Two years ago, after the hack of major US telecom operators attributed to the Salt Typhoon group, CISA advised citizens to encrypt their communications: even if someone intercepted them, reading them would be “impossible” (NBC News). It was true, and it still is today. The question is for how long: the Electronic Privacy Information Center (EPIC) has already warned that the arrival of quantum computing makes it increasingly attractive to intercept encrypted data in order to read it later. 

This time, standards, timelines and governments are already responding to the threat. The bad news is that migrating the cryptography of an entire digital ecosystem takes years, and artificial intelligence is speeding up the clock on both sides. 

The quantum attack has already begun, even though the computer that will carry it out hasn’t started working yet. Harvest now, decrypt later: copying encrypted data that can’t be read today, storing it and waiting until a quantum computer is able to open it. 

From Enigma to RSA: how we protect information today (and what quantum computing changes) 

Encryption is, in essence, turning a message into something unreadable with the help of a key. During the Second World War, the security of the Enigma machine rested on an astronomical number of possible combinations. The arrival of the computer changed everything: the first programmable computer was designed precisely to decrypt Axis communications. 

Methods had to evolve. In the 1970s, asymmetric encryption was born: a public key that anyone can know and a private key that only its owner keeps. It solved the old problem of how to exchange keys securely, and its strength no longer depends on a shared secret but on the difficulty of certain mathematical calculations. RSA and elliptic curves are built on that principle, and with them online banking, email, digital certificates and electronic signatures. 

This is where quantum computing comes in. A classical computer works with bits that are either 0 or 1; a quantum computer works with qubits, which exploit properties such as superposition and entanglement (NIST). The most common explanation needs debunking: it is not a computer that “tries every combination at once”. It is a different kind of machine, extraordinarily good at a handful of very specific problems. The problem for cybersecurity is that those problems include precisely the calculations that underpin asymmetric encryption. 

Not everything is a threat: the same technology that promises breakthroughs in chemistry, materials and artificial intelligence is the one forcing us to rethink how we protect data. And progress is already being made: in Europe, San Sebastián-based Multiverse Computing has already run layers of a language model on an IBM quantum processor. 

Shor, the 1994 algorithm still waiting for its machine 

In 1994, mathematician Peter Shor showed that a quantum computer could factor huge numbers and compute discrete logarithms efficiently. These are exactly the two problems that underpin RSA and elliptic curves. Commander Yoann Guglielmetti, author of an analysis published by Spain’s Ministry of Defence, illustrates it with a comparison: with today’s keys, a supercomputer would need thousands or millions of years to factor, whereas the cost of Shor’s algorithm grows far more modestly. Thirty years on, the algorithm is still waiting for a machine large enough to run it. 

In 1996 came Grover’s algorithm, which speeds up blind searches. For years it was said that this “cut in half” the security of symmetric encryption. The US National Institute of Standards and Technology (NIST) qualifies this in its FAQ: it considers it very likely that Grover offers little or no real advantage against AES (Advanced Encryption Standard), the symmetric encryption standard that protects everything from web connections to hard drives. The reason is that the attack can’t be efficiently split across multiple machines, which is why NIST expects even AES-128 to remain secure for decades. Cryptographer Filippo Valsorda describes this as an almost unanimous consensus among experts and standards bodies. 

There is one detail that explains everything: the padlock holds, but the key travels in an envelope that can be opened. In an encrypted connection, the data is protected with symmetric encryption, but the key for each session is agreed using asymmetric cryptography. Anyone who breaks that exchange with Shor recovers the key without touching the padlock. That is exactly what harvest now, decrypt later exploits, and the reason why Cloudflare started its migration with key exchange. The same applies to apps such as WhatsApp, which is why Signal and iMessage already protect that step with post-quantum cryptography (Apple). 

When will Q-Day arrive? What the numbers say (and what they don’t) 

Q-Day is the day a quantum computer capable of breaking today’s encryption exists. Nobody knows when it will come, but we do know which way the estimates are moving: down. 

In 2019, Craig Gidney (Google Quantum AI) and Martin Ekerå calculated that breaking an RSA-2048 key would require around 20 million qubits working for eight hours. In May 2025, Gidney himself cut that figure to fewer than one million qubits in less than a week. In February 2026, a preprint from Iceberg Quantum, not yet peer-reviewed, put it below 100,000 with a different architecture (The Quantum Insider). 

Now for the other side of the story. All of these reductions have happened on paper: they come from better algorithms and new ways of correcting errors, not from machines that already exist. Qubits are extremely fragile, to the point that each “useful” qubit may require on the order of 10,000 physical qubits just for error correction, according to a study published in EPJ Quantum Technology. As of today, no quantum computer has broken a real RSA key. 

