms are secure when the check happens.² A login that finished years ago cannot be forged after the event. Signed documents and software that must still be trusted years from now are different: once their signing algorithm can be broken, new forgeries become possible, so they need a plan before that point.

That is not a reason to delay. Some signing keys sit at the root of trust for many years: certificate authority roots, and keys built into devices to check firmware. NIST says devices that cannot update their verification code should be designed to require quantum-resistant signatures if they may still be in use when such a computer arrives.²