Mike Howells's Blog

Category: Cryptography

  • The Signature That Retires the Signatures

    The Signature That Retires the Signatures

    It started with a signature.

    On June 22, 2026, the President signed two executive orders about quantum computing. One of them directs the federal government to begin retiring the digital signature algorithms that secure nearly everything, on a deadline, with names and dates attached. I find it hard not to notice the shape of that. A signature, ordering the replacement of signatures. The old world authorizing its own succession.

    This is the last post in this series, and it is the one where the story stops being history and physics and becomes my day job. Six posts ago we started at Bletchley Park with a machine built to break a cipher everyone believed unbreakable. We followed the thread through Shor’s bridge, through the prism, through the soap bubbles. In the last post I made the case that Q-Day is not a date but a probability distribution, and that for recorded traffic the deadline is earlier than Q-Day anyway. This post is about what the world is actually doing about it, because the answer, as of this summer, is a great deal, in public, on the record, and faster than most people realize.

    The replacements already exist

    First, the good news, because there is genuine good news. This is not a story about waiting for a solution. The solution shipped two years ago.

    Post-quantum cryptography, meaning cryptographic algorithms designed to resist attack by both quantum and classical computers, is not exotic future technology. In August 2024, NIST published the finished standards. The two that matter most for this post carry the names ML-KEM, standardized in FIPS 203, and ML-DSA, standardized in FIPS 204. ML-KEM handles key establishment, which means the process by which two parties who have never met agree on a shared secret key over a public channel. ML-DSA handles digital signatures, which means the process of proving that a message or a piece of software came from who it claims to come from and has not been altered.

    Both are built on mathematical problems involving lattices, high-dimensional grids of points, rather than on factoring or its elliptic curve cousin. And the reason for the switch comes straight out of this series. Shor’s algorithm works because factoring hides a rhythm, and a quantum computer can hear rhythms. The lattice problems underneath ML-KEM and ML-DSA have no known rhythm to hear. Nobody has proven none exists, in the same way nobody had proven factoring was safe for the fifty years we bet everything on it. But after years of open, adversarial analysis by the world’s cryptographers, the new problems have no known structure that either a classical or a quantum computer can exploit. The tuning fork gets no answer. That is the strongest guarantee cryptography has ever been able to offer, because it is the same guarantee the old algorithms had, minus the flaw we now know about.

    So the algorithms exist, they are standardized, and they are shipping in real products. The remaining problem is the one engineers always inherit from mathematicians. Deployment.

    Two signatures in June

    Which brings us back to June 22.

    The first order, Executive Order 14412, is titled Securing the Nation Against Advanced Cryptographic Attacks, and it converts the migration from advice into instruction. I read the primary text rather than the coverage, and the coverage got details wrong that the text settles, including, in the early days, the order’s own number. Here is what it actually requires. Federal agencies must move their high value assets and high impact systems to post-quantum cryptography for key establishment by December 31, 2030, and for digital signatures by December 31, 2031. Every agency had 30 days to name a dedicated PQC migration lead reporting to its CIO. NIST must run a pilot migration of its own systems, complete by the end of 2027. CISA and NIST have 270 days to publish the minimum elements of a cryptographic bill of materials, which is a machine-readable inventory of the cryptographic assets a given piece of hardware or software actually uses. And a proposed federal acquisition rule will extend the compliance requirement to government contractors by the same 2030 deadline. National Security Systems are carved out and handled separately under NSA oversight, with annual reports to the President until their migration is complete.

    The order gave OMB 90 days to issue binding guidance to agencies. OMB used two. Memorandum M-26-15 landed on June 24, and it requires every agency to submit a migration plan by October 22, 2026. It also does something the order itself does not, which is publish a phased schedule: inventory and planning through 2027, pilots and early migration through 2028, key establishment migrated by 2030, signatures in 2031, and everything remaining by 2035. The 2030 and 2031 dates are the priority-system deadlines. 2035 is the backstop for the rest. Whatever else you conclude about the machinery of government, the enforcement layer of this particular policy did not stroll.

