The Deadline Is Now Official. The Hardware Estimate Just Got Smaller.

For years, quantum readiness has been caught between two arguments. One side says the cryptographic threat is serious and organizations should begin migrating now. The other says cryptographically relevant quantum computers are still years away, so there is little reason to rush.

This week made that debate considerably less useful.

On October 27, NIST finalized IR 8547, Transition to Post-Quantum Cryptography Standards, establishing its official approach for moving information systems away from quantum-vulnerable public-key cryptography. The report identifies the vulnerable standards, the post-quantum standards intended to replace them, and the migration considerations organizations need to address. NIST explicitly describes the transition as a multiyear modernization effort involving systems, suppliers, use cases, and cryptographic dependencies.

Two days later, quantum-computing company Alice & Bob published a new theoretical resource estimate. Its researchers calculate that, under the assumptions of their cat-qubit architecture, 22,593 physical qubits could factor RSA-2048 in approximately 3.14 days.

For elliptic-curve cryptography relevant to Bitcoin and other systems, they estimate approximately 29,588 physical qubits could solve a 256-bit elliptic-curve discrete logarithm problem in about 62 minutes.

No such machine exists. This is not a demonstration of RSA or Bitcoin being broken. But the important number may not be 22,593. It may be the direction of travel.

Resource estimates keep getting smaller while migration deadlines keep getting closer. That combination should have management's attention.

The first signal is NIST IR 8547 itself.

NIST finalized the report on October 27 after publishing its initial draft in 2024. The document establishes a formal transition path away from quantum-vulnerable public-key cryptography and toward the post-quantum algorithms NIST began standardizing in 2024. NIST describes the report as a road map for federal agencies, technology providers, standards organizations, and other organizations developing quantum-readiness plans.

The significance is larger than an algorithm table. NIST explicitly says migration will vary by use case. It tells organizations to consider not merely their own technology, but their entire cryptographic supply chain. It also points organizations toward cryptographic visibility, risk prioritization, crypto-agility, hybrid approaches, and practical implementation work through the NCCoE.

The message is increasingly clear: The standards problem is largely solved. The implementation problem is not.

The second signal is the Alice & Bob resource estimate.

The company says its latest architecture would require about 40 times fewer physical qubits than a 2025 Google estimate for RSA-2048 under a different architecture and set of assumptions. Its result relies on specialized cat qubits designed to suppress certain errors at the hardware level, improved LDPC-cat error-correction codes, and a redesigned arithmetic implementation for Shor's algorithm.

The caveats matter enormously. These are resource estimates, not working attacks. Alice & Bob has not built a 23,000-qubit fault-tolerant machine. The assumptions include extremely strong suppression of bit-flip errors. Alice & Bob notes that less favorable error assumptions would increase the required hardware.

So this should not be interpreted as:  “RSA will be broken next year.”

It should be interpreted as: “The engineering estimate required to break RSA is not fixed.”

That is an important distinction for risk management.

The third signal is what this means for systems using elliptic-curve cryptography.

Alice & Bob estimates that its architecture could solve ECDLP-256 in roughly an hour with approximately 30,000 physical qubits. CoinDesk notes that such an attack would still be too slow, under the stated assumptions, to reliably derive a Bitcoin key during Bitcoin's roughly ten-minute transaction-confirmation window.  

But coins sitting behind already exposed public keys create a different scenario because an attacker could potentially have much longer to perform the calculation.

Again, this is not evidence that Bitcoin is currently vulnerable to quantum theft.

It is evidence that the migration problem deserves serious engineering attention before the hardware exists.

The most important development this week is not that Q-Day suddenly moved to a particular year. It did not. The important development is that the two variables organizations have historically used to justify waiting are moving against them.

The policy window is becoming more defined.

The technical resource estimates are becoming smaller.

That creates an asymmetry. If the hardware arrives later than expected, an organization that began preparing early has improved its cryptographic inventory, supplier visibility, crypto-agility, identity architecture, and security governance.

Very little of that work is wasted. But if the hardware arrives earlier than expected, an organization that waited cannot compress a five-year migration program into six months simply because the threat became undeniable.

That is why the relevant question is not: “When will quantum computers break RSA?”

Nobody can answer that with sufficient certainty.

The better management question is: “How much time would we need if the answer suddenly became sooner than we expected?”

That question can be answered.

• How long would it take to locate vulnerable cryptography?
• How long to prioritize it?
• How long to replace certificates?
• How long to change machine identities?
• How long to update applications?
• How long to remediate embedded devices?
• How long to obtain vendor support?
• How long to test interoperability?
• How long to migrate production systems safely?
• And how long to prove to management, regulators, customers, and the board that the work actually happened?

That is the real quantum clock. Not the number of qubits.

Migration time.

NIST has now made the direction of travel official. Alice & Bob has reminded us that estimates of the hardware required to threaten today's cryptography can change.

Organizations therefore face a fairly simple risk-management decision.

They can bet that cryptographic progress will move slowly enough to accommodate their migration schedule. Or they can determine their migration schedule now.

QCI-QS1 v2.3 is built around the second approach: inventory the exposure, establish ownership, evaluate dependencies, test crypto-agility, prioritize the migration, and maintain evidence that the organization is making measurable progress.

Because the organization does not need to predict Q-Day perfectly. It needs to make sure Q-Day does not arrive before its migration day.

That is the boardroom question for today: “If the technical timeline moved forward by five years tomorrow, how much of our migration plan would still work?”

If nobody can answer that question, the biggest uncertainty may not be quantum computing. It may be the organization's own readiness.

Think Earlier. Trust Must Survive.