The Central Question: When Will Quantum Computers Break Encryption?
The post-quantum cryptography migration is driven by a single question: when will a Cryptographically Relevant Quantum Computer (CRQC) exist — a quantum computer capable of running Shor’s algorithm at sufficient scale to break RSA-2048, ECDH P-256, or equivalent classical public-key cryptography?
This is not an academic question. The answer determines:
- How urgently organizations must migrate to PQC
- How much data is at risk from Harvest Now, Decrypt Later (HNDL) collection
- Whether regulatory timelines (CNSA 2.0’s 2030-2035 deadlines) are adequate or aggressive
- How much organizational budget and priority to allocate to migration
This guide provides a realistic, evidence-based assessment of quantum computing timelines, what must happen before cryptographic attacks are feasible, and why uncertainty itself demands action.
What Is a Cryptographically Relevant Quantum Computer?
Definition
A CRQC is a quantum computer with sufficient:
- Logical qubits: Enough error-corrected qubits to represent the problem (factoring RSA-2048 requires approximately 4,000-20,000 logical qubits, depending on the algorithm)
- Gate fidelity: Sufficiently low error rates across qubit operations to complete the computation
- Circuit depth: Ability to execute billions of quantum gates sequentially
- Coherence time: Quantum states maintained long enough to complete the full computation
- Classical co-processing: Supporting classical computation for algorithm orchestration
The Gap Between Today’s Quantum Computers and CRQCs
| Metric | Current State (2026) | CRQC Requirement | Gap |
|---|---|---|---|
| Physical qubits | ~1,000-1,500 (IBM, Google) | 10-20 million | ~10,000-20,000x |
| Logical qubits | ~10-50 (with error correction) | 4,000-20,000 | ~100-2,000x |
| Two-qubit gate error | 0.1-1% | <0.01% (threshold varies) | 10-100x improvement |
| Coherence time | 100-500 μs (superconducting) | Hours-days (for full computation) | ~10,000-100,000x |
| Circuit depth | ~1,000 gates | Billions of gates | ~1,000,000x |
This gap is enormous. However, quantum computing has demonstrated exponential improvement in some metrics, and breakthrough advances could dramatically compress timelines.
Current State of Quantum Hardware (2026)
IBM Quantum
IBM has been the most transparent about their quantum computing roadmap:
- Current system: IBM Heron (133 qubits, 2024) and planned systems with 1,000+ qubits
- Error correction progress: Demonstrated logical qubit operations with improved error rates
- Roadmap target: 100,000+ qubit systems by 2033 (per IBM Quantum Roadmap)
- Modular architecture: Plans for interconnected quantum processors to scale beyond single-chip limits
- Relevance to CRQC: IBM’s roadmap, if achieved, brings hardware closer to CRQC requirements but does not achieve cryptographic breaks within their current published timeline
Google Quantum AI
Google’s quantum program focuses on achieving quantum error correction milestones:
- Willow processor (2024): Demonstrated that increasing code size reduces error rates — a key milestone for error correction scaling
- Surface code demonstration: Showed logical qubit error rates below physical qubit error rates
- Roadmap: Targeting “useful” quantum computation within the decade
- Relevance to CRQC: Google’s error correction progress is directly applicable to CRQC construction. Their demonstration that larger codes work better was a significant milestone toward scalable quantum computing.
