Q-Day timeline: 43 dated events from the invention of RSA in 1977 to the 2035 migration deadlines, on a map with a source for each. Real, sourced facts up to November 2026, then a clearly labelled scenario of how the race between quantum computers and post-quantum encryption could end.
Clifford Cocks, a mathematician at Britain’s signals intelligence agency GCHQ, wrote an internal note in 1973 describing a cipher in which anyone can lock a message with a public number, but only the holder of its two secret prime factors can unlock it. The note stayed classified until 1997. The same idea, found again in public four years later, became RSA, the lock that Q-Day is about.
Whitfield Diffie and Martin Hellman of Stanford published the concept of an asymmetric cryptosystem in 1976: one key to lock, a different key to unlock, and a way to sign messages digitally. Before this, two parties had to share a secret key in advance. Their key exchange method, and its elliptic curve descendants, now protects most web connections. It is also breakable by the same quantum algorithm that threatens RSA.
In April 1977 three MIT researchers, Ron Rivest, Adi Shamir and Leonard Adleman, built a working public-key cipher. After a Passover evening Rivest worked through the night and had most of the paper written by daybreak. RSA multiplies two large primes into a public modulus. Encrypting is easy. Undoing it without the primes means factoring the modulus, which for a 2048-bit key would take classical computers far longer than the age of the universe.
Martin Gardner described the RSA algorithm in detail in his Mathematical Games column in the August 1977 issue of Scientific American. It was the first time the general public could read how the new cipher worked. The cipher took its name from the initials of its three inventors, Rivest, Shamir and Adleman. The MIT team filed a patent application in December 1977.
The United States Patent Office granted patent 4,405,829 to MIT on 20 September 1983 for the RSA algorithm. Companies that wanted to use RSA in software paid licence fees for the next 17 years. RSA Security released the algorithm into the public domain on 6 September 2000, two weeks before the patent was due to expire on 21 September 2000.
Peter Shor, a mathematician at Bell Labs in Murray Hill, New Jersey, published an algorithm in 1994 that factors large numbers on a quantum computer in polynomial time. It works by turning factoring into the search for the period of a repeating function, which a quantum Fourier transform finds efficiently. The same method solves the discrete logarithm problem behind Diffie-Hellman and elliptic curve keys. A longer journal version appeared later in SIAM Journal on Computing.
A team at IBM Research Almaden in San Jose ran Shor’s algorithm for the first time and factored 15 into 3 and 5. The machine was a liquid-state NMR device: a test tube of a specially synthesised molecule with seven nuclear spins acting as qubits. The result appeared in Nature in December 2001. It proved the algorithm ran on real hardware. It said nothing yet about breaking a 2048-bit key.
A 2012 analysis by Austin Fowler and colleagues estimated that factoring a 2048-bit RSA key with error-corrected qubits would need hundreds of millions to about one billion physical qubits. Physical qubits are noisy. Error correction bundles many of them into one reliable logical qubit, and that overhead set the figure. For years that figure made Q-Day look like a problem for a later generation.
The US National Institute of Standards and Technology announced a public competition in December 2016 to find replacements for RSA and elliptic curve cryptography. The new algorithms had to run on ordinary computers and resist both classical and quantum attack. By the end of 2017 NIST had 69 complete submissions, all of which entered the first round.
Craig Gidney of Google and Martin Ekerå published a 2019 estimate that a quantum computer with about 20 million noisy qubits could factor a 2048-bit RSA key in about 8 hours. That was roughly a fiftyfold drop from the 2012 figure. The saving came from algorithm and circuit design, worked out on paper, not from new hardware.
A research team announced on 28 February 2020 that it had factored RSA-250, an 829-bit number from the old RSA Factoring Challenge. The computation took about 2,700 CPU-years on conventional processors. It remains the largest publicly known factored RSA number. A 2048-bit key is more than twice as long, and each extra bit makes classical factoring much harder, which is why the threat to RSA-2048 comes only from quantum machines.
The NSA published its Commercial National Security Algorithm Suite 2.0 in 2022. Software and firmware signing must prefer the new algorithms by 2025 and use them exclusively by 2030. Web browsers, servers and cloud services follow by 2033. Networking gear such as VPNs and routers must prefer them by 2026, operating systems by 2027. The agency’s goal is that all US national security systems are quantum-resistant by 2035.
The White House issued National Security Memorandum 10 on 4 May 2022. It set the goal of mitigating as much of the quantum risk as feasible by 2035. Federal civilian agencies had one year to submit inventories of IT systems vulnerable to a cryptographically relevant quantum computer, then repeat the exercise every year. Agencies running national security systems had to list every use of quantum-vulnerable cryptography.
On 5 July 2022 NIST announced the first winners of its post-quantum competition, including CRYSTALS-Kyber for key exchange and CRYSTALS-Dilithium for signatures, both based on lattice problems. Four more candidates moved to a fourth round. The same day CISA told organisations to prepare for the new standards. On 5 August 2022 one fourth-round candidate, SIKE, was broken.
