Blog

Categories:

6. 4. 2026

Security Cryptography

Comparing Digital and Quantum Computers, Part 9: Assesment of Original Attack

Everyone in the IT world is wondering how big a threat quantum computers pose to cryptography and how to deal with the problem. This series of articles tries to explain the problem in a popular way. After getting acquainted with the available technologies, it is possible to try to estimate the capabilities of quantum computers around 2035.

Technology overview

Based on this information, it is possible to create the following overview, which is again an estimate for the year 2035. To attack the following algorithms, a quantum computer, like a digital computer, needs a specific time, and in the case of a quantum computer, a minimum number of passes. This is followed by post-processing on a conventional digital computer. In addition to the specified time, it also requires a certain minimum number of qbits, but there is constant development in this area, so at the time of writing the article the result is slightly overestimated. For these requirements, the most significant input is probably the cooling power. Here is a modified table that takes into account the power consumption of individual qbits and gates in the range of pW, thermal radiation of the cabling of 1mW/m, and reading the state from one qbit of 100mW. The system mentioned assumes high-quality insulation and the need for cooling to a temperature of 1 mK , and uses a steel supporting structure with mechanical parameters for the weight of the device corresponding to a steel ball of a given volume. The need for internal cooling for heat dissipation is deliberately neglected, this is only a theoretical model. The necessary construction for heat dissipation would extremely change the conditions of the entire approximate calculation. The resulting energy stated is needed for the implementation of one calculation, not all repetitions to ensure an adequate level of probability. At the same time, it does not include post-processing, which, on the other hand, does not have significant power requirements.

Algorithm	Logical qubits	Number of gates	Time (s)	Volume (m³)	Energy (J)
DSA 1024	2058	1.074·10¹⁰	1.074·10³	0.028	1.667·10¹⁴
DSA 2048	4106	8.590·10¹⁰	8.590·10³	0.055	2.661·10¹⁵
DH 1024	2058	1.074·10¹⁰	1.074·10³	0.028	1.667·10¹⁴
DH 2048	4106	8.590·10¹⁰	8.590·10³	0.055	2.661·10¹⁵
DH 3072	6154	2.899·10¹¹	2.899·10⁴	0.083	1.346·10¹⁶
DH 4096	8202	6.872·10¹¹	6.872·10⁴	0.111	4.252·10¹⁶
DH 6144	12298	2.319·10¹²	2.319·10⁵	0.166	2.152·10¹⁷
DH 8192	16394	5.498·10¹²	5.498·10⁵	0.221	6.800·10¹⁷
brainpoolP256r1	522	1.678·10⁸	16.78	0.007	6.607·10¹¹
brainpoolP384r1	778	5.662·10⁸	56.62	0.010	3.324·10¹²
brainpoolP521r1	1052	1.414·10⁹	141.42	0.014	1.122·10¹³
NIST P-256	522	1.678·10⁸	16.78	0.007	6.607·10¹¹
NIST P-384	778	5.662·10⁸	56.62	0.010	3.324·10¹²
NIST P-521	1052	1.414·10⁹	141.42	0.014	1.122·10¹³
Curve25519	520	1.658·10⁸	16.58	0.007	6.505·10¹¹
Curve448	906	8.992·10⁸	89.92	0.012	6.146·10¹²
RSA 512	1029	6.711·10⁸	67.11	0.014	5.210·10¹²
RSA 1024	2053	5.369·10⁹	536.87	0.028	8.316·10¹³
RSA 2048	4101	4.295·10¹⁰	4.295·10³	0.055	1.329·10¹⁵
RSA 2540	5085	8.194·10¹⁰	8.194·10³	0.069	3.143·10¹⁵
RSA 3072	6149	1.450·10¹¹	1.450·10⁴	0.083	6.725·10¹⁵
RSA 4096	8197	3.436·10¹¹	3.436·10⁴	0.110	2.125·10¹⁶
RSA 7168	14341	1.841·10¹²	1.841·10⁵	0.193	1.992·10¹⁷
RSA 8192	16389	2.749·10¹²	2.749·10⁵	0.221	3.399·10¹⁷
RSA 13550	27105	1.244·10¹³	1.244·10⁶	0.365	2.544·10¹⁸
RSA 37100	74205	2.553·10¹⁴	2.553·10⁷	1.000	1.429·10²⁰
RSA 76608	153221	2.248·10¹⁵	2.248·10⁸	2.064	2.599·10²¹

