"Quantum-resistant" is QRL's whole reason to exist, but it is easy to throw the phrase around without knowing what the threat actually is. The good news is that the core idea is understandable without any physics. The danger comes down to two quantum algorithms — and only one of them is really dangerous.
Two algorithms, two very different threats
| Algorithm | Targets | Effect | Verdict |
|---|---|---|---|
| Shor's | RSA, ECDSA (signatures, key exchange) | Breaks them efficiently | The real danger |
| Grover's | Hash functions (SHA-256, etc.) | Square-root speed-up only | A manageable dent |
The headline: quantum computers are a signature problem, not a hashing problem.
Shor's algorithm: the signature breaker
Today's mainstream cryptography leans on two "hard" math problems:
- Factoring very large numbers (RSA), and
- The discrete logarithm on elliptic curves (ECDSA — the signature Bitcoin and Ethereum use).
These are hard for ordinary computers: the best-known methods take impractically long. Shor's algorithm changes that. Running on a large, fault-tolerant quantum computer, it solves both problems efficiently.
For a blockchain, the consequence is direct and severe. With ECDSA, your public key is enough for Shor's algorithm to recover your private key. Any wallet whose public key is exposed — which includes every wallet that has ever spent, since spending reveals the public key — could be drained by whoever runs the attack first.
This is the threat QRL is built to remove. By signing with post-quantum schemes — XMSS on Legacy and ML-DSA-87 on QRL 2.0 — there is no number-theoretic shortcut for Shor's algorithm to exploit.
Grover's algorithm: the overstated one
The other algorithm people worry about is Grover's, which speeds up brute-force search. Applied to a hash function, it could find a preimage or collision faster than a classical computer — but only by a square root. A 256-bit hash that takes 2^256 classical effort drops to roughly 2^128 quantum effort.
2^128 is still astronomically large, and there is an easy fix: double the output size. A 512-bit hash returns you to a 2^256 quantum security margin. That is why hashing is considered robust against quantum computers, and why QRL's quantum-resistance story is really about signatures, with hash sizes chosen generously as a precaution.
"Harvest now, decrypt later"
A subtle point makes the timeline matter even though no dangerous quantum computer exists yet: harvest now, decrypt later.
An adversary can record signed or encrypted data today and simply wait. Once a capable quantum computer arrives, they break the captured material retroactively. For long-lived secrets — and for blockchains, where exposed public keys live forever in an immutable ledger — being late is not recoverable. You cannot un-expose a key after the fact.
So when does this actually happen?
Honestly: nobody knows. Credible estimates for a cryptographically-relevant quantum computer range from "a decade or more" to "maybe never." QRL's bet is not that the threat is imminent, but that:
- the cost of preparing early is small, and
- the cost of being unprepared is catastrophic and irreversible.
That asymmetry — cheap insurance against a rare but ruinous event — is the case for quantum-resistant cryptography. The longer view is in why quantum-resistance matters.
Where to go next
- Grover's algorithm and hash functions — why bigger hashes are enough.
- NIST post-quantum standards — the schemes the world is standardising on.
- XMSS explained and ML-DSA-87 explained — QRL's two answers.