The headline is always "quantum computers will break encryption". The truthful version is narrower, and the difference decides how worried you should be.
| Primitive | What it does | Status | |
|---|---|---|---|
| RSA | key exchange, signatures | broken | Shor factors the modulus |
| Diffie–Hellman, ECC | key exchange, signatures | broken | Shor solves discrete log |
| AES-128 | bulk encryption | weakened | Grover halves the effective key length |
| AES-256 | bulk encryption | fine | still ~128-bit security |
| SHA-256, SHA-3 | hashing | fine | use a longer digest and move on |
The locks that break
There are two jobs your browser does every time it loads a secure page. It agrees on a secret key with the far end, and it checks a signature proving the far end is who it claims.
Both of those are built on math that Shor's algorithm demolishes. RSA rests on factoring being hard; the elliptic-curve schemes rest on a close cousin being hard. Shor does both.
And you cannot buy your way out with a longer key. Doubling an RSA key roughly doubles the quantum computer's work, while multiplying an ordinary attacker's work enormously. The safety margin you are used to simply is not there.
The locks that mostly hold
Once the key is agreed, the actual scrambling of your data uses a different family — AES and friends. There is no clever mathematical shortcut into those. All a quantum computer can do is guess faster.
Grover roughly halves the effective key length. AES-128 becomes about as strong as a 64-bit key sounds — though in practice Grover parallelises poorly and the real damage is smaller. The official advice is simply: use AES-256. Job done.
Hashes are the same story. Use a longer one and move on.
So what actually has to change
You are not replacing "encryption". You are replacing key agreement and signatures, and bumping up key sizes where they are still at 128 bits.
That is a big job — certificates, protocols, security hardware, devices in the field with a fifteen-year life. But it is a bounded job, and the replacements already exist. Two lessons from now you will know their names.
RSA and ECC
Broken outright. Must be replaced.
AES-128
Weakened. Move to AES-256.
SHA-256
Basically fine. Use a longer one if you are nervous.
Worth remembering
- Shor breaks the math behind key agreement and digital signatures.
- No key size saves you — it is not that kind of problem.
- Scrambling ciphers and hashes survive; they just want bigger settings.
- The job is bounded, and the replacements are already standardised.