The article contains only an estimate, not a specific implementation. It is not even an optimal estimate, because the development of algorithms for quantum computers will accelerate attacks. Algorithms are already significantly simpler, but their explanation is challenging and it is extremely difficult to find a suitable idea. The question is to what extent the risks arising from quantum computers are overestimated in terms of the time frame. Another issue is the effect of multiplexing, where several qubits use one gate. While this reduces the required number of gates (connections) and their power consumption, the total processing time is also increased in the corresponding proportion. An attack using quantum computers is definitely within the capabilities of the entire human civilization, and perhaps even within the capabilities of some state actors. Nevertheless, it can be somewhat problematic to attack even simpler elliptic curves for a simple reason. This reason is to ensure an adequate amount of available energy. In addition to the design difficulties, a cryptographically relevant quantum computer will also have a problem with the aforementioned power source. According to this basic description, an attack on asymmetric algorithms could require significant investment in resources. On the other hand, increasing the operating temperature by a single order of magnitude will significantly reduce the aforementioned impacts. Added to this is the question of how to solve the problem of waste heat. According to this estimate, quantum computers are still a theoretical attack. However, this attack may become feasible in the foreseeable future, where any technological breakthrough threatens current cryptography.

If, based on the above results, I were to consider power supply using blocks with 1GW reactors for simplicity, I would get the following results. For Curve25519 , brainpoolP256r1 and NIST P-256, it would be 39 blocks, for brainpoolP384r1 and NIST P-384, it would be 58 blocks, for Curve448, it would be 60. blocks and for brainpoolP521r1 and NIST P-521 even 78 blocks.I'm really curious to see how close this estimate will be to reality. Given the possibilities offered by quantum computers, I'd like to be wrong.

$\mathit{N}_{\mathit{1GW\ blocks}}\mathit{=}\frac{\mathit{Energy\ needed\ for\ computation\ (J)}}{{1 \cdot 10}^{\mathit{9}}W \cdot time\ of\ computation\ (s)}$

At the same time, the above overview shows that for small key sizes, a classical digital computer could be more suitable for decryption than a quantum computer. Examples include DSA 1024b, DH 1024, DSA 2048b and DH 2048b. For small key sizes of the RSA algorithm, this difference is not so great, quantum computers have dominated here from the beginning. For large keys, of course, the quantum computer has a clear advantage in all cases. The biggest problem here is cooling, the temperature close to absolute zero is as limiting as the speed of light. The goal of the development is therefore to shift the operating temperatures of the system to more comfortable temperature ranges. Here is an overview of what this would mean in terms of energy consumption, i.e. the energy required for one calculation.

