This summer, researchers from NCC Group in Spain, North America and the UK have been experimenting with quantum computers available via Amazon Web Services (AWS) Bracket, their quantum computer as a service offering. We have been building quantum circuits and running them on real Quantum Processing Units to learn about quantum algorithms, what is possible with the current generation of commercially available quantum computers, what their current limitations are and how that relates to cyber security applications of quantum computing. In this blog series we will demystify these topics, providing insights into the current and future threat from a cryptographically relevant quantum computer and how quantum technologies can be used in security architectures.
The research team consisted of Diego Albillos, Miguel Dilaj, Jon Renshaw, Marta Vila and Joshua Williams.
In this first introductory post in the series Diego explains why you should care about the threat from a computer that doesn’t exist yet.
Why a computer that doesn't exist yet is already a problem for your data today.
Imagine that someone has been photocopying every sealed letter you have ever sent.
Figure 1 - Encrypted data copied today, opened years later.
They cannot read them. The envelopes are locked with a lock that nobody on Earth can open. So they do something patient: they store them. Millions of them, in a warehouse, on shelves labelled by date.
They are not waiting for you to make a mistake. They are waiting for a key that has not been invented yet.
This is not a thriller plot. Security agencies in the US, UK and Europe have given it a name and are asking organisations to act on it now [1][2][3]. It is called "Harvest Now, Decrypt Later", and the key the collectors are waiting for is a quantum computer.
In 30 seconds
- Almost everything you do online is protected by encryption: a digital lock based on math problems that today's computers cannot solve.
- A sufficiently powerful quantum computer could solve some of those problems and open the locks.
- That computer does not exist yet. But data stolen today can be stored and opened later.
- That is why some governments and tech giants are already changing the locks, and why this series exists.
The invisible lock you use multiple times a day
You probably never think about it, but you rely on encryption constantly:
- The padlock in your browser when you log in to your bank.
- Your messaging apps, which scramble messages so that only the recipient can read them.
- Card payments, contactless and online.
- Software updates on your phone. Your phone checks a digital "signature" to confirm that the update really comes from Apple, Google, Samsung or any other phone company, and not from an impostor.
- Your medical records, your tax return, your company's contracts, all travelling across networks and sitting on servers.
Behind almost all of these sits a family of techniques called public-key cryptography. Its security rests on a simple bet: some math problems are so hard that even the world's fastest supercomputers would need longer than the age of the universe to solve them.
The best-known example is multiplication. Multiplying two huge prime numbers takes a computer a split second. Doing it backwards, taking the result and finding the two original numbers, is practically impossible for a normal computer when the numbers are hundreds of digits long and is known as the integer factorisation problem.
Figure 2 - Easy to multiply, practically impossible to reverse.
That asymmetry, easy one way and impossible the other, is the lock.
The problem: a new kind of locksmith
In 1994, a mathematician called Peter Shor showed that a quantum computer, a machine that works according to the rules of quantum physics, could solve exactly those "impossible" problems [4]. This solution using quantum computers is known as Shor's algorithm. Another hard problem used in modern public-key cryptography is the discrete logarithm problem which is also solvable using Shor's algorithm. And Shor's algorithm running on a quantum computer can solve those problems quickly.
Not a bit faster. Fundamentally faster. A lock that would take a normal computer billions of years could fall in hours or days.
For thirty years this was a theoretical curiosity, because nobody could build a quantum computer big and reliable enough to do it. That is starting to change, and faster than most people expected. We will look at exactly how fast in Chapters 2 and 3.
Side note: You may also have heard of Grover's algorithm. Lov Grover invented a quantum search algorithm which speeds up the time taken to find the correct value in a range of possible values. This is relevant to any problem requiring a brute-force search, such as finding the secret key used in symmetric encryption algorithms like the Advanced Encryption Standard (AES). However the speed up with Grover's algorithm is not as dramatic as the speed up with Shor's and is therefore considered less of an imminent threat. We may cover experiments with Grover and other quantum algorithms in future but for these initial blogs our focus will be on Shor's algorithm.
Why "later" is already "now"
Here is the twist that turns a future problem into a present one.
Most of the time, when we think about hacking, we think about timing: the attacker has to break in while the door is open. The quantum threat breaks that assumption. An attacker does not need a quantum computer today. They only need to record your encrypted data today, which is technically easy for anyone with access to network cables, compromised routers or stolen backups, and wait.
So the real question is not "When will quantum computers arrive?" It is:
"Will the information I'm sending today still matter when they do?"
For a lot of data, the answer is no. Your one-time login code is useless after 30 seconds. Your card number will have expired.
For other data, the answer is very much yes:
- Health records and genetic data never expire. Your DNA in 2040 is the same as your DNA today.
- Trade secrets, patents in progress, product designs.
- Government and defense communications.
- Legal and financial documents that stay sensitive for decades.
- Personal conversations you would never want made public, ten or twenty years from now.
Figure 3 - How long different types of data must stay secret.
Security experts summarise this with a simple rule of thumb, known as Mosca's theorem [5]:
If the time your data must stay secret + the time it takes you to upgrade your systems is longer than the time until quantum computers arrive, you are already late.
Figure 4 - Mosca's rule applied to a hypothetical hospital.
Upgrading the cryptography of a large company, a hospital or a bank is not a weekend job. It usually takes years, because encryption is buried in thousands of systems, devices and suppliers. That is why the countdown matters now.
It's not only about secrets: forged signatures
There is a second, less-discussed risk. The same math that protects secrets also protects identity: the digital signatures that prove a website is really your bank, or that an update really comes from the manufacturer.
Once quantum computers can break those signatures, an attacker could impersonate trusted organisations: pushing fake updates, faking certificates, or moving cryptocurrency out of wallets. Some researchers call this "Trust Now, Forge Later" [6].
Unlike stolen data, this attack only starts working once the machine exists. However, the systems that depend on signatures (payment networks, car software, industrial equipment, passports) take so long to replace that the work also has to start now.
So, should we panic?
No (not yet). Some honest facts:
- Nobody can break today's encryption with a quantum computer yet. Some headlines claim otherwise; Chapter 2 shows why most of them are misleading.
- The replacement locks already exist. In 2024, the US standards body NIST published new "post-quantum" standards designed to resist quantum computers [7].
- You are probably already using them. If your phone and browser are up to date, many of your connections are already protected by these new locks, as Chapter 4 explains.
However, the hard part is for organisations, not individuals. They have to find the old locks protecting sensitive data in their systems and replace them before the deadline. This last point is where this story gets interesting, and where the timeline has recently started to move.
Next in the series: Chapter 2, The Key Nobody Has Built (Yet)
What exactly is a quantum computer? What good could it do? Why can't we just buy one and break everything tomorrow? And why did one of the world's leading cloud providers just announce a date for an error-corrected machine on its cloud?
- CISA, NSA, NIST, Quantum-Readiness: Migration to Post-Quantum Cryptography (2023).↩︎
- NIS Cooperation Group (EU), Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography (June 2025).↩︎
- NCSC (UK), Timelines for migration to post-quantum cryptography↩︎
- P. Shor, Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer.↩︎
- M. Mosca, Cybersecurity in an era with quantum computers: will we be ready?↩︎
- Cloudflare, Cloudflare targets 2029 for full post-quantum security (2026).↩︎
- NIST, NIST Releases First 3 Finalized Post-Quantum Encryption Standards (August 2024).↩︎