    The second order, Executive Order 14413, Ushering in the Next Frontier of Quantum Innovation, is the other half of the thought. It establishes the Quantum Computer for Application Development and Discovery Science effort, coordinated from the White House science office, to build a quantum computer at a scale intended to begin the era of quantum-enabled scientific discovery, with at least one machine delivered to a Department of Energy facility. The order sets no date for that machine. The Energy Department supplied one the next day, announcing an initiative called Quantum Genesis that targets fault-tolerant systems in 2028 carrying logical qubits in the low hundreds. Read the two orders side by side and the message is hard to miss. The same government is funding the sword and mandating the shield, signed on the same day, with the sword on the nearer date and the shield on the firmer one.

    Why keys before signatures

    Now look closely at those two dates in EO 14412, because the one-year gap between them is not arbitrary. Key establishment by the end of 2030. Signatures by the end of 2031. Keys first. That ordering encodes the single most important analytical point in this entire post, and it follows directly from the harvest now, decrypt later logic of the last post.

    Recorded encrypted traffic is retroactively breakable. An adversary who records your protected traffic today holds ciphertext whose confidentiality depends on a key that was established with quantum-vulnerable mathematics. The day the machine exists, that recording opens. So every day that traffic continues to flow under old key establishment adds to a pile that is already, in a meaningful sense, lost.

    Signatures do not work that way. A signature’s job is done at the moment it is verified. An adversary who records a signed software update today and breaks the signature algorithm in 2033 gains almost nothing, because the update was verified and installed years ago, and breaking the old signature does not let anyone reach back in time and forge a different past. To abuse a signature algorithm you must break it while it is still being trusted. That means signature migration is urgent in the ordinary way that patching is urgent, while key establishment migration is urgent in the retroactive way that makes delay permanently unrecoverable. The federal ordering, keys in 2030 and signatures in 2031, gets that asymmetry exactly right.

    One honest exception belongs on the record. Signatures with very long verification horizons, code signing and firmware signing above all, sit closer to the key establishment category than the calendar suggests. A signed firmware image may need to be trusted, verified fresh, for fifteen or twenty years on devices that will never see an update pipeline again. Anyone signing things that must still be believed in 2040 should be behaving like a key establishment migrator, not a signature migrator.

    And while we are being honest, let me close a door some readers will reach for. Modern TLS uses ephemeral keys, a fresh key agreement for every session, a property called forward secrecy, and it is tempting to hope this defeats the recorded-traffic problem. It does not. Forward secrecy protects you when a long-term key is stolen later. It does nothing against Shor’s algorithm, because the ephemeral public values are right there in the recorded handshake, and reconstructing the matching private values from them is exactly the problem Shor’s algorithm solves. The recording contains everything the mathematics needs. Forward secrecy was built against thieves, not against a machine that unpicks the lock itself.

    The uncomfortable ordering inside the old algorithms

    Here is the part I have seen almost nowhere in mainstream coverage, and it matters for anyone deciding what to migrate first.

    Within the old, vulnerable world, elliptic curve cryptography falls before RSA. That sounds backwards, because ECC was the newer, stronger, more elegant system, the one this series covered in Post 3 as the upgrade. Against classical computers it genuinely is stronger per bit. But Shor’s algorithm mostly cares about key size, and ECC’s efficiency is exactly the property that let everyone use 256-bit keys instead of 2048-bit keys. Smaller problem, smaller quantum computer.

    The current numbers make the point concrete. In March 2026, researchers from Google Quantum AI, together with collaborators at the Ethereum Foundation and Stanford, published resource estimates showing that a 256-bit elliptic curve key could be broken with fewer than half a million physical qubits, in a runtime measured in minutes, under the same conservative hardware assumptions that put RSA-2048 at roughly a million qubits and a week. A separate line of academic work published this spring put the logical qubit requirement for a 256-bit curve at 1,193, against 2,043 for the RSA key of equivalent classical strength. That is roughly forty percent fewer. The academic result buys its reduction with a far larger gate count, so the two papers are not measuring the same cost, and I will not pretend they are. But on the resource that decides whether a machine can attempt the attack at all, both now point the same way. The elegant algorithm goes first. Classically stronger turned out to mean quantumly weaker, and there may well be a window in which the machines can break elliptic curves but cannot yet touch RSA. Nearly all modern TLS, and for that matter nearly all cryptocurrency, lives on the wrong side of that window.