Algoritmus	1μK (J)	1mK (J)	0,1K (J)	1K (J)	10K (J)	100K (J)
DSA 1024	1.667·10¹⁷	1.667·10¹⁴	1.667·10¹²	1.667·10¹¹	1.667·10¹⁰	1.667·10⁹
DSA 2048	2.661·10¹⁸	2.661·10¹⁵	2.661·10¹³	2.661·10¹²	2.661·10¹¹	2.661·10¹⁰
DH 1024	1.667·10¹⁷	1.667·10¹⁴	1.667·10¹²	1.667·10¹¹	1.667·10¹⁰	1.667·10⁹
DH 2048	2.661·10¹⁸	2.661·10¹⁵	2.661·10¹³	2.661·10¹²	2.661·10¹¹	2.661·10¹⁰
DH 3072	1.346·10¹⁹	1.346·10¹⁶	1.346·10¹⁴	1.346·10¹³	1.346·10¹²	1.346·10¹¹
DH 4096	4.253·10¹⁹	4.253·10¹⁶	4.253·10¹⁴	4.253·10¹³	4.253·10¹²	4.253·10¹¹
DH 6144	2.152·10²⁰	2.152·10¹⁷	2.152·10¹⁵	2.152·10¹⁴	2.152·10¹³	2.152·10¹²
DH 8192	6.800·10²⁰	6.800·10¹⁷	6.800·10¹⁵	6.800·10¹⁴	6.800·10¹³	6.800·10¹²
brainpoolP256r1	6.607·10¹⁴	6.607·10¹¹	6.607·10⁹	6.607·10⁸	6.607·10⁷	6.607·10⁶
brainpoolP384r1	3.324·10¹⁵	3.324·10¹²	3.324·10¹⁰	3.324·10⁹	3.324·10⁸	3.324·10⁷
brainpoolP521r1	1.122·10¹⁶	1.122·10¹³	1.122·10¹¹	1.122·10¹⁰	1.122·10⁹	1.122·10⁷
NIST P-256	6.607·10¹⁴	6.607·10¹¹	6.607·10⁹	6.607·10⁸	6.607·10⁷	6.607·10⁶
NIST P-384	3.324·10¹⁵	3.324·10¹²	3.324·10¹⁰	3.324·10⁹	3.324·10⁸	3.324·10⁷
NIST P-521	1.122·10¹⁶	1.122·10¹³	1.122·10¹¹	1.122·10¹⁰	1.122·10⁹	1.122·10⁷
Curve25519	6.505·10¹⁴	6.505·10¹¹	6.505·10⁹	6.505·10⁸	6.505·10⁷	6.505·10⁶
Curve448	6.146·10¹⁵	6.146·10¹²	6.146·10¹⁰	6.146·10⁹	6.146·10⁸	6.146·10⁷
RSA 512	5.210·10¹⁵	5.210·10¹²	5.210·10¹⁰	5.210·10⁹	5.210·10⁸	5.210·10⁷
RSA 1024	8.316·10¹⁶	8.316·10¹³	8.316·10¹¹	8.316·10¹⁰	8.316·10⁹	8.316·10⁸
RSA 2048	1.329·10¹⁸	1.329·10¹⁵	1.329·10¹³	1.329·10¹²	1.329·10¹¹	1.329·10⁹
RSA 2540	3.143·10¹⁸	3.143·10¹⁵	3.143·10¹³	3.143·10¹²	3.143·10¹¹	3.143·10¹⁰
RSA 3072	6.725·10¹⁸	6.725·10¹⁵	6.725·10¹³	6.725·10¹²	6.725·10¹¹	6.725·10¹⁰
RSA 4096	2.125·10¹⁹	2.125·10¹⁶	2.125·10¹⁴	2.125·10¹³	2.125·10¹²	2.125·10¹¹
RSA 7168	1.992·10²⁰	1.992·10¹⁷	1.992·10¹⁵	1.992·10¹⁴	1.992·10¹³	1.992·10¹²
RSA 8192	3.399·10²⁰	3.399·10¹⁷	3.399·10¹⁵	3.399·10¹⁴	3.399·10¹³	3.399·10¹²
RSA 13550	2.544·10²¹	2.544·10¹⁸	2.544·10¹⁶	2.544·10¹⁵	2.544·10¹⁴	2.544·10¹³
RSA 37100	1.429·10²³	1.429·10²⁰	1.429·10¹⁸	1.429·10¹⁷	1.429·10¹⁶	1.429·10¹⁴
RSA 76608	2.599·10²⁴	2.599·10²¹	2.599·10¹⁹	2.599·10¹⁸	2.599·10¹⁷	2.599·10¹⁶

