21–30 of 40 posts
It's unfortunate that we're past the point where all quantum computing progress is public. Between this and the unbearable secrecy of AI labs, balkanization of knowledge is in full force.
I think the incentive to share progress is still orders of magnitude higher than the incentive to keep it private.
Why do they care about cryptocurrencies but not about the entire world's infrastructures that are based on RSA and elliptic curve algorithms, such as HTTPS and many other electronic signature solutions? Is this a case of cryptocurrency market manipulation? And why do they think that the US government would care about securing cryptocurrencies? Aren't they designed to circumvent the government regulation?
This was the first of several articles coming out of Google: https://blog.google/innovation-and-ai/technology/safety-secu...
And the timeline for web migration is 2027 Q1: https://security.googleblog.com/2026/02/cultivating-robust-a...
And this was Sophie Schmieg’s talk at a cryptography conference this month (they lead PQC migration efforts at Google) tracking migration efforts and urging folks to prioritize signature migrations in lieu of accelerated quantum timelines: https://westerbaan.name/~bas/rwpqc2026/sophie.pdf
Have they factored 21 yet? [0] IMO most of us can ignore such pieces until a practical factorization of arbitrary 32 bit integers is demonstrated on a QC. And even after this "easy" milestone is achieved, I think it will be at least a decade until QC will be a practical cryptographic threat. And it's generously assuming that a Moore-like scaling is possible for QC. [0]: https://algassert.com/post/2500
Have they factored 21 yet? [0] IMO most of us can ignore such pieces until a practical factorization of arbitrary 32 bit integers is demonstrated on a QC. And even after this "easy" milestone is achieved, I think it will be at least a decade until QC will be a practical cryptographic threat. And it's generously assuming that a Moore-like scaling is possible for QC. [0]: https://algassert.com/post/2500
My read of this post is that there's nuance here and that by the time we see 32-bit integers being factored then the roadmap to 256 bit integers can be counted in months on ten fingers rather than being a decade out. The underlying scaling needed to go to 32 bit requires only linear progress to get to 256
Nope. Firstly, for RSA you need to scale from 32 to 4096. Secondly, Shor requires N^2*log(N) quantum gates where N is number of bits in the integer, so the scaling is superquadratic. And it's very much an open question whether QEC protocols will continue to work with the same efficiency on the required scales.
Earlier quoted context omitted.
My read of this post is that there's nuance here and that by the time we see 32-bit integers being factored then the roadmap to 256 bit integers can be counted in months on ten fingers rather than being a decade out. The underlying scaling needed to go to 32 bit requires only linear progress to get to 256
>The underlying scaling needed to go to 32 bit requires only linear progress to get to 256 Nope. Firstly, for RSA you need to scale from 32 to 4096. Secondly, Shor requires N^2*log(N) quantum gates where N is number of bits in the integer, so the scaling is superquadratic. And it's very much an open question whether QEC protocols will continue to work with the same efficiency on the required scales.
If we want to talk RSA the engineering journey from factoring 21 to 35 is big, because it requires creating logical qubits with error rates that we are only now seeing companies report. But the engineering journey from 32 bits that are tolerant enough to run a factoring algorithm to doing the same with 4096 appears linear in engineering cost is what I am claiming.
For RSA specifically the resource have come down. I am not yet up to date on this round of papers however the 2024 result https://eprint.iacr.org/2024/222 had it down to n/2 + O(N) logical qubits.
Earlier quoted context omitted.
>The underlying scaling needed to go to 32 bit requires only linear progress to get to 256 Nope. Firstly, for RSA you need to scale from 32 to 4096. Secondly, Shor requires N^2*log(N) quantum gates where N is number of bits in the integer, so the scaling is superquadratic. And it's very much an open question whether QEC protocols will continue to work with the same efficiency on the required scales.
We are talking to different things. There is linear engineering progress for getting from 32 bits to 256 bits being factored is my claim. If we want to talk RSA the engineering journey from factoring 21 to 35 is big, because it requires creating logical qubits with error rates that we are only now seeing companies report. But the engineering journey from 32 bits that are tolerant enough to run a factoring algorithm t…
And yet 21 was not factored on a real hardware.
>There is linear engineering progress for getting from 32 bits to 256 bits being factored is my claim.
IMO it's a very bold claim until linear progress is demonstrated between 8, 16, and 32 bits. Not in theoretical papers. On a real hardware. With honest experiments using arbitrary integers.
It's easy to claim "QC will repeat Moore's law!" especially when your salary depends on it, but the practical evidence is quite lacking at the moment.
If I find a cryptocurrency vulnerability I am reallocating (the blockchain never lies) as much of it as I can and cashing it out. Its the only responsible thing to do.
If someone else finds a cryptocurrency vulnerability, they too will reallocate as much of your allocation as they can and cash it out.
Earlier quoted context omitted.
We are talking to different things. There is linear engineering progress for getting from 32 bits to 256 bits being factored is my claim. If we want to talk RSA the engineering journey from factoring 21 to 35 is big, because it requires creating logical qubits with error rates that we are only now seeing companies report. But the engineering journey from 32 bits that are tolerant enough to run a factoring algorithm t…
>it requires creating logical qubits with error rates that we are only now seeing companies report And yet 21 was not factored on a real hardware. >There is linear engineering progress for getting from 32 bits to 256 bits being factored is my claim. IMO it's a very bold claim until linear progress is demonstrated between 8, 16, and 32 bits. Not in theoretical papers. On a real hardware. With honest experiments using…
Is this as wild a news as I think it is? I'm surprised I haven't yet seen more reactions to the 2029 migration timeline plan (proposed?).