Quantum cryptography: how do quantum computers affect encryption?

Can quantum computers break encryption? Shor’s and Grover’s algorithms, post-quantum cryptography (ML-KEM, ML-DSA) and quantum key distribution (BB84) explained.

The short answer

A large enough, error-corrected quantum computer could break the public-key encryption most used on the internet today (RSA, Diffie–Hellman and elliptic-curve cryptography) with Shor’s algorithm. Today’s quantum computers are far from that size. Still, because data recorded today can be decrypted years later, the world is already moving to quantum-resistant encryption.

Which encryption is at risk?

Public-key cryptography: RSA relies on the difficulty of factoring a large number into primes, elliptic-curve cryptography on the difficulty of the discrete logarithm problem. Shor’s algorithm solves both in polynomial time. Key exchange and digital signatures in HTTPS connections belong to this group.

Symmetric encryption and hash functions: the best known quantum attack on AES and SHA-2/SHA-3 is Grover’s algorithm, which gives only a quadratic speed-up. Doubling the key length (for example AES-256 instead of AES-128) is considered sufficient.

The “harvest now, decrypt later” threat

An attacker can record encrypted traffic today and decrypt it once a powerful quantum computer exists. For data that must stay secret for decades, such as health records, state secrets or long-lived business information, the risk starts today. This is the main reason the migration has to happen before quantum computers are ready.

Post-quantum cryptography

Post-quantum (quantum-resistant) cryptography consists of new algorithms that run on classical computers but rest on mathematical problems believed to be hard for quantum computers too. It needs no quantum hardware and can be deployed with a software update.

The US National Institute of Standards and Technology (NIST) published the first standards in 2024: lattice-based ML-KEM (FIPS 203, formerly Kyber) for key exchange, ML-DSA (FIPS 204, Dilithium) and hash-based SLH-DSA (FIPS 205, SPHINCS+) for digital signatures. Major browsers and messaging apps have started using hybrid key exchange that combines classical and post-quantum algorithms.

Quantum key distribution (QKD)

Quantum cryptography usually refers to quantum key distribution. In the BB84 protocol two parties build a secret key from the quantum states of individual photons. An eavesdropper who measures the photons disturbs their states, which the parties notice as a higher error rate. Security rests on the laws of physics rather than a mathematical assumption.

QKD requires special hardware and fibre or satellite links, has limited range and still needs classical cryptography for authentication. That is why post-quantum cryptography leads at internet scale, while QKD is used for high-security point-to-point links.

Try it yourself

With Quantum Store’s BB84 package you can see in simulation how an eavesdropper raises the key error rate, and with the Shor package you can run the small example that factors 15 with Qiskit.

Frequently asked questions

Can quantum computers break bank encryption today?

No. Breaking RSA-2048 is estimated to need an error-corrected quantum computer with millions of physical qubits; today’s devices are far behind that.

Is AES-256 safe against quantum computers?

Yes, against known attacks. Grover’s algorithm roughly halves the effective security; AES-256 stays very strong even then.

Does post-quantum cryptography need a quantum computer?

No. Post-quantum algorithms run on ordinary computers and phones; they are simply designed to resist quantum attacks as well.

Are quantum cryptography and post-quantum cryptography the same?

No. Quantum cryptography (QKD) gets its security from quantum physics and needs special hardware. Post-quantum cryptography means mathematical algorithms that run on classical computers and resist quantum attacks.

Concepts in this guide

Shor’s algorithm · Shor’s algorithm factors large numbers exponentially faster than known classical methods, which is why it threatens RSA encryption.
Grover’s algorithm · Grover’s algorithm finds a marked item among N unsorted items in about √N steps, a quadratic speed-up over classical search.
Post-quantum cryptography (PQC) · Post-quantum cryptography means encryption algorithms that run on today’s classical computers and are believed to stay secure against large quantum computers.
Quantum key distribution (QKD, BB84) · Quantum key distribution lets two parties share a secret encryption key while detecting eavesdropping attempts thanks to the nature of quantum measurement.
No-cloning theorem · The no-cloning theorem states that it is impossible to make an exact copy of an unknown quantum state; it is a fundamental constraint for quantum cryptography and error correction.
Quantum error correction · Quantum error correction spreads one logical qubit over many physical qubits so that errors caused by noise can be found and fixed without measuring the qubits directly.

Full quantum computing glossary →