Will Quantum Computers Crack Encryption? RSA, ECC & Post-Quantum Cryptography Explained

Quantum computing is often described as a future threat to encryption. That description is directionally right, but incomplete. A sufficiently capable quantum computer could undermine important public-key systems that protect websites, VPNs, certificates, software updates, and secure messaging. It would not instantly break every cipher or make all encrypted data readable at the push of a button.

The practical lesson is more important than the headline: organisations cannot wait for the first cryptographically relevant quantum computer to appear before they start planning. NIST has already finalised post-quantum cryptography standards, and the migration from old algorithms can take years.

What changes when computing becomes quantum?

A classical computer stores information as bits, represented as zero or one. A quantum computer uses qubits and manipulates quantum states with operations that have no direct classical equivalent. The advantage is not that a quantum computer simply tries every answer at once and reads all the answers back. Useful quantum algorithms shape probabilities and interference so that the right kind of answer becomes easier to identify.

That distinction matters for cybersecurity. Quantum computers are not universal password-breaking machines. Their advantage depends on the mathematical structure of the problem and on whether a useful quantum algorithm exists. Two algorithms dominate the encryption discussion: Shor’s algorithm for certain public-key problems, and Grover’s algorithm for unstructured search.

How Shor’s algorithm could crack RSA and ECC

RSA relies on a one-way problem: multiplying two large prime numbers is easy, while recovering those prime factors from the product is computationally difficult for ordinary computers. The security of several RSA operations depends on that asymmetry.

Diffie-Hellman and elliptic-curve cryptography use a related idea. It is easy to perform a one-way operation such as exponentiation or elliptic-curve multiplication, but difficult for a classical attacker to reverse it. The reverse problems are called the discrete logarithm problem and the elliptic-curve discrete logarithm problem.

Shor’s algorithm provides a quantum method for solving integer factorisation and discrete logarithms much faster than the best known classical methods. A cryptographically relevant quantum computer running that algorithm could therefore recover private keys from public information, derive session secrets, decrypt captured traffic, or create fraudulent digital signatures.

This is why the problem is broader than “RSA encryption”. The same public-key families appear throughout a modern network:

• TLS: certificates, key exchange, and authentication for HTTPS and APIs.
• VPNs: IKE, IPsec, and other protocols that use public-key operations to establish trust or session keys.
• PKI: certificate chains and certificate authorities that prove which systems or people are trusted.
• Code signing: signatures that devices use to decide whether firmware or software is authentic.
• Secure messaging: key agreement and identity signatures that protect private conversations.

Which encryption is vulnerable to quantum attacks?

The table is a planning guide, not a substitute for a cryptographic assessment. A protocol can be vulnerable even when the bulk data cipher is strong, because an attacker may target the key exchange, certificate signature, random-number generation, or long-term private key instead.

Does a quantum computer crack AES?

Symmetric encryption is affected differently. Grover’s algorithm can speed up an exhaustive search for a secret key by roughly a square-root factor in idealised conditions. That is a meaningful reduction in the brute-force cost, but it is not the exponential collapse associated with Shor’s algorithm against RSA or ECC.

In simple terms, a key with a classical security level of roughly 128 bits may offer a lower quantum security level under the idealised Grover model. AES-256 therefore provides a larger margin than AES-128 for long-term protection. Real attacks also have to account for error correction, circuit depth, hardware overhead, implementation details, and whether the attacker can use the required oracle. This is why the migration priority is usually public-key cryptography first, while symmetric key sizes and hash choices remain part of the wider review.

Harvest now, decrypt later

Some encrypted information is valuable for much longer than the life of the system that created it. An attacker can copy encrypted traffic or stored files today, keep the ciphertext, and wait for better cryptanalytic capability. If a future quantum computer can recover the private key or session secret, the old capture may become readable.

This is known as harvest now, decrypt later. It changes the timeline. A company does not only need to protect data from a quantum computer that exists today; it needs to protect information whose confidentiality period extends into the future. Examples include health records, sensitive research, intellectual property, diplomatic material, credentials, and long-lived industrial or infrastructure designs.

Not every organisation has the same exposure. The right questions are: how long must this data remain secret, where is it encrypted, which public-key algorithms are involved, and how long would replacement take? Those answers make the quantum risk concrete instead of speculative.

What is post-quantum cryptography?

Post-quantum cryptography (PQC) uses algorithms that run on ordinary computers but are designed to resist known attacks from both classical and quantum computers. It is different from quantum cryptography: organisations can deploy PQC through software, libraries, protocols, certificates, and hardware updates without needing a quantum network.

NIST published its first three final PQC standards in 2024:

• FIPS 203 / ML-KEM: a key-encapsulation mechanism for establishing shared secrets over an untrusted network.
• FIPS 204 / ML-DSA: a lattice-based digital signature standard for authentication and integrity.
• FIPS 205 / SLH-DSA: a stateless hash-based digital signature standard using a different mathematical foundation.

NIST has also selected HQC as a backup key-encapsulation algorithm based on error-correcting codes. HQC is intended to complement, not replace, ML-KEM, and its final standard is still being developed. That is a useful reminder that cryptographic migration is about agility: systems should be able to replace algorithms without redesigning every application from scratch.

Read the current standards and project status in NIST’s Post-Quantum Cryptography project, and see the rationale for HQC in NIST’s HQC announcement.

How organisations should prepare

A sensible PQC programme is an inventory and upgrade project, not a last-minute algorithm swap. The exact implementation belongs with the system owner and cryptographic experts, but the sequence below is a useful starting point for security and network teams:

1. 1. Build a cryptographic inventory: Find RSA, Diffie-Hellman, ECDH, ECDSA, certificates, VPNs, TLS endpoints, code-signing keys, libraries, appliances, and embedded devices.
2. 2. Classify data by secrecy lifetime: Prioritise information that must remain confidential for years or decades, especially data that crosses networks or is stored by third parties.
3. 3. Talk to vendors early: Ask for post-quantum roadmaps, supported protocol versions, firmware plans, certificate options, and performance measurements.
4. 4. Design for crypto-agility: Keep algorithm choices configurable and avoid hard-coding one key type into applications, certificates, device images, or operational procedures.
5. 5. Test hybrid migration paths: Many transitions begin with a classical and post-quantum combination so interoperability can be measured while systems are upgraded. Validate packet sizes, latency, CPU use, failure modes, and rollback.
6. 6. Replace and monitor: Move to approved standards when your platform supports them, retire vulnerable algorithms on a controlled schedule, and continue tracking new cryptanalysis and standards guidance.

What this means for network engineers

Network engineers do not need to become cryptographers to understand the operational impact. The important distinction is between the algorithm protecting the bulk data and the public-key mechanisms that establish identity or negotiate a session.

When reviewing a TLS service, VPN concentrator, wireless authentication system, PKI deployment, or network-management platform, ask which algorithms are used for key exchange and signatures. Check certificate lifetimes, device upgrade paths, supported firmware, packet-size assumptions, and whether monitoring can identify old cryptographic handshakes. A future-proof design should make cryptographic replacement a planned change rather than an emergency rebuild.

For CompTIA Network+ and Security+ learners, quantum computing is best understood as a cryptography and risk-management topic: public-key algorithms based on factoring and discrete logarithms are the main concern, symmetric encryption is affected differently, and post-quantum migration is already a standards and systems-engineering task.

Frequently asked questions

Further reading

• NIST: What Is Post-Quantum Cryptography?
• NIST NCCoE: Migration to Post-Quantum Cryptography
• NIST CSRC: PQC standards and migration status