Another day, another urgent pronouncement on the need to transition to post-quantum cryptography ASAP: this one from the White House, in the form of an Executive Order requiring certain “high value” systems to transition to post-quantum cryptography (PQC) by the end of 2030 (for key exchange) or 2031 (for signatures). This brings forward the date slightly compared to previous guidance, which disallows quantum-vulnerable crypto for US Federal systems by 2035. But is this urgency justified?

First, an important note: as you can probably tell already, I’m going to pour some skepticism on this sense of urgency. I don’t think cryptographically-relevant quantum computers are coming soon. However, that doesn’t mean we shouldn’t be prepared! The risk that they might appear soon is non-negligible, and the impact of them appearing for many applications is catastrophic. Sensible timelines to mitigate known threats are justified, panic-induced rushing is not. On with the article…

Filippo Valsorda wrote a good piece about why he believes this urgency is justified, and that we need to be moving faster towards a post-quantum world. He cites two papers that dramatically reduce the estimates for how many qubits are needed to break classical cryptography (in this case elliptic curves) using a quantum computer. He writes:

“Overall, it looks like everything is moving: the hardware is getting better, the algorithms are getting cheaper, the requirements for error correction are getting lower.”

But is the hardware getting better? This is where I have doubts. Initial timelines for quantum computing from Google and IBM were extremely optimistic. Just 5 years ago, Google suggested they would have a fault-tolerant quantum computer with 1,000,000 physical qubits by 2029. They are currently at 105. So just 4 orders of magnitude to go in the next 3 years. IBM were a bit more conservative, anticipating 100,000 qubits by 2033. They are currently at 156 qubits.

Sam Jacques has been updating a useful chart every year, showing the current state of quantum computing progress. Below shows a comparison of the first chart he published in 2023 and the most recent one in 2026. What can clearly be seen is how better analysis has moved attacks down and to the left, but actual hardware progress has remained stubbornly in that little grey box, with a tiny nudge upwards on reducing the error rate.

Now, you may say that there has been good progress on improving error correction. For example, at the end of 2024, Google announced “below threshold” quantum error correction. Surely a sign of good progress, even if the number of qubits was behind schedule. Once you’ve cracked error correction, the qubits will come thick and fast: an atomic explosion of qubits, if you will. (If you believe this then it doesn’t really matter how much more efficient the attacks become on paper: all that matters is how soon the hardware arrives). But I do wonder how that announcement was different from the announcement Google made almost 2 years earlier stating “For the first time ever, our Quantum AI researchers have experimentally demonstrated that it’s possible to reduce errors by increasing the number of qubits.” Call me skeptical, but if you were really making progress then would you need to put out re-runs of results you’ve already announced? Are there new chips coming that build on this breakthrough to give us the large numbers of usable qubits we’ve been promised?

Maybe I’m about to be proved wrong by new announcements, or maybe all of the companies and governments involved in the entire world have suddenly decided to keep their progress hush-hush. But from my point of view as an outsider looking in, it all looks suspiciously like progress on quantum computing has stalled rather than the sky being about to fall on our heads.

To reiterate: I still think it is sensible to be working right now on transitioning to post-quantum encryption (in a hybrid). But I am deeply skeptical of the idea that we need to rush things because quantum computers are arriving any second now. As I said in “Are we overthinking post-quantum cryptography?”, I think if you’re not beholden to the diktats of an insane autocrat, making minimal adjustments to ensure you can counter “store now, decrypt later” attacks is sensible. Wholesale replacement of all of your cryptography with post-quantum alternatives is IMO still in the realm of something to start thinking about, not a burning crisis that needs immediate attention.

The key things to consider have nothing to do with PQC at all: Can I change algorithms easily and securely? Do I need to be using public key cryptography, or will symmetric cryptography do instead? (Hint: if it doesn’t cross a trust boundary, then the answer is almost always “yes”). Can I avoid digital signatures (the post-quantum ones are mostly crap)? Can I avoid cryptography entirely? (E.g., moving from “stateless” JWTs to good old-fashioned stateful tokens/cookies).