    The view from the certificate authority

    Now let me bring this all the way down to the systems I actually operate, because the vendor side of this migration contains a puzzle that took me some digging to resolve, and the resolution is more instructive than the puzzle.

    In May 2026, Microsoft shipped post-quantum support in Active Directory Certificate Services, the certificate authority role that anchors enterprise PKI across an enormous share of the world’s Windows environments. What shipped was ML-DSA. Signatures. The key establishment algorithm, ML-KEM, is slated for a later phase of AD CS, with no date attached. Set that next to the federal deadlines and it looks like an inversion. The policy says keys first, signatures second, correctly, for the harvest-now reasons above. The largest enterprise PKI vendor shipped signatures first and keys later.

    The inversion dissolves when you separate two planes that this series has been quietly treating as one. The traffic plane is where harvest now, decrypt later lives, and on that plane Microsoft moved early. ML-KEM has been generally available in the Windows cryptographic platform since late 2025, and on July 14, 2026, hybrid key exchange arrived in the TLS stack itself. Hybrid key exchange pairs a classical algorithm with ML-KEM in the same handshake, so that an attacker must break both. It shipped to Windows 11 and Windows Server 2025 together, and it shipped turned off. The three new groups require TLS 1.3 and an explicit administrator decision to enable them, and the default negotiation order still lists the classical curves. So the recorded-traffic problem is being addressed where recorded traffic actually happens, in the protocol rather than in the certificate. Shipped is not the same as enabled, and enabling it belongs to the people who run the servers.

    The certificate plane is a different animal, and it is a signature animal all the way down. A certificate authority’s entire function is signing. Its root certificates are the longest-lived cryptographic objects in most organizations, ten and twenty year lifetimes, which means a root issued today on old algorithms is still being trusted well past every deadline in EO 14412. And here is the operational detail that should focus attention: there is no in-place migration. An existing certificate authority cannot be converted to ML-DSA. The signature algorithm is fixed at creation, so a post-quantum PKI means standing up an entirely new hierarchy in parallel with the old one, migrating trust relationships, templates, and enrollment one dependency at a time. That is not a patch. That is a project measured in years, which is precisely why the CA is where the longest-lead work begins first. Signatures-first at the certificate authority is not the inversion of keys-first policy. It is the same deadline math applied to the slowest-moving objects in the fleet.

    One more date belongs in this section. On June 30, 2026, eight days after the executive order, Microsoft moved its own schedule. The roadmap it had published ten months earlier called for early adoption of quantum-safe capabilities by 2029 and full transition by 2033, a position it described at the time as two years ahead of the governments. The new goal is to transition products and services to post-quantum cryptography by 2029 outright, with the work folded into the same engineering framework the company uses for its other security commitments. The stated reason is that the risk horizon has shifted. The announcement cites the executive order in its footnotes. So the apparent inversion resolves a second time, at the level of intent rather than architecture. The largest enterprise PKI vendor is not running against federal policy. It is running a year ahead of it.

    I will write more about what a parallel hierarchy build actually involves, because I suspect I am going to be living one. For now the summary for anyone responsible for a PKI is one sentence. The traffic plane migrates by protocol upgrade and the certificate plane migrates by rebuild, and the rebuild is the long pole.

    What does not need rescuing

    One reassurance before the close, because a series about breaking encryption owes its readers the boundary of the threat.

    Symmetric encryption survives, and so does hashing. The AES that encrypts your disk and the SHA-256 that fingerprints your files do not rest on factoring or elliptic curves, and Shor’s algorithm has nothing to say to them. The best known quantum attack against symmetric ciphers offers only a quadratic speedup, which sounds dramatic and is answered, completely, by doubling the key length. AES-256 is expected to remain secure against quantum computers, full stop. The quantum threat is precise, not general. It targets the public-key mathematics that lets strangers establish trust, because that mathematics, and only that mathematics, was built on problems with a rhythm. This is also why a quantum computer will not speed up your spreadsheet, your database, or your compile times. It is not a faster computer. It is a different instrument, and it plays a narrow repertoire devastatingly well.

