§1 · Exposure Overview
Risk Profiles for Cryptographic Primitives
Shor's algorithm turns the hard problems beneath RSA, Diffie–Hellman and elliptic-curve cryptography into polynomial-time ones. Symmetric ciphers and hashes are only dented by Grover. This table ranks the widely deployed primitives by how exposed they are — the infrastructure that falls with each, the logical qubits a machine needs to break it, and credible estimates for when that many qubits arrive. Because harvest-now, decrypt-later is already viable, anything encrypted today with these primitives is a standing target.
Elliptic curves · Shor
An \(n\)-bit curve needs on the order of
logical qubits — about 2,330 for a 256-bit curve.
Roetteler, Naehrig, Svore & Lauter, ASIACRYPT 2017
RSA & finite-field · Shor
An \(n\)-bit modulus or group needs roughly
logical qubits — ≈6,200 at 2048 bits, and the physical figure keeps falling.
Gidney & Ekerå, Quantum 2021; Gidney 2025
Symmetric & hashes · Grover
Grover only cuts the effective strength to
so AES-256 and SHA-256 keep a comfortable margin.
Grover 1996; Grassl et al. 2016
How to read the qubit figures
These are algorithm-level logical-qubit estimates from the cited literature — not fixed constants. They shrink as algorithms improve (RSA-2048's physical estimate fell ~20× between 2019 and 2025). Crucially, holding enough logical qubits is necessary but not sufficient: a real break also needs the required gate depth, runtime and a low logical error rate, each demanding many physical qubits per logical qubit. Treat every number as an order-of-magnitude signpost, not a countdown.
§2 · When does the number arrive?
Feasibility Horizon Heat Map
Each row is a logical-qubit threshold that breaks a family of primitives. The heat blooms brightest at the year that threshold is most likely first reached and fades on either side — so a row that has gone cool on the right isn't safe there; it's one the field expects to have been crossed already. The white whisker marks each family's aggressive-to-conservative spread, with a gold dot at the consensus (most-likely) date. Vertical guides mark the NIST deadlines — legacy public-key crypto is deprecated after 2030 and disallowed after 2035.
Each row's brightest column is its most-likely arrival year. Hover or tap a cell for the estimate and its sources · tap a row label for detail.
What the colour means — and the one way to misread it
The colour is a reasoned distribution over the year each qubit threshold is first reached — brightest at the most-likely date and fading as arrival in that specific year grows less probable — synthesised from the sources attached to each row. Read it carefully: a cool cell to the right of a row's bloom does not mean safe, it means the field expects that capability to have arrived already. And clearing the qubit bar is only one gate on a longer path that also demands sustained low-error operation and enormous gate volumes. Reasonable analysts disagree by a decade or more — which is why the spread whisker and the scenario toggle exist. These bands are a reading of published estimates, not forecasts.
§3 · What is exposed
Examples of Infrastructure at Risk
The chains and protocols below secure enormous value with exactly the primitives Shor breaks — ECDSA on secp256k1, EdDSA on Curve25519, and pairing signatures on BLS12-381. Each entry lists the signature schemes it depends on and, drawn from the same feasibility model, the year its weakest scheme is most likely to first fall. Hashes such as SHA-256 and Keccak-256 are only Grover-weakened — noted where relevant, but not the near-term risk.
Almost everything shares one cliff. Nearly every chain signs with ~256-bit elliptic-curve keys, and those all fall together under Shor — so the headline year is similar across the board. The real differences are in how many breakable schemes each stacks: projects that also lean on BLS12-381 (Ethereum consensus, Filecoin, the Internet Computer, Aptos, Sui…) stay exposed on a longer tail. Sort by latest to surface them.
How the break year is derived
For each project we take the signature schemes it actually relies on, read each scheme's logical-qubit requirement from §1, map that to the nearest modelled threshold in §2, and report the most-likely (consensus) year that threshold is first reached — with the aggressive–conservative span beside it. The project's headline is its weakest link: the scheme expected to fall first. This is deliberately coarse and inherits every caveat of the feasibility model — clearing the qubit bar is necessary, not sufficient, and estimates move. It's a starting point for triage, not a deadline. Mappings reflect each project's primary signature scheme(s); some use additional or configurable schemes.
§4 · Underlying justification
References & Sources
The estimates above are only as good as their provenance. Below is the working bibliography — foundational algorithms, peer-reviewed resource estimates, expert timelines and the standards defining the migration — each with a one-line note on what it contributes.
Adding Sources
This register is meant to grow. If you know a credible, well-cited paper, report or standard we've missed — or you can sharpen an estimate — open an issue or a pull request. References live in data.json under the references array, and primitives cite them by id; the schema is documented in the repository README.