IonQ (Trapped Ion)
IonQ uses trapped ion technology, which offers different trade-offs:
- Gate fidelity: Higher individual gate fidelity than superconducting (~99.5% two-qubit gates)
- Connectivity: All-to-all qubit connectivity (no routing overhead)
- Scale challenge: Slower individual operations and harder to scale to large qubit counts
- Current systems: 32+ algorithmic qubits
- Relevance to CRQC: Trapped ions may offer a path to higher-fidelity qubits but face scaling challenges
Other Major Programs
| Program | Technology | Status | Notable Aspects |
|---|---|---|---|
| Microsoft (Topological) | Topological qubits | Early hardware demonstrations | Inherently error-resistant if achieved |
| PsiQuantum | Photonic | Manufacturing-focused approach | Targeting 1M qubits via silicon photonics |
| Quantinuum (Honeywell) | Trapped ion | 56+ qubits, high fidelity | Focus on near-term quantum advantage |
| China (USTC) | Superconducting + Photonic | Zuchongzhi (66 qubits) | National strategic priority |
| Rigetti | Superconducting | Multi-chip architecture | Focus on hybrid algorithms |
Chinese Quantum Programs
China’s quantum computing investment deserves special attention from a threat assessment perspective:
- National strategic priority: Massive government funding ($15B+ estimated investment)
- Quantum communication network: Beijing-Shanghai quantum key distribution backbone
- Computing hardware: Zuchongzhi processor (66 superconducting qubits)
- Photonic systems: Jiuzhang demonstration of quantum computational advantage
- Military applications: Explicit interest in cryptanalytic applications
- Opacity: Less public information than Western programs; actual capabilities may exceed public demonstrations
Error Correction: The Critical Bottleneck
Why Error Correction Matters
Current quantum computers have high error rates. A physical qubit operation might succeed 99.5% of the time — impressive for one operation, but catastrophic when you need billions of operations:
Single gate success: 99.5%
After 1,000 gates: 0.995^1000 = 0.7% success probability
After 1,000,000 gates: 0.995^1000000 ≈ 0 (essentially guaranteed failure)
For RSA-2048 factoring: ~billions of gates needed
Without error correction: Computation will never succeedQuantum Error Correction (QEC) encodes logical qubits across many physical qubits, enabling error detection and correction during computation:
Logical qubit = Many physical qubits (encoding + ancilla)
Example: Surface code at distance 23
- 1 logical qubit = ~1,000 physical qubits
- Logical error rate: ~10^-10 per operation (if physical rate ~0.1%)
- Enables billions of operations on logical qubitsError Correction Requirements for CRQC
| Algorithm Target | Logical Qubits Needed | Physical Qubits (est.) | Gate Operations | Time Estimate |
|---|---|---|---|---|
| RSA-2048 (Shor’s) | 4,000-20,000 | 4-20 million | ~10^9 - 10^12 | Hours-days |
| ECDH P-256 (Shor’s) | 2,000-10,000 | 2-10 million | ~10^9 | Hours |
| RSA-4096 (Shor’s) | 8,000-40,000 | 8-40 million | ~10^10 | Days |
These estimates vary widely depending on:
- The specific implementation of Shor’s algorithm (many optimizations exist)
- The error correction code used (surface code, color code, etc.)
- Physical qubit error rates achieved
- Classical co-processing efficiency
- Quantum memory (magic state distillation) overhead
Recent Error Correction Milestones
- Google Willow (2024): First demonstration that larger surface codes reduce logical error rates (the “threshold” behavior)
- IBM (2024-2025): Demonstrated error-suppression techniques reducing effective error rates
- Microsoft (2025): Claimed topological qubit progress (inherent error resistance)
- Academic results: Continued improvements in code efficiency and decoding algorithms
These milestones are significant but represent the earliest steps. Scaling from demonstrating the principle to executing cryptographic attacks requires orders-of-magnitude improvement in every metric simultaneously.
Expert Predictions and Surveys
Global Risk Institute Annual Survey
The Global Risk Institute conducts annual surveys of quantum computing experts:
| Year of Survey | Probability of CRQC within 10 years | Probability of CRQC within 20 years | Probability of CRQC within 30 years |
|---|---|---|---|
| 2022 | ~10-15% (median) | ~50% | ~70% |
| 2023 | ~15-20% (median) | ~50-55% | ~75% |
| 2024 | ~17-25% (median) | ~55-60% | ~75-80% |
Interpretation: Expert consensus suggests:
- ~20% probability of CRQC by 2034-2036
- ~55% probability of CRQC by 2044-2046
- ~75% probability of CRQC by 2054-2056
These are probability distributions, not certainties. A 20% chance of CRQC within 10 years is not “probably won’t happen” — it’s an unacceptable risk for long-lived secrets.
RAND Corporation Assessment
RAND’s analysis emphasizes:
- The uncertainty range remains very wide (decades of spread between optimistic and pessimistic estimates)
- Progress in error correction is the key variable that could compress timelines
- A breakthrough in any one of several areas could dramatically accelerate capability
- Planning should account for the optimistic tail of the distribution, not the median
Intelligence Community Perspective
While specific assessments are classified, the public actions of intelligence agencies reveal their beliefs:
- NSA’s CNSA 2.0 mandates PQC migration by 2030-2035 — implying NSA believes CRQCs are possible within that timeframe
- NSM-10 (Biden administration) directed agencies to inventory quantum-vulnerable cryptography immediately
- CISA’s guidance treats quantum as an active threat requiring immediate preparation
- Five Eyes (US, UK, Australia, Canada, New Zealand) have aligned on PQC transition urgency
These actions are inconsistent with a belief that CRQCs are 30+ years away. Intelligence agencies are acting as if the threat is 10-15 years away (or closer).