Forecasts vary too. Gartner places the point at which conventional asymmetric cryptography will no longer be safe in 2029. By contrast, a panel of 37 experts surveyed by the Global Risk Institute considered such a computer extremely unlikely within five years, but very likely within thirty. 

In communications, we know that a threat without a date is the hardest one to tell: it has no headline. That is why Q-Day has been “ten years away” for decades, and why every new paper that lowers the figure ends up as a “Bitcoin broken in nine minutes” headline. Neither helps anyone decide, but the time to act is now. 

Harvest now, decrypt later: the theft that pays off later 

An attacker copies encrypted data today that they can’t read: communications, records, identity data. They don’t throw it away: they store it. A few years from now, a quantum computer breaks the key and the archive opens. The attack is carried out in the future, but the capture happens today. 

It isn’t even a new idea. Between 1943 and 1980, the US Venona project worked to decrypt Soviet telegrams intercepted during the Second World War. The first major breakthrough came in 1946, years after the messages had been sent, and the program ended up exposing Soviet espionage on the Manhattan Project and the Rosenberg spy ring (NSA; Center for Cryptologic History). No quantum computer was needed. It was enough to store the traffic and wait for the adversary to make a mistake: reusing key pads that were meant to be used only once. 

When should we start worrying? Mathematician Michele Mosca, of the University of Waterloo, summed it up in an inequality that regulators and security leaders use today (IACR, 2015; IEEE Security & Privacy, 2018): 

X + Y > Z 

X is the time a piece of data must remain protected. Y is how long it takes an organization to migrate its cryptography. Z is how long until a quantum computer capable of breaking it exists. If the first two add up to more than the third, the problem already exists, even though the computer doesn’t. That is why armed forces were among the first to run the numbers: they handle information that must remain secret for decades. 

The math is simple. If data needs to stay confidential for ten years and migration takes five, any Q-Day less than fifteen years away turns the risk into a present one. 

Trust today, forge tomorrow: the less-told angle 

Harvest now, decrypt later is about secrets. But asymmetric cryptography is also used for something else: signing. It is how we prove that a certificate, a contract, a software update or an identity document is authentic. And here the risk changes shape: what is signed today could be forged tomorrow. 

It’s worth being precise. In a live connection, the signature matters at that moment, and no one can impersonate a conversation after it has ended. The problem lies in what is signed to last: certificates valid for years, identity documents, contracts or a device’s firmware. That is why the UK’s NCSC asks organizations to include long-lived hardware roots of trust in their migration plans, and warns that authentication will not be quantum-safe until traditional certificates have expired or been revoked. 

What does that look like in real life? We have already had a dress rehearsal. In 2017, an international team of researchers discovered ROCA, a flaw in the RSA key generation of certain Infineon chips. It was not a quantum attack, but it made it possible to derive the private key from the public key: exactly what a quantum computer would do at scale. 

Estonia, Europe’s most digitalized state, had around 800,000 affected identity documents, belonging to more than half of its population (Information System Authority). The government blocked the certificates of 760,000 of them on November 3, 2017 (Government of Estonia). Its prime minister, Jüri Ratas, justified the move with an idea that sounds prophetic today: a digital state runs on trust and cannot afford the identity theft of its citizens (AFP). 

The Estonian authority notes that the flaw also affected Spain, Austria and Slovakia. In Spain, the National Police disabled the electronic signature of DNI 3.0 cards, the electronic version of the Spanish national identity document, with chips issued since April 2015 (INCIBE-CERT; Vozpópuli), in a crisis that, according to published estimates, could have affected more than 17 million documents (Xataka). The most unsettling detail was pointed out by experts in the press: because the system did not timestamp each signature, it was impossible to know when each document had been signed. That is exactly what “forge tomorrow” means. 

If you want to watch the debate unfold live, just look at Bitcoin. Its signatures use elliptic curves, and every time someone spends from an address, their public key is recorded on the chain forever. A paper by Google Quantum AI with Stanford and the Ethereum Foundation, published in March 2026, estimated that breaking those curves could require fewer than 500,000 physical qubits (The Quantum Insider), and that with work prepared in advance, around nine minutes per exposed key would be enough (Google Quantum AI), compared with the ten minutes an average block takes. The community’s response, the BIP-360 proposal, keeps public keys off the chain until the moment of spending. Another way of reaching the same conclusion: migration can’t be improvised. 

AI and automation: the missing accelerator in the equation 

Until recently, the quantum threat and artificial intelligence were told as separate stories. In 2026 that is no longer possible: AI is speeding up the clock in three ways. 

AI as cryptanalyst. In July, Anthropic announced that one of its models had found a weakness in HAWK, a post-quantum signature algorithm that NIST was evaluating for standardization (Anthropic). Its authors withdrew it from the process. NIST itself notes this on its reference page and clarifies that the finding does not affect the standards already published, such as ML-KEM and ML-DSA. There are two takeaways: the review process worked, and AI is already part of it. 

