Guide to the Quantum Future: What Will the Future Look Like?

Will the advent of quantum computers (the so-called "Q-day") be a "hard" or "soft" landing?

Based on what we've seen so far, will we likely see a prepared and orderly transition to a world where quantum computers exist and can decrypt cutting-edge classical encryption algorithms at scale? Or will we see a chaotic and abrupt transition, with damaging, costly cyberattacks, and governments and organizations scrambling to secure their IT systems?

At first glance, there appears to be good reason to suspect that the world can expect a "soft" landing. Proponents of this theory often argue [1] that if you contrast the upcoming Q-Day with past cyberattacks, the major difference is that the world has had a long time to prepare and roll out an orderly transition. There is merit to this argument. Major exploits have caused significant economic and political fallout in the past [2], with examples such as ProxyLogon, Log4Shell, Heartbleed [3], and EternalBlue [4] all costing billions of dollars in damages and mitigations. However, these were all events that the world had essentially no time to prepare for in advance, with some zero-days such as ProxyLogon likely being extensively exploited prior to public disclosure.[2] Q-Day, the argument goes, could well entail costs, and might take various organizations off guard, especially if advances in quantum hardware occur faster than expected. However, the world will likely be much better prepared, and the damage will be far more contained, possibly resembling the Y2K transition.

However, others argue that this view misconstrues the nature of the vulnerabilities in question. While it’s true that past zero-day exposures have been significantly costlier because of the lack of advance warning, a comparison to well-known zero-days of the past is misleading. In the four examples cited above, among others [2], the flaws existed in popular code bases, and once identified, could be comprehensively patched in relatively short order. While these patches could be developed quickly, the deployment, their deployment is inconsistent and depends heavily on the infrastructure, maturity, and cost of patching per entity.

A better comparison point, the "hard landing" camp argues, is something like the Spectre or Meltdown hardware attacks against speculative execution. Unlike vulnerabilities like EternalBlue or Log4Shell, these were not simply software vulnerabilities for which updates and patches could be pushed, but deep structural flaws in the entire edifice of modern CPU architecture.[5],[6] Mitigations could be developed, sure, but these were almost always partial, could only be applied in some domains, and would impose significant performance penalties if adopted.[7] Quantum-resistant encryption is likely to share many of these characteristics as well: certain sectors will be much more able to adopt mitigations than others, performance penalties will certainly exist, and the mitigations will reduce but not eliminate the risks.

While we won't be able to know until Q-Day arrives, in the authors' opinion, the reality is likely to be somewhere between these two outcomes. Structurally, upgrading the world's encryption standards to be quantum-resistant is likely going to be much more like Spectre and Meltdown than Heartbleed or Log4Shell. Many systems will be unpatchable or difficult to patch due to latency, hardware, or power constraints, and there will be significant performance penalties that will unevenly impact different sectors. However, unlike Spectre and Meltdown (or the above-listed software vulnerabilities), the world has had decades to prepare for the advent of quantum algorithms. Although the fixes will structurally look similar, due to the long runway to develop mitigations, we believe that the transition to a quantum-resistant world will likely be more orderly. However, this relies on a few assumptions.

How "quantum resistant" are the new algorithms now being adopted?

At the time of writing, the National Institute of Standards and Technology (NIST), has officially approved three "quantum-resistant" asymmetric (public key) algorithms for future use: FIPS 203 (ML-KEM) [8], FIPS 204 (ML-DSA) [9], and FIPS 205 (SLH-DSA) [10]. A fourth, FIPS 206 (FN-DSA also known as Falcon) [11],[12] is in development, and scheduled for review and approval sometime in 2026-2027. Currently, no symmetric encryption algorithms are under active review or development by NIST. This is because the only existing quantum algorithm that affects the current standard symmetric encryption algorithms (AES-128/192/256) is Grover's algorithm. While significant, this only provides a modest, quadratic speedup in brute-force key search speeds, and therefore doesn't require a comprehensive redesign of the algorithms in use for symmetric-key problems. However, there is no guarantee that further improvements on Grover's algorithm won't occur in the future, so this could easily change!

In terms of the newly adopted asymmetric-key algorithms, how robust they will be to future quantum decryption efforts is obviously an open question, and one that will require significant research in the future. Unfortunately, a deep exploration of the algorithms is beyond the scope of this article. However, we can look at the assumptions and components at a high level to make some predictions. ML-KEM, ML-DSA, and FN-DSA are all lattice-based algorithms [13] that rely on Module Learning-with-Errors (Module-LWE), Module-SIS, or NTRU lattices for their security. If a quantum algorithm were discovered that broke those modules, the security of all these algorithms would likely be compromised. This is a very much an open question however, and no such algorithms currently exist, but this is not guaranteed to remain the case.