    Closing the loop

    Eighty-seven years ago, the British government looked at a machine everyone knew was unbreakable and funded the effort to break it anyway, in secret, under existential pressure, after the catastrophe was already underway. The work at Bletchley Park was heroic partly because it was late. The war did not wait for the bombe, and the bombe had to be built inside the emergency it was meant to end.

    What has happened between 1994 and this June is, whatever its imperfections, the opposite shape. The flaw was found by mathematicians decades before the machine that exploits it exists. The replacement mathematics was developed, attacked, and standardized in the open. The deadlines were signed while the largest published demonstration anywhere held 96 logical qubits alive at once, for the length of a single laboratory circuit, and while Google’s own circuits for a 256-bit elliptic curve called for between 1,200 and 1,450 of them, each one holding through tens of millions of operations without a single uncorrected fault. Those are not the same kind of qubit, and the count is the easier of the two gaps to close. For once, the institutions are building the defense before the weapon, in public, with dates attached. You do not defeat an astronomical number by counting through it. You defeat it by exploiting structure. And the last lesson of this series is that the defenders finally learned the same trick as the attackers, which is to exploit the structure of time itself. The migration is racing a machine that does not exist yet, and that is the only race against this machine that can be won.

    I am the person who needed to understand what the cryptographer’s work means for the world I live in. Seven posts later, here is what it means. The math is settled, the machines are coming on a schedule nobody knows, the deadlines are real, the replacements work, and the job now belongs to the people who run systems. People like me, and quite possibly people like you.

    The bombe is in a museum. The next machine will not take its enemies by surprise.

    Fediverse Reactions
  • A Machine Made of Soap Bubbles

    A Machine Made of Soap Bubbles

    It started with a soap bubble.

    Blow one and watch it drift. For a few seconds it is a perfect thing, a sphere of swirling color, physics balanced on a film thinner than a wavelength of light. Then a draft touches it, or a mote of dust, or nothing you can see at all, and it is gone. Not damaged. Gone. A soap bubble does not degrade gracefully. It exists completely and then it does not exist, and everything it was doing ends in the same instant.

    In the last post, I showed you the complete mechanism by which a quantum computer breaks RSA. Superposition loads the problem, interference silences the wrong answers, measurement reads the survivor. The mathematics has been settled since 1994. And I ended on the honest cliffhanger: the machine that runs it does not exist. This post is about why, and about the honest answer to the question everyone eventually asks, which is how long the gap will last.

    The short version of why is that we are trying to build a computer out of soap bubbles.

    The fragility is not a defect

    Everything that makes a qubit powerful comes from its isolation. Qubit is short for quantum bit, and the superpositions and interference we have spent four posts on only exist while the qubit remains genuinely undisturbed, a pond no one has touched. The catch is that the universe is not polite. Every stray photon, every vibration, every whisper of heat is a kind of touch, and a touch acts like a measurement whether anyone intended one or not. Physicists call the resulting collapse decoherence, meaning the process by which a qubit loses its quantum character and becomes an ordinary, definite bit through unwanted contact with its surroundings.

    This is why the machines look the way they do. The superconducting processors at IBM and Google live at the bottom of dilution refrigerators colder than deep space. Trapped-ion machines hold single charged atoms in electromagnetic fields inside a hard vacuum. Every layer of that engineering exists to keep the universe from touching the bubble. And even so, the bubble pops. A superconducting qubit holds its quantum state for something on the order of a ten-thousandth of a second. The machine has to finish its work, or protect its work, inside the lifetime of a soap bubble.

    Your classical instinct sees the fix immediately. Computers have always been built from unreliable parts. Hard drives fail, bits flip, network packets vanish, and we paper over all of it with redundancy and checksums. Store the data three times, compare copies, majority vote wins. Surely the same medicine works here.

    The instinct is right about the disease and wrong about the medicine, in a way that took physicists years to untangle. Because quantum information has two properties that break every classical redundancy trick at once. You cannot copy a qubit. The laws of quantum mechanics flatly forbid duplicating an unknown quantum state, so “store it three times” is not merely hard, it is illegal. And you cannot check on a qubit, because looking at it is a measurement, and measurement destroys the very superposition you were trying to protect. The two most basic moves in classical error correction, copy and compare, are both against the rules.

