Quantum computing threatens RSA encryption within five years

The timeline for quantum computers to break RSA-based encryption has collapsed from 2035 to as early as 2029, according to recent assessments by Google and the Asia Pacific Network Information Centre (APNIC). This acceleration stems from rapid progress in quantum hardware, error correction, and factoring algorithms, which now threaten the foundational public-key infrastructure underpinning secure web communications, including Transport Layer Security (TLS).

The quantum threat to encryption

Public-key cryptography, such as RSA and Elliptic Curve Cryptography (ECC), secures the initial handshake in encrypted connections by enabling the exchange of symmetric keys. These symmetric keys—typically AES—then encrypt the bulk of data transmitted. While symmetric encryption remains resistant to quantum attacks, the asymmetric methods protecting key exchange are vulnerable to Shor’s algorithm, a quantum computing technique capable of factoring large integers exponentially faster than classical methods.

Early estimates suggested that breaking 2048-bit RSA would require a million stable qubits, a figure far beyond current capabilities. However, recent advancements in quantum error correction and algorithm efficiency have reduced this requirement to under 100,000 qubits. With state actors likely to achieve this threshold within the next decade, encrypted traffic captured today could be decrypted retroactively once sufficiently powerful quantum computers become available. APNIC’s analysis warns that this risk is no longer theoretical, with practical attacks on RSA potentially feasible within five years.

Symmetric encryption remains secure—for now

Unlike asymmetric encryption, symmetric schemes like AES-128 and SHA-256 are not directly threatened by Shor’s algorithm. Grover’s algorithm, a quantum technique that could theoretically halve the effective key strength of symmetric encryption, remains largely theoretical and has not demonstrated practical feasibility. Cryptographers, including Filippo Valsorda, have emphasized that symmetric key sizes do not need to change as part of the transition to post-quantum cryptography. However, the urgency lies in replacing RSA and ECC with quantum-resistant alternatives to protect the key exchange process itself.

Industry response and next steps

Google’s call to complete PQC adoption by 2029 reflects a growing consensus that the window for action is narrowing. Standardization bodies, including the National Institute of Standards and Technology (NIST), have already begun evaluating and standardizing post-quantum algorithms. The challenge now lies in deploying these solutions across the internet’s infrastructure before quantum computers render existing encryption obsolete. For enterprises and service providers, this means auditing cryptographic dependencies, prioritizing upgrades for long-term data security, and monitoring developments in quantum-resistant protocols.

What to watch

The pace of quantum hardware development will determine whether the 2029 timeline holds. Key milestones include advances in qubit stability, error correction, and the demonstration of Shor’s algorithm on increasingly larger RSA key sizes. Meanwhile, NIST’s ongoing standardization process for PQC algorithms will shape the tools available for migration. Industry adoption rates will also be critical—early movers may gain a security advantage, while laggards risk exposure to retroactive decryption attacks.