The most practically quantum secure algorithm is SLH-DSA. SLH-DSA is a stateless hash-based signature scheme. Its design builds a large binary Merkle tree of hash-based one-time signatures. Each leaf of the Merkle tree is a public key for a small one-time signature, and the tree's root is the SLH-DSA public key.[10] In simple terms, the "hardness" of the algorithm reduces to the hardness of the hash function. Currently, Grover's algorithm is the only algorithm giving quantum computers an advantage in this regard, and only a relatively modest one at that. However, there is no proof that Grover's algorithm could not be improved on, and if future improvements do occur, SLH-DSA could find itself being much less quantum-resistant than anticipated.

How has the transition to a post-quantum internet been going to date?

Although the process is still in its early stages, significant progress is being made, and a roadmap is being developed. As noted above, NIST has adopted three quantum-resistant algorithms already [14], a fourth is being reviewed, and a fifth (HQC) was selected in 2025 [15]. In addition, the US National Security Agency has published requirements with a phased compliance schedule as the Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) [16]. This is a guideline for organizations to transition to using quantum-resistant encryption standards, following the NIST guidelines. The transition began in 2022 with future milestones set through 2025-2027 by product category, and full transition is projected for 2030-2033 depending again on the product category. This lines up broadly with the currently projected estimates for when quantum hardware capable of cracking modern classical encryption algorithms will exist, so from a theoretical perspective, it seems like a reasonable timeline.
Adoption, while currently extremely uneven, is starting with critical systems in high-priority sectors such as government, finance, and military, and spreading out to lower-priority sectors as time goes on.[17] Additionally, other organizations such as the IETF have rolled out recommendations and some companies have adopted these changes to harden commonly used infrastructure such as TLS,[18] although how successful these efforts beyond large entities will be remains to be seen.

Clearly, there are still a huge number of unknown variables that will dictate how smooth the transition to a post-quantum world is, many of which rely on scientific breakthroughs that haven't yet occurred, and decisions at the governmental, organizational, and individual levels that haven't been made yet. However, the post-quantum world is coming, regardless of how well people prepare for it.

What can we anticipate may change about computer security once quantum computers become a reality?

One problem that will likely become significantly more pressing is the "harvest now, decrypt later" problem. Most secrets have a "half-life": their sensitivity degrades over time, as knowledge of their existence slowly leaks, the details become less relevant, or the sensitive timelines they were needed for pass and they become worthless. However, there are many secrets which have a long half-life, where many years after their creation and encryption they are still important and their disclosure would cause significant problems. In the age of electronic communications, most organizations rely on encryption to protect their secrets. However, this does nothing to prevent a potential adversary from recording the encrypted messages, hoping that in the future, advances in cryptanalysis will render problems that are insurmountable today crackable. Quantum computing threatens to significantly speed up this timeline. This could be a significant issue for governments, companies, and other organizations, as almost all the world's encrypted traffic relies on non-quantum-resistant algorithms for security. In the next decade, almost any secret transmitted via a commonly used channel could be far more decryptable depending on the speed of various hardware advancements. Worse yet, there are few good workarounds for this, short of desisting from electronic communication. Organizations will have to prepare for a world where long-term secrets may be much easier to uncover, provided someone recorded them before the adoption of quantum-resistant encryption. This is not a new problem, but the speed at which it will occur will likely increase over what was expected in the past.

Another significant issue will be with embedded devices and the "Internet of Things". Low-powered devices will likely be much more at risk than other types of devices. This is mainly due to things like memory, power, and latency constraints, as many quantum-resistant algorithms will likely consume more power and memory, as would increasing the key size on a classical algorithm. On top of this, many low-powered and IoT devices face existing security issues that will make adoption difficult. Many are chosen with price in mind rather than security, many are poorly documented, run on legacy or cheap hardware, and lack update pipelines (or in some cases the ability to receive updates). This will likely mean that the quantum revolution won't be evenly distributed. Certain large, well-resourced organizations with significant compute and well-developed update systems will likely be able to weather the transition, whereas smaller, poorer organizations more dependent on cheaper and lower-power hardware could struggle.

Finally, once quantum computers become a practical reality, it is likely that encryption algorithms will break much more "quickly" than in the past. It will take decades for Shor's algorithm and Grover's algorithm to go from theory to practice, if current projections hold. In the future, if a breakthrough is achieved in quantum cryptanalysis, it will likely go from theory to practice very quickly. It is possible governments and other near-nation-state actors may be able to suppress or hoard knowledge of quantum advances long enough to snoop on their adversary's traffic for a time. Maybe they already do.

Although upgrading the world's encryption infrastructure is a massive, complex problem, significant resources are going into the transition. As with everything, only time will tell how successful these efforts will be. However, the world has the technical know-how to devise likely workable solutions, and time to implement them. If taken seriously, this is a problem that should be costly but manageable.