In this series, I tried to explain the problems of attacks on current asymmetric cryptography and to explain in a somewhat popular way the problems of attacks using quantum computers and the Shorr algorithm. Although the part dedicated to quantum computers tries to explain the mentioned issue, it is mainly a popular form and includes some distortion of information, for which I apologize. This area is extremely complex and its explanation is difficult. In my opinion, however, it is necessary to draw attention to the publicly overlooked problem of attack time depending on the need to achieve a certain accuracy and, in the case of cryogenic devices, the need to effectively cool such devices.

In the future, this series will be loosely followed by a critical assessment of the successes of attacks on asymmetric cryptography using both classical computers (history) and quantum computers. The reason is an effort to draw attention to what I believe to be misleading experiments and their possible inappropriate interpretation. I would like to compute power needed for each quantum algorithms also.

Autor článku:

Jan Dušátko

Jan Dušátko has been working with computers and computer security for almost a quarter of a century. In the field of cryptography, he has cooperated with leading experts such as Vlastimil Klíma or Tomáš Rosa. Currently he works as a security consultant, his main focus is on topics related to cryptography, security, e-mail communication and Linux systems.

1. Introductory Provisions

1.1. These General Terms and Conditions are, unless otherwise agreed in writing in the contract, an integral part of all contracts relating to training organised or provided by the trainer, Jan Dušátko, IČ 434 797 66, DIČ 7208253041, with location Pod Harfou 938/58, Praha 9 (next as a „lector“).
1.2. The contracting parties in the general terms and conditions are meant to be the trainer and the ordering party, where the ordering party may also be the mediator of the contractual relationship.
1.3. Issues that are not regulated by these terms and conditions are dealt with according to the Czech Civil Code, i.e. Act No.89/2012 Coll.
1.4. All potential disputes will be resolved according to the law of the Czech Republic.

2. Creation of a contract by signing up for a course

2.1. Application means unilateral action of the client addressed to the trainer through a data box with identification euxesuf, e-mailu with address register@cryptosession.cz or register@cryptosession.info, internet pages cryptosession.cz, cryptosession.info or contact phone +420 602 427 840.
2.2. By submitting the application, the Client agrees with these General Terms and Conditions and declares that he has become acquainted with them.
2.3. The application is deemed to have been received at the time of confirmation (within 2 working days by default) by the trainer or intermediary. This confirmation is sent to the data box or to the contact e-mail.
2.4. The standard time for registration is no later than 14 working days before the educational event, unless otherwise stated. In the case of a natural non-business person, the order must be at least 28 working days before the educational event.
2.5. More than one participant can be registered for one application.
2.6. If there are more than 10 participants from one Client, it is possible to arrange for training at the place of residence of the intermediary or the Client.
2.7. Applications are received and processed in the order in which they have been received by the Provider. The Provider immediately informs the Client of all facts. These are the filling of capacity, too low number of participants, or any other serious reason, such as a lecturer's illness or force majeure. In this case, the Client will be offered a new term or participation in another educational event. In the event that the ordering party does not agree to move or participate in another educational event offered, the provider will refund the participation fee. The lack of participants is notified to the ordering party at least 14 days before the start of the planned term.
2.8. The contract between the provider and the ordering party arises by sending a confirmation from the provider to the ordering party.
2.9. The contract may be changed or cancelled only if the legal prerequisites are met and only in writing.