    Spelling Bravo without saying B

    Here is the shape of the solution, and it is one of the cleverest ideas of the last thirty years.

    Think about a radio operator on a bad connection spelling a word. She does not say the letter B and hope. She says Bravo. The word is longer than the letter, and that is the point. Static can chew off the front or the back of Bravo and the listener still recovers the B, because the letter is no longer stored in any single sound. It is spread across the whole word. The information survives damage to its parts because it does not live in any one part.

    Quantum error correction does this with quantum states. It spreads the information of one ideal qubit across many physical qubits, entangled together, so that the quantum state does not live in any individual qubit. The environment can touch individual qubits, pop individual bubbles, and the spread-out information survives. And the checking problem has an answer just as clever as the storage problem: instead of reading the data, which would destroy it, the machine continuously asks the group of qubits indirect questions, along the lines of “do these two neighbors still agree with each other,” questions whose answers reveal where an error happened without revealing, or disturbing, the protected information itself.

    The result has a name you need for every conversation about this technology from now on. A physical qubit is one actual, fragile device, one soap bubble. A logical qubit is one reliable, error-corrected unit of quantum information, woven out of many physical qubits and kept alive by constant correction. Shor’s algorithm, the real thing, runs on logical qubits. Every physical qubit count you have ever seen in a headline has to be run through an exchange rate before it means anything.

    For years there was a genuinely open question underneath all of this: does the weaving actually help? Error correction itself is built from the same faulty parts it is trying to fix, and if the correction machinery adds more noise than it removes, the whole scheme makes things worse. The theory said that below a certain hardware error rate, adding more physical qubits per logical qubit makes the logical qubit better, exponentially better, rather than worse. That threshold claim was the load-bearing wall of the entire field. As of this year, multiple independent research teams have demonstrated it on real hardware. Adding qubits now provably makes things more reliable, not less. Whatever else is uncertain in this story, the fundamental physics question has been answered, and it was answered yes.

    The exchange rate, and where the machines actually are

    So the honest scoreboard, as of the summer of 2026, reads like this.

    The largest quantum processors in the world hold physical qubits in the hundreds to low thousands. IBM has demonstrated a chip with a little over 1,100 physical qubits, and neutral-atom labs have trapped arrays of several thousand atoms, with the largest array to date holding about 6,100, although that one has not yet been used for computation.

    Logical qubits, the ones that matter, are far scarcer. The best demonstrations at the time of writing are 96 logical qubits woven from 448 physical ones, published this January, and 94 logical qubits announced in March at a remarkable roughly two-for-one exchange rate, that second machine reflecting how much the underlying hardware quality matters. Another lab needed roughly 1,200 physical qubits to produce 24 logical ones. The exchange rate is not one number. It depends entirely on how error-prone your bubbles are to begin with, and it currently ranges from two physical qubits per logical qubit to fifty or worse.

    Now the other side of the ledger. What does it take to break RSA-2048 with Shor’s algorithm?

    This is the number I most want you to watch, because it is the number that keeps falling. In 2012, published estimates put the cost at roughly a billion physical qubits. In 2019, a careful analysis by Craig Gidney and Martin Ekerå brought it down to about 20 million physical qubits running for eight hours. In May 2025, Gidney published a revision: under one million physical qubits, running for under a week, using the same hardware assumptions as before. The improvement came from better algorithms and better error-correcting codes, not better hardware. And in the first half of 2026, new architecture proposals have pushed claimed requirements lower still, first to around 100,000 physical qubits, and then, in one design from a new neutral-atom company, to roughly 10,000. Both of those 2026 figures are designs on paper for machines nobody has built, and neither has been demonstrated.

    Hold those two ledgers side by side and you can see the actual race. It is not machines racing toward a fixed finish line. The machines are climbing from thousands of qubits upward while the finish line falls from a billion downward, and both trends have been moving in the same direction for a decade without a single published reversal. Every revision of the requirement has made it smaller. Every generation of hardware has made the machines bigger and cleaner. The gap is closing from both ends.

