How Quantum Algorithms Pose a Threat to Asymmetric Encryption
Not all quantum threats to cryptography work the same way. Security teams preparing for the quantum era need to understand that two distinct algorithms are at play, each attacking a different layer of the cryptographic stack, and each demanding a different response.
Shor’s algorithm targets asymmetric encryption directly and completely. Grover’s algorithm weakens symmetric encryption more modestly. The policy and engineering responses to these two threats are not the same, and conflating them leads to poorly calibrated migration plans.
Two Different Algorithms, Two Different Threats
The place to start is understanding exactly what each algorithm does and what it does not do. A dedicated explainer on quantum algorithms threatening asymmetric encryption covers both in technical detail, but the practical distinction is this: Shor’s algorithm, if run on a sufficiently large quantum computer, would not merely weaken RSA and elliptic curve cryptography. It would render both completely insecure, regardless of key size.
Grover’s algorithm is more contained. Applied to symmetric encryption schemes like AES, it reduces effective security by roughly half. AES-256 would behave like AES-128 under a quantum brute-force search. That is a real reduction, but one that can be addressed by doubling key lengths, which is far simpler than replacing an entire class of cryptographic infrastructure.
How Shor’s Algorithm Actually Works
Shor’s algorithm, developed by mathematician Peter Shor in 1994, solves a specific mathematical problem called integer factorization in polynomial time. On a classical computer, factoring a large number into its prime components becomes exponentially harder as the number grows larger. That hardness is the entire security foundation of RSA encryption.
On a quantum computer, Shor’s algorithm exploits superposition and the quantum Fourier transform to find the period of a mathematical function efficiently, which in turn reveals the prime factors. The process that would take a classical computer billions of years collapses to a matter of hours or days on a machine with enough stable qubits.
Elliptic curve cryptography faces the same threat through a closely related variant of the algorithm, since the discrete logarithm problem underlying ECC is equally vulnerable to quantum Fourier transform techniques. Both RSA and ECC are therefore exposed to complete break, not degradation.
Why Today’s Quantum Computers Cannot Do This Yet
The critical gap between the theory and the current reality is the qubit count and error rate of available hardware. Factoring a 2048-bit RSA key using Shor’s algorithm would require millions of physical qubits with very low error rates, a capability current machines fall far short of achieving.
Quantum computing expert research from RAND places cryptanalytically relevant quantum computers no earlier than the 2030s, and notes that the hardware requirements are substantial enough that any organization approaching that capability would almost certainly be visible to the broader scientific community well before the milestone was reached.
That visibility matters because it means the threat is not a surprise attack. It is a known trajectory with warning signs, which is precisely what makes early preparation both possible and necessary.
Grover’s Algorithm and the Symmetric Encryption Response
Grover’s algorithm operates on a completely different principle. Rather than exploiting the structure of a specific mathematical problem, it provides a general quadratic speedup for searching unsorted datasets. Applied to cryptographic key search, it means that a quantum computer could find a symmetric key in roughly the square root of the time a classical brute-force search would take.
For 128-bit keys, this reduction is severe enough to make brute-force feasible. For 256-bit keys, a quantum computer would still require the equivalent of a classical search over 128-bit space, which remains computationally prohibitive for the foreseeable future. The engineering response is therefore proportionate: organizations already using 256-bit symmetric encryption are in relatively strong shape, while those relying on shorter key lengths need to upgrade.
This is a meaningful difference from the Shor situation. No key length for RSA or ECC provides adequate protection once a sufficiently powerful quantum computer exists. For symmetric encryption, the defense already exists in the form of longer keys.
What Governments Are Doing in Response
The asymmetric encryption threat from Shor’s algorithm has prompted responses at the highest levels of national policy. The US government’s coordinated quantum security work treats this as a priority that cuts across both economic and national security interests, recognizing that the same mathematical breakthrough that could enable enormous commercial value in quantum computing would simultaneously expose the encryption protecting most internet communications.
The quantum security guidance maintained by US national quantum security authorities reflects this urgency, framing the transition to quantum-resistant cryptography as a challenge comparable in scale to any previous major cryptographic migration, with the added complication that the timeline is driven by external technological progress rather than internal planning cycles.
Federal agencies face formal migration deadlines, and the NIST FIPS algorithms finalized in 2024 exist specifically because Shor’s algorithm makes the current public-key cryptographic infrastructure untenable once quantum hardware matures.
The Harvest-Now-Decrypt-Later Dimension
One element of the Shor threat that applies even before functional quantum computers exist is the harvest-now, decrypt-later problem. An adversary with enough storage capacity can capture encrypted traffic today, keep it, and decrypt it retroactively once the hardware eventually arrives.
For most data, this is not an immediate concern, since the information loses value before it could be decrypted. For long-lived sensitive data, the concern is very real. Diplomatic cables, intellectual property, medical records, and strategic communications that need to remain confidential for a decade or more are already at risk under this threat model, regardless of when a cryptanalytically relevant quantum computer actually appears.
This is the argument for beginning migration work now, even when the hardware threat remains years away.
Why the Timeline Still Matters Even With Uncertainty
Precise predictions about quantum hardware timelines carry considerable uncertainty, and serious researchers are candid about this. The relevant question for security planning is not exactly when a cryptanalytically relevant quantum computer will exist, but whether migration work to replace RSA and ECC infrastructure can be completed before that moment arrives.
That migration is a multi-year undertaking for most large organizations. Organizations that treat the quantum threat as a future problem to revisit when the hardware arrives will find that the window for orderly preparation has already closed.
Frequently Asked Questions
Does Shor’s algorithm affect symmetric encryption like AES?
No. Shor’s algorithm specifically targets the mathematical problems underlying asymmetric encryption, such as integer factorization and the discrete logarithm problem. AES and similar symmetric schemes face the separate and less severe threat from Grover’s algorithm instead.
Can larger RSA keys protect against Shor’s algorithm?
No. Unlike Grover’s algorithm, where doubling key length restores an acceptable security margin, Shor’s algorithm breaks the underlying mathematical problem entirely. Increasing the RSA key size does not change the fundamental vulnerability once a sufficiently powerful quantum computer exists.
How soon do organizations need to start replacing RSA and ECC?
Given that migration across enterprise systems is itself a multi-year process, and that data with long confidentiality requirements is already exposed to harvest-now, decrypt-later collection, most security teams should treat the migration as an active program today rather than a future planning exercise.