AI as attacker. In November 2025, Anthropic documented the first cyber-espionage campaign orchestrated largely by AI agents, which it attributed with high confidence to a Chinese state-sponsored group (Anthropic report). The agents carried out between 80% and 90% of the tactical tasks, from reconnaissance to credential theft and data exfiltration, against around thirty organizations worldwide (CPO Magazine). The report acknowledges a limitation: the AI overstated its findings and sometimes fabricated data. For our purposes, the takeaway is a different one: the harvesting phase can already be automated. 

Access within everyone’s reach. In October 2026, a tutorial posted on X passed one million views explaining how to set up, in about ten minutes, a team of five AI agents with access to data, compute and execution through a single connection and an API key. Its purpose is legitimate (financial research), and it devotes an entire section to what the agents cannot do. But it illustrates a change of scale: every agent, every key and every connection means more encrypted traffic that someone can store today, and more machine identities that will need migrating tomorrow. 

In communications, we would say that AI has changed the format of the threat: you no longer need a team of specialists to harvest; orchestration is enough. And here too, security is first and foremost a design decision. 

The standard already exists; the problem is the migration (crypto-agility) 

In August 2024, after an eight-year international process, NIST published its first three post-quantum cryptography standards: FIPS 203 (ML-KEM), for key agreement, and FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA), for signatures. The agency insists that they can and should be used now, is still studying backup algorithms such as HQC and Falcon, and plans to remove vulnerable algorithms from its standards by 2035, with high-risk systems well before that (NIST CSRC). 

History, however, tells us these transitions are slow. SHA-1 was standardized in 1995; NIST deprecated it in 2011 and prohibited it for digital signatures in 2013 (Dark Reading). In 2017, researchers from CWI Amsterdam and Google demonstrated the first practical attack against it. Even so, NIST will not consider it fully retired until December 31, 2030: 35 years from its arrival to its final retirement. Something similar is happening with TLS 1.3: it was published in 2018, and part of internet traffic still uses the previous version today (Cloudflare Radar). 

Some progress gives cause for optimism. More than 65% of human traffic passing through Cloudflare’s network is already protected with post-quantum encryption, without users having to do anything (Cloudflare). The company has set 2029 as its target to complete authentication as well, the same year as Google, and it puts it bluntly: if Q-Day is approaching, a data leak is serious, but broken authentication is catastrophic. 

That is why every framework repeats the same word: crypto-agility. For years, classical and post-quantum algorithms will coexist, and the NCSC guidance calls for systems able to switch algorithms without being rebuilt from scratch. It is not just about making it in time for this migration, but about being ready for the next one. 

Governments are already making their move 

If the technology has no date, regulation does. In just two years, the conversation has moved from the labs to the supervisors, and governments have already stepped up. 

The most candid figure comes from Hong Kong. The monetary authority surveyed its banks and gave them a 2.3 out of 10: 32% of institutions had not started the transition, and nearly half had no formal roadmap (South China Morning Post). The index measures four dimensions, from awareness to practical readiness, and comes with a toolkit to help institutions prioritize (HKMA). 

The most telling warning comes from Europe. When announcing their agreement on October 23, Banco de España and Banco de Portugal noted that an uncoordinated migration could create systemic risks, because banks and supervisors share providers, market infrastructure and interoperability dependencies (CriptoNoticias). In other words, quantum has stopped being each company’s own problem and has become a systemic risk. Nobody migrates alone. 

A face can’t be reset: why identity is the most exposed data 

Let’s go back to Mosca’s inequality and look at X, the time a piece of data must remain protected. A chat message stops mattering within weeks; a contract, within years. But a face, a fingerprint, a date of birth or a document number stay with a person for life. Identity data is the longest-lived and most sensitive data of all, and that puts it at the center of harvest now, decrypt later. The NCSC guidance itself asks organizations to classify data by its lifespan and its value to an adversary. Few kinds of data score as high on both. 

We discussed this in our analysis of the Morocco data leak. The quantum threat adds an even more uncomfortable layer: the personal data that leaks ten years from now may already be circulating today, encrypted, on the hard drive of someone who is simply waiting. 

Certificates, credentials and digital identity wallets all rely on electronic signatures. An academic analysis of the European Digital Identity Wallet points out that its prototypes use signatures and authentication mechanisms that will need to be replaced with post-quantum cryptography (Scuola Superiore Sant’Anna). What is issued today to last for years will need to remain trustworthy when Q-Day arrives. 

