How Worried Should We Be About Quantum Threats to Blockchain?

Quantum is fundamentally complex and can be very confusing, even to those in the field.  The vast majority of people are not in the quantum field, but certainly hear about quantum in their news feeds.  More and more frequently there are stories that talk about quantum computing, quantum encryption, quantum communication, and quantum sensing.  All of these fields are incredibly important, but they don’t mean a lot to the average person.  What does matter, however, are headlines that warn about quantum breaking through banking encryption, and quantum breaking Bitcoin.  This doesn’t explain how, but it certainly gets your attention.  Now we all want to know exactly what quantum is capable of, when we will be at risk, and what companies and governments are doing about it.

While the headlines can be sensational (approaching clickbait status), they also aren’t exactly wrong.  The answers to the quantum threat are complicated, and there is a major cloud of uncertainty on the “when” we will be at risk.  However, when you understand quantum and cryptography at even a high level, and when you look at the trends from the past 5 years, you can actually get a clearer picture of what lies ahead.  

It’s not pretty.  But it’s also not hopeless, if we act on it now.

The Quantum Threat

So what exactly is this threat from quantum tech?  There are a number of threats, but broadly speaking, quantum computing capability is increasing steadily.  This means that as quantum computing becomes more powerful (three keys here:  more cubits for potential computation, more fault-tolerant systems for better performance, and optimized algorithms that are designed to work in quantum vs. traditional computing), it has a larger chance of breaking traditional encryption methods.  These traditional methods are essentially extremely large and complex math problems that would take even supercomputers centuries to solve.  This has kept people safe for a long time, but quantum computing works differently than traditional computers, and some very hard problems are much easier for quantum computers.  How easy?

Three key examples.  

First, RSA.  A fundamental encryption technology in banking, RSA ensures that things like payment details are secure from even the most robust hacks.  Quantum computing, however, is increasing in capabilities at a rapid, accelerating rate.  Researchers have been estimating that at some point, quantum computing will be able to crack RSA.  At the same time, in 2024 a team of researchers claimed to have cracked it using a quantum computer.  However RSA-2048 encryption could be cracked by 2030 based on some estimates, which is 20x easier than previously thought.  This was a very limited scope, but it also served as a stark warning.

Second, Bitcoin.  The blockchain has shown robust protection due to its complexity, but the threat of quantum computing is beginning to register with Bitcoin holders as not an “if”, but a “when.”  The power it would take was once estimated at 500K physical qubits, but more research research indicates that this number could be drastically lower. 

Third, “Capture and Wait”.  This is a simple strategy that ruins the timeline completely for data that will not expire quickly.  Essentially, this strategy is to collect as much data as possible, even if it is currently impossible to decrypt.  Then, simply wait for quantum technology to catch up and then apply it to reveal the data.  This could be the most worrisome piece of the puzzle because of two things:  The pace of improvements for quantum is not only steady, it is accelerating at a much faster pace than expected.  There are unpredictable 10x or 100x leaps in capabilities, and enough groups working on it that these types of achievements can happen at any time.  Further, there are many different actors--governments, corporations, well-funded hacking organizations--that might be making extremely fast progress, but aren’t announcing it, meaning that we won’t actually know if someone has the capability to crack RSA, blockchain, or anything else.

What Can Be Done?

The obvious answer to fix this problem is to use quantum computing to create equally powerful encryption methods.  This is happening, and technology like Quantum Key Distribution (QKD) and variations of Quantum Authentication are being developed.  The problem is, we can’t wait for these technologies.  Something has to be done in the meantime.

One of the best solutions isn’t foolproof long term, but has significant promise against the quantum computing predicted for the near future.  Post-Quantum Cryptography is a collection of algorithms and protocols that use techniques that deliberately focus on areas of computing that quantum cryptography is unsuited for.  Quantum is amazing at some types of problems, but traditional computing can still beat it for other types.  Post-quantum methodologies are varied, but include using protocols or hybrid protocols that are too complex for traditional computers, but designed to remove the strengths of quantum as well.  Additional techniques include account abstraction, hybrid signature layers, using specific (not all) Zero-Knowledge protocols, and working toward proper quantum encryption like QKD

Like any security measure, encryption isn’t done in just one spot.  Vulnerabilities for quantum attacks on Bitcoin have been discovered at various points in a transaction process.  Instead, blockchain infrastructure must create layered defenses that can each hold their own, but together create a significantly stronger barrier to even unknown quantum capabilities.  A key example of this approach is AEREDIUM, with its Quantum Foundation LIbrary (called TRUSTCORE), which is being developed to produce post-quantum primitives across the entire stack, including key encapsulation, identity signatures, per-operation and hash-based signatures, and session-attested verification.  Each piece has a critical role to play, and once it has been fully audited will provide a critical example for other blockchains as they try to stay ahead of the quantum threat.

What Comes Next?

With any emerging technology, the future is uncertain.  Thankfully, with quantum we have been able to look far enough ahead to understand where quantum is asymmetrically strong, and where it suffers at a fundamental level.  The future of computing, at least until the next big breakthrough, will likely be hybrid computing.  Knowing where each will continue evolving is key to protecting against encryption hacking.  Blockchain, banking, and any other security-focused systems need to understand this right now, and work fast to build up a layered, coordinated protection against those rapidly evolving quantum threats.  It won’t be easy, but right now it is still possible.