On 21 August 2023 CISA, the NSA and NIST released a joint factsheet telling organisations to start migrating to post-quantum cryptography: build an inventory of where they use public-key cryptography and ask vendors for roadmaps. The guidance names the threat called harvest now, decrypt later: an adversary records encrypted traffic today and stores it until a quantum computer can read it. Data that must stay secret for ten years is already exposed.
Apple announced PQ3 on 21 February 2024, a new iMessage protocol that adds post-quantum key establishment on top of elliptic curve cryptography. Signal had added a post-quantum key agreement called PQXDH a few months earlier. Messaging apps moved early, because chats are exactly the long-lived data a harvest now, decrypt later attacker wants.
On 13 August 2024 NIST released its first three final post-quantum standards: FIPS 203 (ML-KEM, from Kyber) for key establishment, FIPS 204 (ML-DSA, from Dilithium) for signatures and FIPS 205 (SLH-DSA, from SPHINCS+), a hash-based signature backup. Eight years after the call for proposals, vendors had final specifications to build into browsers, chips and operating systems.
Google announced in September 2024 that Chrome 131, due in early November 2024, would replace its experimental Kyber key exchange with the final ML-KEM standard, combined with the classical X25519 curve. A hybrid exchange keeps a connection safe as long as either half holds. From then on, every connection between Chrome and a server that supports the hybrid gets post-quantum key exchange by default.
Google Quantum AI announced Willow on 9 December 2024, a 105-qubit superconducting chip built at its fabrication facility in Santa Barbara. As the team grew its encoded qubit grid from 3x3 to 5x5 to 7x7, the logical error rate halved each time. That result, called below threshold, is the condition error correction needs to scale. Without it, adding qubits adds noise faster than it adds power.
On 11 March 2025 NIST picked HQC, a code-based scheme, as a fifth algorithm and a backup to ML-KEM. If someone finds a flaw in the lattice mathematics behind ML-KEM, HQC rests on a different hard problem. NIST expected a draft HQC standard in 2026 and the final in 2027. Having two unrelated families means one mathematical breakthrough cannot take out both.
The UK National Cyber Security Centre, part of GCHQ, published its post-quantum migration timeline on 20 March 2025. By 2028 organisations should define their goals, find the systems to upgrade and draft a plan. By 2031 the highest-priority migrations should be complete. By 2035 the migration should be complete across all systems, products and services.
In May 2025 Craig Gidney of Google Quantum AI published an estimate that a 2048-bit RSA key could be factored in less than a week by a machine with fewer than one million noisy physical qubits. That was a twentyfold cut from his own 2019 figure of 20 million. The machine would run longer, trading speed for size. No quantum computer of that size existed in 2025.
The European Commission and the NIS Cooperation Group published a coordinated roadmap in June 2025. Every member state should have a national transition plan and pilot projects by the end of 2026. High-risk uses, including government communications, public key infrastructure and software update systems, should move by the end of 2030. Medium and low-risk uses should follow as far as feasible by the end of 2035.
IBM said on 10 June 2025 that it would deliver Quantum Starling by 2029 at a new quantum data centre in Poughkeepsie, New York. The target: 200 logical qubits running 100 million quantum operations, about 20,000 times more operations than current machines. A successor, Blue Jay, is designed to reach 2,000 logical qubits and one billion operations.
Cloudflare reported in February 2026 that more than 60 percent of human-originated TLS traffic reaching its network was protected by hybrid ML-KEM key exchange. By June it put the share of browser traffic at over two-thirds. The key exchange is the part harvest now, decrypt later attacks target. Signatures and certificates, which prove a server is who it claims, were still mostly classical.
Iceberg Quantum, a Sydney startup founded by University of Sydney PhD students, published its Pinnacle architecture on 13 February 2026. Using quantum LDPC error-correcting codes instead of the surface code, it estimated RSA-2048 could be factored with fewer than 100,000 physical qubits. The figure is about ten times lower than Gidney’s 2025 estimate. It was validated by simulation, not on hardware. The company also raised a 6 million dollar seed round.
On 25 March 2026 Google’s Heather Adkins and Sophie Schmieg announced that the company would finish migrating its systems to post-quantum cryptography by 2029. The date is a migration target, not a forecast: Google gave no year for when a quantum computer could break current encryption, and said the harvest now, decrypt later threat to encryption was already relevant. Android 17 was integrating post-quantum signature protection using ML-DSA.
On 31 March 2026 Google Quantum AI, with Justin Drake of the Ethereum Foundation and Dan Boneh of Stanford, estimated that the 256-bit elliptic curve protecting Bitcoin and Ethereum could be broken with fewer than 500,000 physical qubits. The previous estimate, from 2023, was about 9 million. The attack would take about 9 minutes after a public key is revealed. Google withheld the circuits and published a zero-knowledge proof that its numbers are correct.
Jameson Lopp and five co-authors published a draft Bitcoin Improvement Proposal on 15 April 2026 called Post Quantum Migration and Legacy Signature Sunset. About three years after activation, the network would stop accepting sends to quantum-vulnerable address types. About two years later, coins left in those addresses would be frozen, even for owners who hold the keys. An estimated 6.7 million BTC, about 34 percent of supply, sits in quantum-vulnerable positions.
