# How quantum computers break cryptography

> What Shor's and Grover's algorithms actually do to today's cryptography — and why signatures, not hashes, are the real danger.

"Quantum-resistant" is QRL's whole reason to exist, but it is easy to throw the phrase around without knowing what the threat actually is. The good news is that the core idea is understandable without any physics. The danger comes down to **two quantum algorithms** — and only one of them is really dangerous.

## Two algorithms, two very different threats

| Algorithm | Targets | Effect | Verdict |
|---|---|---|---|
| **[Shor's](/learn/glossary#shor)** | RSA, ECDSA (signatures, key exchange) | Breaks them efficiently | The real danger |
| **[Grover's](/learn/glossary#grover)** | Hash functions (SHA-256, etc.) | Square-root speed-up only | A manageable dent |

The headline: quantum computers are a **signature** problem, not a **hashing** problem.

## Shor's algorithm: the signature breaker

Today's mainstream cryptography leans on two "hard" math problems:

- **Factoring** very large numbers (RSA), and
- The **discrete logarithm** on elliptic curves (ECDSA — the signature Bitcoin and Ethereum use).

These are hard for ordinary computers: the best-known methods take impractically long. **Shor's algorithm** changes that. Running on a large, fault-tolerant quantum computer, it solves both problems *efficiently*.

For a blockchain, the consequence is direct and severe. With ECDSA, your **public key** is enough for Shor's algorithm to recover your **private key**. Any wallet whose public key is exposed — which includes every wallet that has ever spent, since spending reveals the public key — could be drained by whoever runs the attack first.

This is the threat QRL is built to remove. By signing with [post-quantum schemes](/learn/glossary#post-quantum) — [XMSS](/learn/xmss-explained) on Legacy and [ML-DSA-87](/learn/ml-dsa-87-explained) on QRL 2.0 — there is no number-theoretic shortcut for Shor's algorithm to exploit.

## Grover's algorithm: the overstated one

The other algorithm people worry about is **Grover's**, which speeds up brute-force search. Applied to a hash function, it could find a preimage or collision faster than a classical computer — but only by a **square root**. A 256-bit hash that takes `2^256` classical effort drops to roughly `2^128` quantum effort.

`2^128` is still astronomically large, and there is an easy fix: **double the output size**. A 512-bit hash returns you to a `2^256` quantum security margin. That is why hashing is considered robust against quantum computers, and why QRL's quantum-resistance story is really about *signatures*, with hash sizes chosen generously as a precaution.

## "Harvest now, decrypt later"

A subtle point makes the timeline matter even though no dangerous quantum computer exists yet: **[harvest now, decrypt later](/learn/glossary#harvest-now-decrypt-later)**.

An adversary can record signed or encrypted data *today* and simply wait. Once a capable quantum computer arrives, they break the captured material retroactively. For long-lived secrets — and for blockchains, where exposed public keys live forever in an immutable ledger — being late is not recoverable. You cannot un-expose a key after the fact.

## So when does this actually happen?

Honestly: nobody knows. Credible estimates for a cryptographically-relevant quantum computer range from "a decade or more" to "maybe never." QRL's bet is not that the threat is imminent, but that:

- the **cost of preparing early is small**, and
- the **cost of being unprepared is catastrophic and irreversible**.

That asymmetry — cheap insurance against a rare but ruinous event — is the case for quantum-resistant cryptography. The longer view is in [why quantum-resistance matters](/learn/quantum-resistance-explained).

## Where to go next

- [Grover's algorithm and hash functions](/learn/grover-and-hash-functions) — why bigger hashes are enough.
- [NIST post-quantum standards](/learn/nist-post-quantum-standards) — the schemes the world is standardising on.
- [XMSS explained](/learn/xmss-explained) and [ML-DSA-87 explained](/learn/ml-dsa-87-explained) — QRL's two answers.