The Quantum Investor's Notebook logo The Quantum Investor's Notebook
← Back

Thursday, October 22, 2026

Q-Day: A Threshold, Not a Date

Q-DayThe hypothetical point at which a quantum computer can break widely used public-key encryption. is the name for the day a quantum computer could break the public-key encryption much of the internet relies on. It is a capability a machine would have to reach, not a date on a calendar, and the defense is already being rolled out.

What would break

Public-key cryptography lets strangers lock messages and sign documents without sharing a secret first. Its safety rests on math problems that are very hard for ordinary computers: factoring a huge number into its primes, as in RSA, and a related problem called the discrete logarithm, behind elliptic-curve methods.

In 1994, Peter Shor showed that a quantum computer could solve both problems in a number of steps that grows only polynomially with the size of the number.1 Its core is the interference step described in the quantum Fourier transformWhat the Quantum Fourier Transform does: it rearranges a quantum state so that a pattern hidden in the phases interferes into a measurable outcome. Note. Not everything breaks: a draft US transition plan lists public-key methods as quantum-vulnerable, while symmetric ciphers such as AES are used to define its post-quantum security levels.5

What it would take

Shor’s algorithm needs a long computation with almost no errors. That means error-corrected logical qubitsA reliable ‘qubit’ built by bundling many error-prone physical qubits together with error correction. These are the units that actually matter for useful computing. and a large supply of magic statesSpecial resource states that a fault-tolerant computer consumes to perform the operations it cannot do directly., not a few hundred raw qubits.

Published estimatesAn estimate of how many qubits, and how much time, a quantum computer would need to break RSA-2048. A recipe built on stated assumptions. have fallen sharply. A 2019 estimate put factoring a 2048-bit RSA number at about 20 million noisy qubits running for eight hours.2 A 2025 estimate by one of the same authors cut that to under a million noisy qubits running for under a week.3 Both assume a square grid of qubits, a 0.1% error rate per gate and surface codeAn error-correcting code that spreads one protected qubit over a square grid of physical qubits. cycles of one microsecond.2,3 The savings come from new arithmetic, more compact storage for idle qubits and cheaper magic states, not from a new kind of machine.3

For scale, one of the largest high-accuracy machines today has 98 physical qubits.6 Error correction has shown errors falling as small codes grow, but no machine has yet run a long fault-tolerant computation.

Two panels about Q-Day. Title: Q-Day: A Threshold, Not a Date. Left, labeled harvest now, decrypt later: three envelopes in a row, labeled sent today, copied, stored, and opened later, the last with a question mark, joined by arrows, the second arrow labeled if ever. Beneath: secrets that must last for years are at risk before any attack exists: that is why migration starts now. Right, labeled physical qubits: a vertical scale marked 100, 10,000 and 1 million. A dot at 98 is labeled 98: a large machine today; a dot near 1 million is labeled under 1 million: one 2025 estimate to break 2048-bit RSA (under a week). A red arrow between them is labeled about 10,000x more. A note reads rough scale: different hardware, stated assumptions. Beneath both: the estimates keep falling; the machines keep growing; neither curve is a calendar.
Figure 1: A threshold, not a date. Encrypted data copied today could be opened later, which is why migration starts now. One 2025 estimate needs under a million noisy qubits to break 2048-bit RSA, about 10,000 times the 98 qubits of a large machine today. Rough scale only: the hardware differs and the estimate rests on stated assumptions.

Harvest now, decrypt later

Why act before any such machine exists? Because encrypted data can be copied today and stored until it can be opened. The US standards agency calls this “harvest now, decrypt later,” a threat to secrets that keep their value for years, such as medical records.5 Signatures face a different clock: a signature only has to be secure at the time it is checked.5

The defense already exists

In August 2024, the agency finalized its first three post-quantum standards: one for general encryption and two for digital signatures, built on math problems believed to be hard for quantum computers too.4 It urged system administrators to start using them “immediately, because full integration will take time.”4 Its draft transition plan proposes deprecating the weaker settings of today’s quantum-vulnerable methods after 2030 and disallowing all of them after 2035.5 Those are migration deadlines set by policy, not forecasts of when Q-Day will come.

How to read it

When a headline says a result “brings Q-Day closer,” ask which kind of progress it is. Does it lower the resources an attack needs, or raise what real machines can do? Under what assumptions about error rates and speed? Both are progress; neither is a date. The migration, meanwhile, is a present-day project, driven by standards and deadlines, whatever the timing of Q-Day turns out to be.

Sources

  1. P. W. Shor, “Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer,” SIAM Journal on Computing 26, 1484 (1997). arXiv:quant-ph/9508027. (Factoring and discrete logarithms in polynomially many steps; first published 1994.) ↩
  2. C. Gidney and M. Ekerå, “How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits,” Quantum 5, 433 (2021). arXiv:1905.09749. (Square grid, 10⁻³ gate error, 1 µs surface code cycle.) ↩
  3. C. Gidney, “How to factor 2048 bit RSA integers with less than a million noisy qubits,” preprint, arXiv:2505.15917 (2025). (Under a million noisy qubits, under a week, same assumptions; savings from new arithmetic, yoked surface codes and cultivation.) ↩
  4. National Institute of Standards and Technology, “NIST releases first 3 finalized post-quantum encryption standards,” news release, August 13, 2024 (accessed October 20, 2026). (FIPS 203 for encryption; FIPS 204 and 205 for signatures; “immediately, because full integration will take time.”) ↩
  5. National Institute of Standards and Technology, Transition to Post-Quantum Cryptography Standards, NIST IR 8547 initial public draft (November 2024). (Harvest now, decrypt later; medical records; authentication secure when performed; RSA and elliptic-curve methods quantum-vulnerable, 112-bit settings deprecated after 2030, all disallowed after 2035; security categories defined by AES key search.) ↩
  6. A. Ransford, M. S. Allman, et al. (Quantinuum), “Helios: A 98-qubit trapped-ion quantum computer,” preprint, arXiv:2511.05465 (2025). (98 qubits.) ↩