    The Q-Day reality check

    Which brings us to the question, and I am going to give you the honest answer rather than the satisfying one.

    The moment a quantum computer first breaks real-world encryption has a nickname, Q-Day, and nobody knows when it is. Not the vendors, not the intelligence agencies, not the researchers publishing the estimates. Your classical instinct wants a date, and the honest answer is not a date. It is a probability distribution.

    The most serious attempt to pin that distribution down is an annual survey of quantum computing experts run by the Global Risk Institute. The seventh edition, published in March 2026, asked 26 researchers across academia and industry. Their pooled judgment puts the probability of a cryptographically relevant quantum computer within the next ten years somewhere between roughly 30 and 50 percent, and within fifteen years at better than even odds. Read those numbers again slowly, because both halves matter. This is not “imminent,” and anyone selling you imminent is selling. It is also nowhere near “never,” and it is far too likely to ignore, because we do not build critical infrastructure to survive coin flips.

    And here is the turn that the whole final post of this series hangs on. For a large class of encrypted data, Q-Day is not the deadline. The deadline is earlier, and for some data it has already passed. The reasoning fits in one sentence, and it is the most important sentence in this post: encrypted traffic can be recorded today, stored cheaply for years, and decrypted the day the machine exists. If the data you are protecting still needs to be secret in the 2030s, then a machine that arrives in the 2030s reads it, no matter that the machine did not exist on the day the data was sent. The industry calls this harvest now, decrypt later (HNDL), and it converts a future probability into a present-tense problem. A useful rule of thumb, from the same researcher who runs that expert survey: add the number of years your data must stay secret to the number of years your migration will take, and if the sum reaches past the arrival of the machine, you are already exposed.

    That is why the deadlines that matter are not written by physicists. As of this writing, Google, Microsoft and Cloudflare have set an internal target of 2029 to complete their own migration to quantum-safe cryptography. The United States federal government has signed deadlines into policy measured in single-digit years. The people with the most visibility into the hardware are not behaving like people with decades of slack.

    The bombe has one more thing to teach us here, and it is a lesson about timing rather than mathematics. The machine at Bletchley Park was not built after someone proved it would work on a comfortable schedule. It was built under uncertainty, against a threat that could not wait for certainty, and history is not kind to the institutions that waited. Eighty years later, the migration to quantum-safe cryptography is being run on exactly that logic, and it is already underway, with standards published, government deadlines signed, and the largest technology companies rebuilding the plumbing of the internet in plain sight.

    What that migration looks like, what those deadlines actually say, and what all of it means for the systems I work with every day, is the final post.

    Fediverse Reactions
  • The Machine That Listens

    The Machine That Listens

    It started with a tuning fork.

    Strike a tuning fork and set it on a table next to a second, identical fork, and something quietly remarkable happens. The second fork begins to hum. Nobody touched it. The sound waves from the first fork crossed the air, and the second fork answered, because those waves arrived at precisely the rhythm it was built to move at. Now change the experiment. Surround that fork with a marching band playing at full volume. Trumpets, drums, cymbals, chaos. The fork ignores nearly all of it. Out of that entire wall of sound, it responds to one frequency, its own, and lets the rest wash past.

    The fork is not searching the noise. The fork is not listening to the trumpets one at a time and deciding each one is wrong. The fork answers its own frequency because of what it is, all at once, passively, for free.

    Hold that image. Because in the last post, I left you standing at the edge of a promise. We established that factoring, the wall protecting RSA, secretly contains a repeating sequence, and that finding the rhythm of that sequence cracks the wall. We established that a quantum computer can load the entire sequence into superposition at once. And I promised there was a move, the opera singer’s move, that makes the loaded sequence ring at its own natural frequency.

    This is that post. This is the payoff of the whole series. And the move has a name that sounds far more intimidating than it deserves.

    The prism

    There is a mathematical operation called the Fourier transform, which takes any signal and reveals the frequencies hidden inside it. The name honors Joseph Fourier, a French mathematician who worked out the underlying idea in the early 1800s while studying how heat flows through metal. The concept is easier than the name.