That is why, in the face of this latent decryption, protection is not just about encrypting a message better. It is about safeguarding the entire lifecycle of a person’s data: how it is captured, how it is stored securely and who controls its use. The goal is simple to state and demanding to meet: when the decrypt later moment comes, there should be nothing useful left to decrypt. 

Anticipate instead of react 

The quantum attack on identity has already begun, even though the computer that will carry it out hasn’t started working yet. From there, the challenge is to migrate to quantum-resistant cryptography without leaving gaps along the way. 

That requires anticipating instead of reacting, and protecting the entire lifecycle of identity, from capture to control of its use, not just the moment of verification. That is why at Facephi we believe in continuous identity: treating identity as a signal that is protected and verified throughout its life, not as a file stored away in a drawer. 

For any organization, the path set out by NIST, the NCSC and the G7 comes down to five steps: 

• Take inventory. Know where public-key cryptography is used: applications, suppliers, devices and APIs. The NCSC sets 2028 as the date for having that map and a plan in place. 

• Prioritize by lifespan. Start with the data that must stay protected the longest, with identity data at the top of the list. 

• Deploy in hybrid mode. Combine classical and post-quantum algorithms while the ecosystem matures, as major browsers and content delivery networks already do. 

• Build crypto-agility. Design systems that can switch algorithms without being rebuilt, because this will not be the last migration. 

• Ask the supply chain, and the agents. Require a post-quantum roadmap from suppliers and treat AI agents’ identities for what they are: new credentials that will also need to be migrated. 

The quantum threat has moved from the labs to the supervisors, with deadlines, indices and agreements between central banks. Industry has shown that migration at scale is possible without users noticing, and artificial intelligence has entered the game to accelerate attackers and defenders alike. History, from Venona to ROCA, also leaves us two lessons worth remembering: what is captured does not expire, and migration always takes longer than planned. 

We shouldn’t only be thinking about when Q-Day will arrive, but about what we are leaving within reach of those who know how to wait. 

Frequently asked questions 

Sources 

Official bodies 

• NIST: Post-quantum cryptography, CSRC post-quantum cryptography project, FAQ, FIPS 203, FIPS 204, FIPS 205 and retirement of SHA-1. 
• NSA: Venona and Center for Cryptologic History overview. 
• NCSC (United Kingdom): Timelines for migration to post-quantum cryptography. 
• European Commission: Post-quantum cryptography. 
• G7 Cyber Expert Group: roadmap for the financial sector (January 2026). 
• Hong Kong Monetary Authority: press release and Hong Kong Government statement (July 27, 2026). 
• Banco de España: press note (October 23, 2026). 
• Spain’s Ministry of Defence (CEMFAS): “La amenaza cuántica” (The quantum threat), educational paper. 
• INCIBE-CERT: disabling of DNIe digital signatures (2017). 
• Government of Estonia: blocking of 760,000 certificates and Information System Authority (2017). 

Academic research 

• Peter Shor (1994): “Algorithms for quantum computation: discrete logarithms and factoring”, IEEE FOCS. 
• Lov Grover (1996): “A fast quantum mechanical algorithm for database search”, ACM STOC. 
• Michele Mosca: “Cybersecurity in an era with quantum computers: will we be ready?”, IACR (2015) and IEEE Security & Privacy (2018). 
• Craig Gidney (Google Quantum AI): “How to factor 2048 bit RSA integers with less than a million noisy qubits” (2025). 
• Google Quantum AI, Stanford and Ethereum Foundation: “Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities” (2026). 
• Michal Krelina: “Quantum technology for military applications”, EPJ Quantum Technology (2021). 
• Michele Mosca and Marco Piani: Quantum Threat Timeline Report, Global Risk Institute (2023). 
• Scuola Superiore Sant’Anna: analysis of the European Digital Identity Wallet and post-quantum cryptography. 

Reference media 

• NBC News (December 2024) and EPIC (October 2025), on Salt Typhoon. 
• AFP via Phys.org, Vozpópuli and Xataka, on ROCA (2017). 
• South China Morning Post, on the HKMA index. 
• CriptoNoticias, on the agreement between Banco de España and Banco de Portugal. 
• The Quantum Insider, on Iceberg Quantum and Bitcoin. 
• Dark Reading, on the retirement of SHA-1. 
• CPO Magazine, on the AI-agent cyber-espionage campaign. 

Companies and experts (technical sources) 

• Cloudflare: post-quantum roadmap, state of the post-quantum internet in 2025 and Cloudflare Radar. 
• Google: cryptography migration timeline. 
• Apple: iMessage with PQ3, which also covers Signal’s PQXDH protocol. 
• Anthropic: HAWK finding and report on the AI-orchestrated cyber-espionage campaign. 
• Filippo Valsorda: “Quantum computers are not a threat to 128-bit symmetric keys”. 
• Tutorial on AI agent teams posted on X (October 2026).