The U.S. National Security Agency (NSA) wrote in October 2026 that it “does not know when there will be a CRQC,” a cryptographically relevant quantum computer, one able to break today’s public-key encryption. It still intends national security systems to be quantum-resistant “well ahead of the 2035 goal outlined in NSM-10,” a 2022 presidential memorandum. The Australian Signals Directorate (ASD) wrote that estimating when a CRQC will exist “is uncertain.” The ASD nonetheless recommends retiring traditional public-key algorithms by the end of 2030.
Q-FUD, short for fear, uncertainty, and doubt about quantum attacks, includes claims that those agencies do not make. One is that encryption is already broken. In October 2025, Cy4Data Labs, a data-security company, wrote that unnamed university research centers were “already announcing the ability to break traditional RSA encryption in seconds” and that Q-Day, the day a CRQC arrives, “is already here.” Other claims give Q-Day a known and near date, or hold that only a proprietary product will protect a buyer.
The published standards and agency deadlines justify starting post-quantum migration now, and none of them depends on a claim that the threat has already arrived. The agencies cite data that adversaries can record today and decrypt later, and migrations that take years.
Disclosure: Quantum Observer’s Editor-in-Chief Marin Ivezic is the founder and CEO of Applied Quantum, a quantum systems integration and consulting firm, and the author of its PQC Migration Framework. Applied Quantum is not affiliated with the Applied Quantum Technologies Institute discussed below.
Claims that encryption is broken
Researchers set both of 2026’s RSA factoring records on classical computers. Eric Lu of Cognition factored RSA-260, an 862-bit challenge number, on September 3. Stephen Weis of Anthropic factored the 896-bit RSA-896 on September 19 and wrote that his result “does not impact the security of deployed RSA-2048 keys.” Both used versions of CADO-NFS, classical factoring software, on graphics processors.
Researchers have also lowered their estimates of the quantum hardware needed to break RSA-2048, though they assume machines that have not been built. Craig Gidney of Google Quantum AI estimated in a May 2025 preprint that fewer than 1 million noisy physical qubits could factor a 2048-bit RSA key in less than a week.
In October 2026, Iceberg Quantum put the figure at 72,000 physical qubits with a 0.1% error rate, in an update published without a paper. Six days later, Alice & Bob estimated in a preprint that 22,593 physical cat qubits, a superconducting design that suppresses bit-flip errors, could do it in 3.14 days if bit flips were eliminated entirely. No machine reported as of November 2026 approaches either configuration.
Claims of a near date
On March 2, 2026, the Applied Quantum Technologies Institute (AQTI) issued a press release headlined “Cybersecurity Apocalypse in 2026 with a New Algorithm According to The Advanced Quantum Technologies Institute.” AQTI used both names in the release. It wrote, “Research extrapolations suggest it will require less than 5,000 qubits to break encryption methods used in RSA and ECC.” AQTI did not say whether those were physical or logical qubits.
The three authors of the preprint behind the release gave no qubit count of their own for RSA-2048 and cited published estimates of physical qubits “on the order of 1 million.” They wrote that their projections “should not be understood as realistic resource estimate for breaking RSA-sized keys,” as Quantum Observer reported in its coverage of AQTI’s claim. Scott Aaronson, a computer scientist at the University of Texas at Austin, wrote that the method computes its key values on an ordinary computer and “can only look like it wins on tiny numbers.”
AQTI sold no product in the release. It told organizations to “demand clear post-quantum roadmaps from technology vendors and service providers” and wrote that “the most important takeaway is not a single number or date, it is the direction of travel.” The authors later published a revised version in the peer-reviewed Journal of Cybersecurity and Privacy on April 10, 2026. In it, they called part of the analysis “scenario-specific” and wrote that their reported gate reductions “should be interpreted as end-to-end quantum-resource budgets.”
IBM plans to deliver its first large fault-tolerant machine, Starling, by 2029 with 200 logical qubits. A logical qubit is an error-protected unit built from many physical qubits. Gidney’s 2025 method for RSA-2048 uses about 1,400 logical qubits, seven times the count IBM plans for 2029.
In a December 2022 preprint, Bao Yan and 23 co-authors estimated that “a quantum circuit with 372 physical qubits and a depth of thousands is necessary to challenge RSA-2048” with their algorithm, whose “quantum speedup” they called “unclear.” Aaronson wrote that “a miracle would be required” for the approach to yield any benefit over the classical method the authors built on.
Claims that one product is the answer
For national security systems (NSS), the NSA requires standardized quantum-resistant (QR) algorithms. The agency “does not mandate requirements on any other entity outside of NSS,” it wrote in version 2.2 of its FAQ on CNSA 2.0, its Commercial National Security Algorithm Suite. For those systems, it told owners, “Do not use any non-standardized QR solution on NSS mission systems except for those exceptions NSA specifically recommends to meet standardization or interoperability requirements.”
A hybrid combines a classical algorithm with a post-quantum one. The NSA wrote that it “will not require NSS developers to use hybrid certified products for security purposes,” although “product availability and interoperability requirements may lead to adopting hybrid solutions in specific cases.”
Quantum key distribution (QKD) sends encryption keys over optical links using quantum physics. The NSA wrote that it “does not generally consider QKD a practical security solution for protecting NSS.” Britain’s National Cyber Security Centre (NCSC) wrote in August 2025 that it “will not support the use of QKD for government or military applications.” In other sectors, it advised, QKD “should not be solely relied upon for generating and distributing cryptographic keys.”
The standardized alternative is already shipping. NIST published its first post-quantum standards in August 2024, among them ML-KEM, formerly CRYSTALS-Kyber, for agreeing on encryption keys. By default, Firefox on desktop and Apple’s iOS 26 and macOS Tahoe 26 advertise support for X25519MLKEM768, a hybrid of ML-KEM and a classical method, in TLS 1.3 connections. The Internet Engineering Task Force (IETF) made that hybrid a Proposed Standard in RFC 10024 in August 2026.
Deadlines and threat estimates
| Body | Document and date | Deadline | Source |
|---|---|---|---|
| NIST | IR 8547, final, October 27, 2026 | RSA and elliptic-curve algorithms deprecated after 2030, disallowed after 2035 | NIST |
| White House | Executive Order 14412, June 22, 2026 | Federal high-value and high-impact systems on post-quantum key establishment by December 31, 2030, and signatures by December 31, 2031 | Federal Register |
| NSA | CNSA 2.0 FAQ, v2.2, October 2026 | CNSA 2.0 required in new national security system acquisitions from January 1, 2027, all such systems quantum-resistant “well ahead” of 2035 | NSA |
| UK NCSC | Migration timelines, March 20, 2025 | Plan by 2028, highest-priority migration by 2031, all systems by 2035 | NCSC |
| EU member states | Coordinated roadmap, June 23, 2025 | Start by end of 2026, high-risk use cases by end of 2030, medium-risk by 2035 | European Commission, roadmap |
| Canada | Federal roadmap, June 2025 | Departmental plans by April 2026, high-priority systems by end of 2031, remaining systems by end of 2035 | Cyber Centre |
| Australia | ASD guidance, updated September 2025 | Traditional public-key algorithms retired by end of 2030 | ASD |
Where the agencies estimate when encryption could be broken, they give a range, not a Q-Day date. The authors of the EU roadmap cited a 2024 assessment by Germany’s Federal Office for Information Security (BSI) that a CRQC is likely to be feasible “by 2040 or earlier.” They added that the period could shrink to 10 years if current error-correction heuristics and hardware are fully verified. They wrote that the estimated time to a CRQC is “factored into the dates” for the migration, according to a copy of the roadmap on an Italian news site.
EMVCo, the industry body behind the chip-card specifications, has published a threat estimate but no migration date. In December 2025, it wrote that it does not expect quantum computing to pose a practical threat to the EMV infrastructure “before 2040 – maybe never.”
The agencies’ reasons for acting now are present-day ones. In Executive Order 14412, the White House warned that adversaries may be “collecting United States information now, and decrypting it later.” The European Commission wrote that “store now, decrypt later” attacks, also called harvest now, decrypt later, “are already likely occurring.”
Europol, the EU’s law enforcement agency, reported on October 7, 2026, that it saw no clear evidence yet of systematic harvesting at scale. Given past thefts of encrypted data from high-value organizations, the “prerequisites for future decryption may already be in place,” it added.
Migration time is the other reason. NIST asked hardware makers in IR 8547 to begin integrating post-quantum algorithms immediately, citing lead times for chip design and fabrication. The Government Accountability Office audited 24 federal agencies from February 2024 to September 2025 and found a complete inventory of quantum-vulnerable cryptography at only one of them. GAO reported its findings confidentially in September 2025 and released a public version on October 6, 2026.
Arguments for moving faster
Surveyed experts give the strongest grounds for moving faster. In a report the Global Risk Institute published on March 9, 2026, Michele Mosca and Marco Piani of evolutionQ summarized a survey of 26 experts. They rated a CRQC “quite possible” in the next 10 years and “likely” within 15, labels that GRI attaches to probability bands of 28–49% and 51–70%.
Aaronson wrote in November 2025 that he considered it possible for a fault-tolerant quantum computer to run Shor’s algorithm before the next U.S. presidential election, in November 2028. In a comment four days later, he wrote that he would consider the possibility realized if a fully fault-tolerant Shor’s algorithm were used “even just to factor 15 into 3×5” before that election. A two-digit number would therefore satisfy his test, far short of the 617 digits of an RSA-2048 key.
Gidney cut his own estimate more than twentyfold in six years, from 20 million noisy physical qubits with Martin Ekerå in 2019, in a paper later peer-reviewed, to fewer than 1 million in his 2025 preprint.
The agencies set their high-risk deadlines inside the survey’s 10-year window. NIST deprecates RSA and elliptic-curve algorithms after 2030, and the EU wants high-risk systems moved by the end of 2030, about five years before the end of that window.
Aaronson also agrees with the agencies on the first step. In another comment, he wrote that “anyone for whom it really matters should already be making plans to migrate to post-quantum encryption.”
What would move the dates
Three kinds of evidence would justify moving faster than the agencies ask: a demonstration of logical qubits at the error rates assumed in the RSA-2048 estimates, an agency moving its own deadlines earlier, or a report that harvested data had been decrypted with a quantum computer.
Until then, organizations can treat the published dates as the outer limit of their plans and sequence the work by how long their data must stay secret and how long their systems take to replace. A buyer who hears that encryption is already broken can ask which key was factored, on what machine, and where the result was published. For 2026, the published answers are two RSA challenge numbers, both factored on classical hardware.
