When will a quantum computer that breaks RSA arrive?

No one knows for sure; estimates range from one to several decades. But the arrival date isn't what matters: because of 'harvest now, decrypt later', data that must stay secret 10-20 years from now is already at risk today, since an adversary can store your encrypted traffic and wait.

Which algorithms should I use?

The ones NIST standardized in 2024: ML-KEM (FIPS 203, formerly Kyber) for key encapsulation and ML-DSA (FIPS 204, formerly Dilithium) for signatures; SLH-DSA (FIPS 205) for hash-based signatures. Falcon (FN-DSA / FIPS 206) is still a draft as of 2026.

Is symmetric cryptography like AES also broken?

Not by Shor. Grover's algorithm only gives a quadratic speedup, which you neutralize by doubling the key size: AES-256 stays secure. The quantum problem is asymmetric encryption (RSA, ECC, Diffie-Hellman).

Should I migrate now or wait?

Migrate now anything with a long confidentiality horizon, and do it in hybrid mode (classical + post-quantum) so you don't depend on a single scheme: hybrid protects you even if one of the two fails.

What is post-quantum cryptography, and why should you migrate now?

The cryptography that protects your data today —keys, HTTPS, signatures— rests on mathematical problems that today's computers can't solve in a reasonable time. A large enough quantum computer could solve some of them. That is post-quantum cryptography: algorithms designed to resist both classical and quantum computers.

The threat isn't only in the future

You might think: "there's no quantum computer that breaks my encryption yet, so I can wait." The problem is an attack called "harvest now, decrypt later":

An adversary captures your encrypted traffic today and stores it. When quantum capability arrives in a few years, they decrypt it.

If your data must stay secret ten years from now (medical records, trade secrets, personal data), the threat is present, not future. The data you encrypt today with classical cryptography could be read tomorrow.

The new NIST standards

NIST (the U.S. standards body) finalized the first post-quantum algorithms in 2024, after years of public analysis:

ML-KEM (formerly CRYSTALS-Kyber): for key exchange — how two parties securely agree on a shared secret.
ML-DSA (formerly CRYSTALS-Dilithium): for digital signatures — how to verify that a message is authentic and untampered.

These are no longer academic experiments: they are standards that governments and large companies are starting to require.

Hybrid encryption: the prudent approach

Post-quantum algorithms are new, and "new" in cryptography means "less battle-tested." That's why today's best practice is hybrid: combine a well-established classical algorithm with a post-quantum one. The result breaks only if both fall at once. You gain post-quantum protection without giving up decades of trust in classical cryptography.

Where to start?

Inventory where you use cryptography and which data must last for years.
Prioritize long-lived data at rest (the most exposed to "harvest now").
Adopt hybrid encryption instead of wholesale replacements.
Use libraries that compose verified primitives, not home-made cryptography.

That last point is key, and it's the philosophy behind Quipu, a free hybrid post-quantum encryption library for data at rest. If you want to protect your data against the quantum threat, let's talk.