Quantum Cryptanalysis and the Post-Quantum Interface

Quantum cryptanalysis studies what quantum algorithms imply for cryptographic assumptions under a defined attacker model. The research interface with post-quantum cryptography concerns both improved attacks and credible resource estimates. A polynomial-time attack theorem, a costed future attack and an operationally available attack are different statements.

Required background. Shor’s algorithm owns the factoring and order-finding mechanism; cryptography case studies sets the security context.

Three distinct claims

Established algorithmic result: sufficiently capable quantum computers can use order finding against factoring-based cryptography. Conditional engineering estimate: a chosen fault-tolerant implementation would require particular qubits, time and error assumptions. Conjectural security assumption: a post-quantum scheme resists all efficient attacks; standardization and public cryptanalysis provide evidence, not a proof that no future attack exists.

NIST published ML-KEM, ML-DSA and SLH-DSA standards in August 2024. These are classical algorithms intended to resist quantum attacks; they do not require quantum communication. Consult NIST’s live project for current standards and corrections. Official project.

Resource models are research objects

The Gidney–Ekerå RSA analysis and Gidney’s 2025 proposal illustrate substantial changes from arithmetic, code and architecture choices. Their numerical resource claims are conditional calculations, not dates when attacks become available. Published analysis, later proposal.

For unstructured key search, amplitude amplification reduces query count quadratically under the usual model, but reversible oracle cost, parallelization and available coherent depth change the concrete comparison. Do not apply the square root to an entire classical attack cost unless its steps fit the quantum search model.

Open directions

Can arithmetic circuits reduce adaptive depth without excessive workspace? Which physical assumptions dominate a concrete attack estimate? How do reversible implementations alter memory-hard or lattice-search subroutines? Can a proposed quantum improvement be matched by a classical algorithm using comparable preprocessing and memory?

A useful project narrows to a public toy primitive or a published cost model. Forecasting a single “quantum deadline” does not resolve these scientific questions.

Graduate project: arithmetic with an honest cost model

Implement and verify reversible modular addition for small moduli, then compare two published circuit constructions in logical qubits, non-Clifford gates and dependency depth. Use exhaustive small-input tests and an explicit gate library. A laptop circuit simulator suffices; no real keys or external systems are needed.

Deliver circuit files, reversible correctness tests and an architecture-sensitive cost table. The baseline is one established construction under the same ancilla-cleanup convention. Failure tests cover boundary values, entangled inputs, overflow and returning scratch qubits to their initial state. Progress to research through a proved circuit optimization or resource model that changes the dominant cost across a parameter family, followed by independent reproduction.

Entry points and dates

Read the stable algorithm before the resource papers. Source search: 11 October 2026; selected evidence: the 2024 standards milestone and 2021–2025 attack estimates. This page offers research orientation rather than a complete cryptographic deployment recommendation or exhaustive standards inventory.

References

• C. Gidney, “How to factor 2048 bit RSA integers with less than a million noisy qubits,” arXiv:2505.15917 (2025). Preprint.
• C. Gidney and M. Ekerå, “How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits,” Quantum 5, 433 (2021). Article.
• National Institute of Standards and Technology, “Post-Quantum Cryptography,” project and standards index, accessed 11 October 2026. Official resource.