Mosca’s Theorem: The Decision Framework
The Inequality
Michele Mosca’s inequality provides the definitive framework for decision-making under timeline uncertainty:
If X + Y > Z, then your data is already at risk.
X = Time required to migrate your systems to quantum-safe cryptography
Y = Required secrecy lifetime of your data
Z = Time until a CRQC existsPractical Application
| Organization Type | X (Migration Time) | Y (Data Lifetime) | Z (CRQC Arrival) | X + Y > Z? | Action |
|---|---|---|---|---|---|
| Government/Intel | 10-15 years | 50+ years | 10-15 years | 65 > 10 YES | Urgent migration NOW |
| Healthcare | 7-12 years | 50+ years (patient life) | 10-15 years | 57 > 10 YES | Urgent migration NOW |
| Financial services | 5-10 years | 7-25 years | 10-15 years | 15 > 10 YES | Active migration |
| Technology | 3-7 years | 5-10 years | 10-15 years | 10 > 10 BORDERLINE | Plan and begin |
| Retail/Consumer | 3-5 years | 1-3 years | 10-15 years | 6 < 10 Maybe not | Plan, not urgent |
Why Even “Safe” Organizations Should Act
Even if X + Y < Z for your data today:
- Z is uncertain — CRQC could arrive earlier than expected
- Migration creates operational benefits — better crypto hygiene, algorithm diversity
- Regulatory requirements don’t depend on Z — PCI DSS 4.0, CNSA 2.0 have fixed deadlines
- Supply chain requirements — your customers/partners may require PQC from you
Scenarios: Optimistic, Expected, Pessimistic
Optimistic Scenario (CRQC by 2030-2032)
What would need to happen:
- Major error correction breakthrough (e.g., new code family reducing qubit overhead by 10x)
- Physical qubit count scaling faster than roadmaps (10M+ qubits)
- Manufacturing breakthrough enabling rapid qubit scaling
- Undisclosed nation-state program already ahead of public knowledge
Probability estimate: 5-15%
Impact: Organizations that haven’t started migration will have data exposed. Only those already deploying hybrid key exchange will have protection for recent data. Historical data already collected via HNDL is compromised.
Expected Scenario (CRQC by 2035-2040)
What would need to happen:
- Continued steady progress on current quantum computing roadmaps
- Error correction scales as theoretical models predict
- Manufacturing challenges resolved incrementally
- 10-20 million physical qubits achievable through modular architectures
Probability estimate: 40-50%
Impact: Organizations following CNSA 2.0 timelines will be adequately protected. Those that delayed migration will have 5-15 years of HNDL-captured data exposed. The financial and intelligence damage from exposed historical data will be significant.
Pessimistic/Delayed Scenario (CRQC by 2045-2060+)
What would need to happen:
- Fundamental physical limitations prevent qubit scaling beyond 10,000
- Error correction overhead proves worse than theoretical predictions
- No manufacturing breakthrough for mass qubit production
- Decoherence remains an unsolved practical challenge at scale
Probability estimate: 25-35%
Impact: PQC migration was premature relative to the quantum threat — but still provides value through improved crypto hygiene, algorithm diversity, and compliance. The cost of early migration is far less than the cost of late migration in the expected/optimistic scenarios.
Why You Should Plan for the Optimistic Scenario
The cost-benefit analysis is asymmetric:
| Scenario | Cost of Early Migration | Cost of Late Migration |
|---|---|---|
| CRQC arrives early (2030-2032) | ✓ Protected (migration started in time) | ✗ Catastrophic exposure |
| CRQC arrives expected (2035-2040) | ✓ Well-protected, early completion | ✗ Significant exposure of historical data |
| CRQC arrives late (2045-2060) | Minimal wasted cost (modern crypto anyway) | Not applicable |
The cost of being wrong about migrating early is low (you have modern, well-managed cryptography). The cost of being wrong about waiting is potentially catastrophic (decades of data exposed).
Acceleration Risks: What Could Compress the Timeline
Known Accelerators
| Risk Factor | Potential Impact | Probability |
|---|---|---|
| Novel error correction | Could reduce physical qubit requirement by 10-100x | Medium |
| New qubit modalities | Topological qubits, photonic breakthroughs | Medium-Low |
| Algorithmic improvement | Better factoring/discrete log algorithms (classical or quantum) | Low-Medium |
| Manufacturing breakthrough | Enable mass production of high-quality qubits | Medium |
| Nation-state secret program | Capabilities ahead of public knowledge | Low-Medium |
| AI/ML-accelerated design | AI optimizing quantum hardware/algorithms | Medium |
Algorithmic Acceleration (Non-Quantum)
A less-discussed risk: improvements to classical algorithms that reduce the quantum resources needed:
- Shor’s algorithm has been optimized significantly since 1994
- New mathematical techniques could further reduce qubit requirements
- Pre-computation attacks could reduce runtime at the cost of more qubits
- Hybrid classical-quantum approaches may reduce quantum requirements
Each algorithmic improvement effectively brings the CRQC timeline forward by reducing what “cryptographically relevant” means in terms of hardware requirements.
AI-Accelerated Quantum Development
Artificial intelligence is increasingly used in quantum computing research:
- ML for quantum error correction decoder design
- AI-optimized pulse sequences for higher gate fidelities
- Generative models for discovering new quantum algorithms
- Automated calibration reducing human bottlenecks
This meta-acceleration makes prediction harder — the rate of progress itself may accelerate unpredictably.
What This Means for Migration Urgency
The Irrefutable Logic
Regardless of the exact CRQC timeline:
- Migration takes time (X = 5-15 years for large organizations)
- Data already at risk (Y = data already transmitted over quantum-vulnerable crypto is captured)
- Uncertainty favors action (better to migrate 5 years early than 1 day late)
- Cost of action is low (hybrid key exchange is virtually free to deploy)
- Standards are ready (FIPS 203/204/205 are final — no reason to wait)
- Implementations exist (major browsers, servers, and libraries support PQC)
Urgency by Data Type
| Data Category | Required Action | Timeline for Action |
|---|---|---|
| State secrets (25-75 year classification) | Immediate PQC deployment | Should already be done |
| Healthcare/genomic (lifetime sensitivity) | Hybrid key exchange now | Immediate |
| Financial long-term (M&A, strategies) | Hybrid key exchange now | Immediate |
| Corporate IP (10-20 year value) | Plan and begin hybrid | Within 6 months |
| General business (3-5 year value) | Plan migration | Within 12 months |
| Ephemeral data (hours-days) | Monitor progress | Low urgency |
How QCecuring CBOM Supports Threat-Timeline Planning
QCecuring CBOM enables organizations to make risk-informed decisions regardless of CRQC timeline:
- HNDL exposure calculation: Quantifies how much data is at risk based on algorithm usage, data sensitivity, and retention periods
- Migration timeline modeling: Based on current cryptographic inventory, estimates how long migration will take (your X value in Mosca’s inequality)
- Priority-based roadmap: Identifies which systems to migrate first based on data sensitivity × algorithm vulnerability × network exposure
- Progress tracking: Monitors migration velocity to ensure deadlines are achievable
- Scenario planning: Models exposure under different CRQC timeline assumptions
Organizations using QCecuring CBOM can answer the critical question: “Given our current migration rate, will we be protected before a CRQC arrives under optimistic, expected, and pessimistic scenarios?”
Key Takeaways
- CRQCs do not exist today — but expert consensus suggests 15-25% probability within 10 years and 50%+ within 20 years
- The gap between current hardware and CRQCs is enormous — orders of magnitude improvement needed in physical qubits, error rates, and coherence
- Error correction is the critical bottleneck — until logical qubits can be created efficiently at scale, cryptographic attacks remain infeasible
- Google’s Willow result (2024) demonstrated threshold behavior — a significant milestone proving that larger codes reduce errors as theory predicts
- Timeline uncertainty does NOT reduce urgency — Mosca’s inequality shows that data already in transit is at risk regardless of exact CRQC date
- Nation-state quantum programs are opaque — capabilities may exceed public demonstrations, especially in China
- The cost asymmetry heavily favors early action — migrating early costs little; migrating late could mean catastrophic data exposure
- Intelligence agencies are acting as if CRQCs are 10-15 years away — CNSA 2.0 deadlines imply NSA’s risk assessment
- Algorithmic and AI-driven acceleration could compress timelines — don’t assume steady-state progress rates
- Hybrid key exchange has zero cost and immediate benefit — there is no rational reason to delay its deployment
- QCecuring CBOM enables scenario-based planning — model your exposure under different timeline assumptions and track migration progress against them