What breaks, what stays, what to swap.

Cryptography has two kinds of lock. The first is a safe with a code: whoever locks and whoever opens use the same code. This is secret-key cryptography, such as AES, which protects data stored on disk.

The second is a mailbox with a slot: anyone can drop a letter through the slot, but only the owner has the key to open it. This is public-key cryptography, used by two people who have never met to agree on a secret over the internet (the HTTPS key exchange) and to sign documents.

A large quantum computer running Shor's algorithm finds the mailbox key just by looking at the slot. The whole lock falls, whatever the key size. For the safe there is only Grover's algorithm, which speeds up guessing the code: a 256-bit code becomes worth a 128-bit one, which is still safe.

In practice: the mailbox has to be replaced; for the safe, a long code is enough.

The attack does not wait for the machine to exist. Whoever records today's traffic, encrypted with today's key exchange, can store it and open it once the quantum computer is ready. For a medical record, a contract or a state secret that must stay confidential for ten years, the problem has already started.

When? Nobody knows; what exists are third-party estimates. Cryptographer Filippo Valsorda (ex-Google, Go team) moved his estimate from 2035 to 2029 after two 2025 papers: one from Google, showing that 256-bit curves would fall in minutes with fewer qubits than thought, and one from Oratomic, pointing to about 10,000 physical qubits with neutral atoms.

In July 2026, Oratomic raised US$300 million for a 20,000-qubit machine, and Google published error correction that recalibrates itself without stopping the computation. The bottleneck moved from "how many qubits" to "running for days without stopping". None of these numbers is our measurement. The deadline and the assessment are in CRQC 2029.

In August 2024, NIST, the US standards institute, published the new locks: ML-KEM for key exchange (FIPS 203), ML-DSA for signatures (FIPS 204) and SLH-DSA, a signature built only from fingerprints (FIPS 205).

The first two rest on a lattice problem: finding a hidden point in a gigantic grid, with hundreds of dimensions, from a deliberately blurred hint. Nobody knows a shortcut for this, not even with a quantum computer.

We measured it in our stack (Go with Cloudflare's CIRCL library), in one run, on 28 Sep 2026, on a Mac: ML-KEM-768 generates, locks and opens the key in 95 µs, against 63 µs for today's key exchange; ML-DSA-65 generates, signs and checks in 287 µs, against 165 µs for ECDSA. In practice, time hardly matters.

The cost is size: the key-exchange public key gets 18 times bigger, and the signature 46 times. Where every byte counts (field sensors, satellites, a certificate chain in a handshake), that changes the design.

While the new lock does not yet have decades of use, you can use both together: today's key exchange (X25519) and the new one (ML-KEM). The final secret is the fingerprint of both. If either one holds, the conversation stays protected. Chrome, Signal and AWS already do this for key exchange.

This insurance has already shown why it exists. In August 2026 a paper circulated claiming a quantum algorithm against lattice problems. As of this page it has not been confirmed, and a similar announcement in 2024 fell in about eight days because of an error in the proof. With the hybrid mode, even if it is one day confirmed, the conversation is not exposed.

One caveat: for signatures, Valsorda recommends going straight to the new one, without a hybrid. And what really protects against surprises is being able to change the lock without changing the door: crypto-agility.

A zero-knowledge proof shows you know something without revealing what: for example, proving you are over 18 without showing your birth date. The most common versions today rest on elliptic curves or "pairings", and both fall to Shor's algorithm.

The stack has two ways out. The first is lattice Schnorr: the same classic recipe, swapping the curve for a lattice problem. The second is the STARK, which uses only fingerprints (SHA-256): it depends neither on a curve nor on a setup ceremony in which someone must be trusted.

The parameters of these two modules are for teaching (a small grid), not for production. The proof in the example alongside is about 2.5 KB in our simplified implementation.

The last module puts the pieces together in a vote. The server publishes the post-quantum key-exchange key (1,184 bytes). Each terminal sets up an ML-KEM channel with it and receives, through that channel, the homomorphic encryption key: a cipher that lets you compute on data without opening it.

Each vote leaves the terminal encrypted, at 131,406 bytes (about 128 KB). The server adds the encrypted votes in under 1 ms, without ever seeing a vote; only the authority, holding the key, opens the total. Numbers from the 28 Sep 2026 run.

Every layer resists a quantum computer: key exchange and vote on lattices, transport with AES-256, commitment with SHA-256. Other uses of the same idea are in 20 FHE applications, and you can actually vote in the interactive tutorial (in Portuguese).