The math that secures today's internet — and the new math built to survive quantum computers.
The Big Idea
Almost everything secret on the internet — your messages, passwords, bank logins, and every cryptocurrency wallet — is locked with math problems that are easy to check but practically impossible to reverse on a normal computer. A large quantum computer changes the rules: it can run brand-new algorithms that crack some of these locks in hours instead of trillions of years. Post-quantum cryptography (PQC) is the new math we are switching to so our locks stay shut.
Head to Head
Two completely different families of hard problems.
Security rests on number theory that is hard for ordinary computers.
Security rests on problems hard even for quantum computers.
The Threat
Shor's algorithm (1994) finds the hidden period of a function using a quantum Fourier transform. That single trick lets it factor big numbers and solve discrete logs in polynomial time — demolishing RSA, Diffie–Hellman and ECC.
Grover's algorithm (1996) searches an unsorted space of N items in only √N steps. It does not break symmetric crypto — it just halves the security level, so we respond by doubling key sizes.
At a Glance
| Today's algorithm | Job | Quantum attack | Status | Post-quantum replacement |
|---|---|---|---|---|
| RSA-2048 | Key exchange / signatures | Shor | Broken | ML-KEM (Kyber), ML-DSA (Dilithium) |
| ECC P-256 | Signatures (incl. Bitcoin) | Shor | Broken | ML-DSA (Dilithium), Falcon, SPHINCS+ |
| Diffie–Hellman | Key exchange | Shor | Broken | ML-KEM (Kyber) |
| AES-128 | Encrypt data | Grover | Weakened | AES-256 |
| SHA-256 | Hashing (integrity, signatures) | Grover | Mostly safe | SHA-384 / SHA3-512 |
| SHA-256 | Proof-of-work mining | Grover (partial preimage) | Economics shift | No drop-in fix — see below |
Names like ML-KEM and ML-DSA are the official NIST standard names (FIPS 203 & 204) for the algorithms first known as Kyber and Dilithium.
Calling SHA-256 “mostly safe” is fair for hashing: Grover's algorithm turns a 2256 preimage search into roughly 2128 operations, which is still far out of reach. The hash function itself is not the worry.
Mining is a different question, because what proof-of-work needs is not an unbroken hash — it is a widely distributed trust base. A blockchain is secure because no single entity, or small group, controls enough hashing power to rewrite history. Mining is a partial preimage search (find a nonce whose hash starts with enough zeros), and Grover speeds that up too.
So the risk is not that Bitcoin's hash breaks. It is that if a handful of organisations were the only ones holding large fault-tolerant quantum computers, the economics of mining would tilt sharply towards them — and concentrated hashing power is precisely what the security model assumes will not happen.
How big that tilt would be is genuinely debated. Grover parallelises poorly — running it across many machines gives far less than a linear return — so several researchers argue the practical advantage is modest, and that error-corrected quantum hardware would be slow per operation for a long time. The honest summary is that this changes an assumption the system rests on, and the size of the effect is still an open question.
Fun Graphic
Longer bar = safer. Watch how a quantum computer flattens the classical bars.
The Detailed Math
Pick two large primes p and q. The public modulus is their product:
To break it you must recover p and q from n. Shor turns factoring into period finding: find the smallest r with ar ≡ 1 (mod n), which a quantum computer does efficiently.
Points live on the curve y2 = x3 + ax + b (mod p). “Multiplying” a base point G by a secret k is easy; reversing it is the hard ECDLP:
That O(√n) figure assumes the curve is well chosen. n is the largest prime factor of the group order, not the field prime p. On a curve whose order factors into small primes, Pohlig–Hellman drops the cost to the largest factor alone; on an anomalous curve, where the order equals p, the problem falls to a polynomial-time attack. The conditions a curve must satisfy →
Bitcoin and Ethereum sign every transaction with ECC (secp256k1). This is exactly why people ask whether quantum computers could one day steal coins.
A lattice is a grid of points stretching through high-dimensional space. Finding the shortest vector is brutally hard — even for quantum machines. Learning With Errors (LWE) hides a secret with a little random noise:
Kyber (encryption) and Dilithium (signatures) are both built on this idea. The noise e is what makes the system impossible to “solve like a normal equation.”
These trust only a hash function. If your hash is secure, your signature is secure — no number theory for Shor to attack. They build a giant tree of one-time keys (a Merkle tree) so one master public key can sign many messages.
Try It
Pick an algorithm and see how a quantum computer changes its real security.
The Road Ahead
Classical crypto isn't “wrong” — it's just built on problems a quantum computer can shortcut. Post-quantum crypto swaps in problems (lattices, hashes, codes) that both classical and quantum computers find hard. Same goal, tougher math.