Re: Post-quantum defaults

"Robert J. Hansen via Gnupg-users" <[email protected]> Mon, 6 Apr 2026 16:40:22 -0400

Newsgroups	gmane.comp.encryption.gpg.user
Message-ID	<[email protected]>

> Can you elaborate on why you think this is the right time to do so?

My three pillars are the difficulty of accumulating a large enough
ensemble; the difficulty of quantum error correction; and the general
inefficiency of quantum computers. These are all to some degree
interconnected.

For instance, there's a theoretical minimum of 5n+1 qubits necessary to
break RSA-n, but at our current level of engineering it requires orders
of magnitude more. That's an inefficiency problem that runs into "so,
how do you plan to get that many qubits anyway?" (large ensemble
problem) and "how do you plan on doing error correction on that huge
ensemble?" (error correction).

Well, there's been some news there.

From Google [1]:

Specifically, we have compiled two quantum circuits (a
sequence of quantum gates) that implement Shor's algorithm
for ECDLP-256: one that uses less than 1,200 logical
qubits and 90 million Toffoli gates and one that uses less
than 1,450 logical qubits and 70 million Toffoli gates. We
estimate that these circuits can be executed on a
superconducting qubit CRQC with fewer than 500,000
physical qubits in a few minutes, given standard
assumptions about hardware capabilities that are
consistent with some of Google’s flagship quantum
processors. This is an approximately 20-fold reduction in
the number of physical qubits required to solve ECDLP-256
and a continuation of a long history of gradual
optimization in compiling quantum algorithms to fault-
tolerant circuits.

Well. That's … impressive. A twentyfold reduction is scary because it
says they're on to a good method and this is just the beginning. There
are some serious cracks showing.

But wait, 500,000 physical qubits? That's ... we can still take some
reassurance from that, right?

Maybe.[2] Cain, Xu, King, et al., just a few days later showed that
maybe it can be done in 10,000 physical qubits.

Serious cracks, indeed. It's not worth panicking over: I give a low
probability these will turn into real attacks any time in the next few
years. But I do think we'll all be using post-quantum algorithms around
2030, and for a lot of us, the time to start making that transition is
today.

[1]
https://research.google/blog/safeguarding-cryptocurrency-by-disclosing-quantum-vulnerabilities-responsibly/

[2] https://arxiv.org/abs/2603.28627

_______________________________________________
Gnupg-users mailing list
[email protected]
https://lists.gnupg.org/mailman/listinfo/gnupg-users

OpenPGP_signature.asc (application/pgp-signature, 236 B)