3. Termination of the contract by cancellation of the application

3.1. The application may be cancelled by the ordering party via e-mail or via a data mailbox.
3.2. The customer has the right to cancel his or her application for the course 14 days before the course takes place without any fees. If the period is shorter, the subsequent change takes place. In the interval of 7-13 days, an administrative fee of 10% is charged, cancellation of participation in a shorter interval than 7 days then a fee of 25%. In case of cancellation of the application or order by the customer, the possibility of the customer's participation in an alternative period without any additional fee is offered. The right to cancel the application expires with the implementation of the ordered training.
3.3. In case of cancellation of the application by the trainer, the ordering party is entitled to a full refund for the unrealized action.
3.4. The ordering party has the right to request an alternative date or an alternative training. In such case, the ordering party will be informed about all open courses. The alternative date cannot be enforced or enforced, it depends on the current availability of the course. If the alternative training is for a lower price, the ordering party will pay the difference. If the alternative training is for a lower price, the trainer will return the difference in the training prices to the ordering party.

4. Price and payment terms

4.1. By sending the application, the ordering party accepts the contract price (hereinafter referred to as the participation fee) indicated for the course.
4.2. In case of multiple participants registered with one application, a discount is possible.
4.3. The participation fee must be paid into the bank account of the company held with the company Komerční banka č. 78-7768770207/0100, IBAN:CZ5301000000787768770207, BIC:KOMBCZPPXXX. When making the payment, a variable symbol must be provided, which is indicated on the invoice sent to the client by the trainer.
4.4. The participation fee includes the provider's costs, including the training materials. The provider is a VAT payer.
4.5. The client is obliged to pay the participation fee within 14 working days of receipt of the invoice, unless otherwise stated by a separate contract.
4.6. If the person enrolled does not attend the training and no other agreement has been made, his or her absence is considered a cancellation application at an interval of less than 7 days, i.e. the trainer is entitled to a reward of 25% of the course price. The overpayment is returned within 14 days to the sender's payment account from which the funds were sent. Payment to another account number is not possible.
4.7. An invoice will be issued by the trainer no later than 5 working days from the beginning of the training, which will be sent by e-mail or data box as agreed.

5. Training conditions

5.1. The trainer is obliged to inform the client 14 days in advance of the location and time of the training, including the start and end dates of the daily programme.
5.2. If the client is not a student of the course, he is obliged to ensure the distribution of this information to the end participants. The trainer is not responsible for failure to comply with these terms and conditions.
5.2. By default, the training takes place from 9 a.m. to 5 p.m. at a predetermined location.
5.3. The trainer can be available from 8 a.m. to 9 a.m. and then from 17 a.m. to 6 p.m. for questions from the participants, according to the current terms and conditions.
5.4. At the end of the training, the certificate of absorption is handed over to the end users.
5.5. At the end of the training, the end users evaluate the trainer's approach and are asked to comment on the evaluation of his presentation, the manner of presentation and the significance of the information provided.

6. Complaints

6.1. If the participant is grossly dissatisfied with the course, the trainer is informed of this information.
6.2. The reasons for dissatisfaction are recorded in the minutes in two copies on the same day. One is handed over to the client and one is held by the trainer.
6.3. A statement on the complaint will be submitted by e-mail within two weeks. A solution will then be agreed within one week.
6.4. The customer's dissatisfaction may be a reason for discontinuing further cooperation, or financial compensation up to the price of the training, after deduction of costs.

7. Copyright of the provided materials

7.1. The training materials provided by the trainer in the course of the training meet the characteristics of a copyrighted work in accordance with Czech Act No 121/2000 Coll.
7.2. None of the training materials or any part thereof may be further processed, reproduced, distributed or used for further presentations or training in any way without the prior written consent of the trainer.

8. Liability

8.1. The trainer does not assume responsibility for any shortcomings in the services of any third party that he uses in the training.
8.2. The trainer does not assume responsibility for injuries, damages and losses incurred by the participants in the training events or caused by the participants. Such costs, caused by the above circumstances, shall be borne exclusively by the participant in the training event.

9. Validity of the Terms

9.1 These General Terms and Conditions shall be valid and effective from 1 October 2024.

Blog

Comparing Digital and Quantum Computers, Part 9: Assesment of Original Attack

Technology overview

Autor článku:

Podobné články