The first quantum computer to break encryption is now shockingly close

Google’s Willow quantum computer

Google Quantum AI

A quantum computer capable of breaking the encryption that secures the internet now seems to be just around the corner. Stunning revelations from two research teams outline how it could happen, with one suggesting that the current largest quantum machine is already more than halfway towards the size needed.

The two studies concern an encryption technique built around the elliptic curve discrete logarithm problem (ECDLP). The particulars of how this mathematical problem is solved made it a good candidate for encrypting data and led to its widespread adoption for securing lots of internet communication, including bank transactions, and nearly every major cryptocurrency, including bitcoin.

It is extremely difficult for conventional computers to crack ECDLP-based encryption, but since the 1990s researchers have known that quantum computers wouldn’t have the same trouble. Building a quantum computer large enough, however, was an engineering impossibility, so seemed a distant worry.

In recent years, both theory and engineering have advanced with staggering speed, greatly squeezing the timeline. On the theory front, researchers have optimised quantum hacking algorithms to reduce the actual amount of quantum computing power needed. For example, in 2019, the best estimate for the size needed to crack a related encryption method called RSA-2048 was 20 million qubits – a qubit is the quantum equivalent of a traditional computer bit. In February this year, that number became just 100,000 qubits.

What’s more, in 2019, state-of-the-art quantum computers barely passed 50 qubits. Today’s largest quantum computers have more than 1000 qubits and the largest qubit array – which hasn’t actually been used for computation yet – has 6100 of them.

Now, Dolev Bluvstein at the firm Oratomic and his team believe that ECDLP could fall to a machine with just 10,000 qubits. While this decryption process would take several years of a quantum computer’s runtime, Ryan Babbush at Google’s quantum research arm and his colleagues have separately charted how 500,000 qubits could do the same in as little as 9 minutes.

Justin Drake at the Ethereum Foundation, who collaborated with Google’s researchers, wrote on X that this is is a momentous day for quantum computing and cryptography.

Bluvstein and his colleagues based their calculations on qubits made from extremely cold atoms controlled by lasers. Such qubits can be connected to each other in many ways, and this large interconnectivity partly accounts for the reduced qubit requirement.

Creating an array of 10,000 ultracold qubits may be possible within a year, says Bluvstein, but the real challenge will be controlling them well enough and getting them to work sufficiently quickly. There are no shortcuts, like connecting multiple existing machines, as the qubits need to be able to interact properly with each other.

Bluvstein thinks a capable enough machine won’t be ready until the end of the decade. “There’s a lot of progress that needs to be made, but it’s starting to become something that people can really imagine building,” he says.

Crypto concerns

The Google team arrived at its conclusions based on a different type of quantum computer made from superconducting circuits, which are broadly considered to be a more mature technology and the one Google has been backing most heavily.

The researchers declined to comment publicly on the work, but in their paper they write that “resource estimates could be reduced substantially by making more aggressive assumptions about hardware capabilities”, suggesting the 500,000-qubit estimate is conservative. Notably, the researchers have chosen to omit the full details of their decryption algorithm, citing security concerns.

They also write that such a quantum computer could be used to intercept a cryptocurrency transaction and redirect the funds – essentially stealing them – in the brief period of time before it is recorded.

Given the two studies, bitcoin certainly looks vulnerable to quantum attack earlier than was previously known, says Scott Aaronson at the University of Texas at Austin.

Stefano Gogioso at the University of Oxford says that both types of quantum computers face significant engineering challenges before either result can be implemented in practice, especially the ultracold-atom approach, which is a much more unproven technology. But there is reason to worry about the security of our digital world, he says.

Some internet browsers already offer encryption impervious to quantum attacks, so-called post-quantum encryption (PQC), and conventional banks may be able to thwart quantum hackers after being attacked, but the very decentralised systems of cryptocurrency will be a lot more vulnerable, says Gogioso. Google has recently urged a migration to PQC by 2029, which Gogioso says is looking ever more necessary.

“This is exactly why we began the PQC standardisation project over a decade ago,” says Dustin Moody at the National Institute of Standards and Technology (NIST) in Maryland. “We’ve always known that as quantum hardware improves, so will the algorithms.”

NIST has chosen several PQC algorithms that could become the security standard in a future filled with practical quantum computers, and the US federal government is aiming to migrate to using them by 2035. But Moody says organisations should begin their transition as soon as possible. “These papers reinforce the idea that the window for migration is finite and the time to act is now,” he says.

Topics: