Shor, ML-KEM and long-lived model secrets

Shor is the only one that actually breaks things

Shor's algorithm solves integer factorisation and discrete logarithms in polynomial time, which takes out RSA, finite-field Diffie–Hellman and elliptic-curve cryptography — that is, the public-key layer underneath essentially all internet key establishment and code signing. Grover, by contrast, gives a quadratic improvement against symmetric primitives, which is why the standard response there is longer keys rather than new algorithms. Symmetric encryption and hash functions survive with parameter adjustments. Public-key cryptography needs replacement, which is a different order of engineering.

What a cryptanalytically relevant machine would cost

Resource estimation is a published literature with a clear trend. Gidney and Ekerå's widely cited analysis put factoring a 2048-bit RSA integer at around twenty million noisy physical qubits over roughly eight hours, under stated assumptions about gate error, cycle time and surface-code overhead. Later work has continued to reduce the estimate substantially by improving arithmetic circuits and magic-state handling. The direction of travel — down, sometimes sharply — is the part worth internalising. Treat any single figure as conditional on the code, the noise model and the arithmetic, and read the assumptions before quoting the headline.

The NIST standards

The US National Institute of Standards and Technology ran a multi-round public post-quantum standardisation process and published the first standards as Federal Information Processing Standards: FIPS 203 for module-lattice key encapsulation, FIPS 204 for module-lattice digital signatures, and FIPS 205 for the stateless hash-based signature scheme. Selection of an additional code-based key encapsulation mechanism followed, to hedge against a structural break in lattice assumptions, and a separate track continues for further signature families. The primary source is NIST's own project pages at csrc.nist.gov, which is where parameter sets and status should be checked rather than in secondary summaries.

Harvest now, decrypt later

The threat model that makes this urgent has nothing to do with when a large quantum computer arrives. An adversary can record encrypted traffic today and decrypt it whenever the capability exists. So the relevant question for any dataset is its confidentiality lifetime. Health records, state secrets, biometric templates and proprietary model weights all have lifetimes measured in decades. If the confidentiality requirement outlasts the plausible arrival window of a cryptanalytically relevant machine, the protection needed to be post-quantum when the data was first transmitted.

Migration is an inventory problem

Every organisation that has attempted this reports the same first obstacle: nobody knows where their cryptography is. Certificates in firmware, hard-coded curve parameters in embedded devices, signature checks in bootloaders, vendor libraries with no upgrade path, protocol fields with no room for larger keys. Cryptographic inventory and agility — the capacity to change primitive without rewriting the application — are the actual deliverables. NIST's National Cybersecurity Center of Excellence has published migration guidance on exactly this, and the US National Security Agency's CNSA 2.0 suite sets out expectations for national-security systems.

Model weights as long-lived secrets

A frontier model's parameters are an unusually awkward asset: extremely valuable, expensive to reproduce, and transmitted between training clusters, evaluation environments and deployment infrastructure. The signature layer matters as much as the encryption layer. If a model artefact is verified by an elliptic-curve signature, then a future forgery capability undermines provenance for anything still trusting that key — and provenance is precisely the control that supply-chain attacks target. Hash-based signatures are conservative and large; lattice signatures are compact and rest on newer assumptions. Both are standardised, which is a policy statement about hedging.

What AGI-grade cryptanalysis would and would not change

A second, distinct worry gets conflated with the quantum one: that highly capable AI systems will find cryptanalytic attacks directly. The categories are separate. Shor is a proven asymptotic break of a specific algebraic structure. Machine-learned cryptanalysis, so far, has mostly produced improvements on reduced-round ciphers and on side-channel analysis — real, valuable, and not a structural break. Side channels, implementation bugs and protocol misuse remain the likeliest failure surface, and automated tooling makes them cheaper to find. Post-quantum migration does not protect an implementation that leaks through timing.