President Trump signed Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, on 22 June 2026. Federal high-value and high-impact systems must move to post-quantum key establishment by 31 December 2030 and to post-quantum signatures by 31 December 2031. Federal contractors must meet the post-quantum FIPS standards by the end of 2030. NIST must finish a pilot migration of some of its own systems by 31 December 2027.
The US Government Accountability Office published report GAO-27-108740 on 6 October 2026. It found that the 24 CFO Act agencies had not fully prepared: they lacked cryptography expertise, complete system inventories and funding plans. The GAO said most industry experts believe a cryptographically relevant quantum computer will be developed, possibly as soon as the 2030s, and that estimates vary widely.
NIST published NISTIR 8547, Transition to Post-Quantum Cryptography Standards, on 27 October 2026. It lists the quantum-vulnerable algorithms in existing standards and sets out how agencies should move off them. It tells organisations to migrate key establishment to FIPS 203 first for long-lived or highly sensitive data, because that data is the target of harvest now, decrypt later collection.
Scenario. NIST meets the 31 December 2027 deadline in Executive Order 14412 and completes a pilot migration of a subset of its systems. The hardest part is not the new algorithms. It is finding every place an old one hides: certificates embedded in firmware, hard-coded keys in lab instruments, libraries nobody remembers installing. Real anchor: the order’s pilot deadline is 31 December 2027.
Scenario. By the end of 2028 large UK organisations have the cryptographic inventories and migration plans the NCSC asked for. Many find more RSA than expected: in payment terminals, building access cards, VPN appliances and signed software updates, each with its own vendor and replacement cycle. Real anchor: the NCSC milestone for defining goals and an initial plan is 2028.
Scenario. IBM brings Quantum Starling online in 2029 with 200 logical qubits. It is a scientific milestone and a long way from Q-Day: the 2025 and 2026 estimates for breaking RSA-2048 assume far larger machines running for hours or days. Security teams read it as a countdown signal, not an alarm. Real anchor: IBM’s 2029 target, announced 10 June 2025.
Scenario. Google finishes moving its own services to post-quantum key exchange and signatures by the end of 2029. Android devices sign and verify updates with ML-DSA. The migration covers the company’s own systems. Websites, banks and governments that still rely on classical certificates remain on their own schedules. Real anchor: Google’s 2029 deadline, announced 25 March 2026.
Scenario. Two deadlines fall on the same day. US federal high-value systems must use post-quantum key establishment, and federal contractors must meet the post-quantum FIPS standards. The EU expects high-risk uses, such as government communications and software update systems, to have moved. In this scenario most agencies meet the key-exchange deadline because browsers and cloud providers did the work for them. Real anchors: Executive Order 14412 and the EU roadmap.
Scenario. The US deadline for post-quantum digital signatures on federal high-value systems arrives, along with the NCSC target for completing the highest-priority migrations. Signatures are slower to replace: certificate chains, hardware security modules and embedded devices have to change at once, and ML-DSA signatures are far larger than the elliptic curve ones they replace. Real anchors: Executive Order 14412 and NCSC milestones.
Scenario. A laboratory announces that a fault-tolerant machine with a few hundred thousand physical qubits has factored a 2048-bit RSA modulus generated for the test. The run takes days. It is not secret and it is not cheap, but it makes Q-Day a date instead of an estimate. Real anchors: the falling estimates from 20 million qubits in 2019 to under 100,000 in 2026, and the 2025 expert survey that put a breaking machine within 10 years at 28 to 49 percent.
Scenario. Traffic recorded before the switch to hybrid key exchange can now be decrypted one session at a time, at high cost per key. Diplomatic cables, trade secrets and medical records encrypted only with RSA or classical Diffie-Hellman in the 2010s become targets. Data sent after browsers moved to ML-KEM in late 2024 stays protected. Real anchor: the harvest now, decrypt later warnings of CISA, NSA and NIST since 2022.
Scenario. US national security systems reach the CNSA 2.0 date for exclusive use of quantum-resistant algorithms in web browsers, servers, cloud services and operating systems. Hybrid modes that kept the classical curve as a safety net are retired. Real anchor: the NSA’s CNSA 2.0 timetable sets 2033 for exclusive use in browsers, servers, cloud services and operating systems.
Scenario. If BIP-361 or a similar soft fork activates around 2029, its second phase falls about here. Coins never moved out of quantum-vulnerable addresses can no longer be spent with old signatures. The frozen set includes early coins whose owners are unknown. Real anchor: the BIP-361 draft of 15 April 2026 and its estimate of 6.7 million BTC in quantum-vulnerable positions.
Scenario. Three timelines end together: NSM-10 for US federal systems, the NCSC target for all UK systems and the EU target for medium and low-risk uses. Most traffic and most signatures are post-quantum. What remains on RSA are devices nobody can update, such as old industrial controllers and implanted hardware, and they are isolated rather than fixed. Real anchors: NSM-10 (2022), NCSC (2025), EU roadmap (2025).