    Think of a prism. White light enters one side looking like a single, featureless thing. The prism bends each color by a different amount, and out the other side comes a rainbow. The prism did not add anything to the light. The colors were in there the whole time, mixed together so thoroughly that no eye could separate them. The prism’s only job is separation. It answers the question: what is this light actually made of?

    A Fourier transform is a prism for any signal. Feed it a sound recording and it tells you which pitches are present and how strongly. Feed it a repeating sequence and it tells you the rhythm of the repetition. The pattern goes in mixed and hidden. The frequencies come out separated and legible.

    You have been surrounded by this operation your entire life. When you pick out one voice in a crowded restaurant, the machinery of your inner ear is performing a physical Fourier transform, separating the roar of the room into frequencies so your brain can grab the ones that matter. The equalizer display bouncing on a stereo is a Fourier transform drawn as bars. MP3 files, JPEG images, and noise-canceling headphones all work by transforming a signal into its frequencies, doing something clever there, and transforming back. This is not exotic mathematics. This is Tuesday.

    So your classical instinct now sees the finish line, and it is about to lunge for it. We have a sequence with a hidden rhythm. We have an operation that reveals rhythms. Run the sequence through the prism, read off the period, factor the number, collect the Turing Award.

    Your classical instinct will keep fighting, and here is where it loses.

    Why the classical prism fails

    To Fourier-transform a signal classically, you need the signal. All of it, or at least a healthy stretch of it, written down where the algorithm can read it. For a sound recording, fine. For our sequence, that requirement is fatal, because writing down the sequence means computing it, step by step, and the sequence for a real RSA number is astronomically long. That is the same wall we have been staring at for three posts. The classical prism works perfectly and does not help at all, because the price of admission is the very thing we cannot afford.

    What we need is a prism that works on a signal nobody ever wrote down. A prism that accepts, as input, a superposition.

    That is the quantum Fourier transform, the QFT, and it is the heart of Shor’s algorithm. It is the same prism idea, rebuilt out of quantum operations, so that it acts on all the branches of a superposition at once. And to see why that changes everything, we have to go back to the room of shouters.

    The room of shouters, one more time

    In the second post of this series, I described interference with a crowded room. Interference means waves combining, so that waves arriving in step reinforce each other and waves arriving out of step cancel each other out. A quantum computer’s entire advantage lives in that one sentence. Every possibility in a superposition is a wave. Arrange the machine so that wrong answers arrive out of step and shout each other into silence, while the right answer arrives in step and grows louder with every contribution.

    The QFT is that arrangement, purpose-built for rhythms.

    Here is the honest, plain-language version of what happens inside Shor’s algorithm. The machine loads a superposition representing every step of the repeating sequence at once. Qubit is short for quantum bit, and the “not knowing versus not being” distinction matters here as much as it ever has: the machine has not secretly computed one step that we simply have not read yet. Every step is genuinely present, the way the surface of a pond is present everywhere on the pond, and the sequence’s rhythm is spread invisibly across all of it, mixed together like colors in white light.

    Then the QFT runs, and every possible answer to the question “what is the period?” becomes a chorus of waves. Consider some wrong guess at the period. Contributions to that guess come from all across the sequence, and because the guess does not match the sequence’s true rhythm, those contributions arrive scattered, out of step, pointing every which way. They cancel. Not approximately. Not mostly. The mathematics of interference grinds wrong guesses toward zero, thousands of contributions annihilating each other in pairs, an entire room of shouters going silent because every voice found its opposite.

    Now consider the true period. Contributions to the true period come from across the sequence too, but these arrive in step, because the guess and the rhythm agree. Every wave lands on the pile. The signal grows. Like sound waves reaching a tuning fork built for exactly that frequency, the sequence answers its own rhythm and ignores the noise, not because anything searched, but because of what interference is.

    Then you measure. Measurement collapses the superposition to a single outcome, and the QFT has spent all its effort rigging that collapse. The overwhelming share of the probability now sits on outcomes that encode the period. You read out one number, run a short classical calculation on it, of roughly the same difficulty as the greatest-common-divisor step from the last post, and the period falls out. In practice the machine sometimes lands on an unlucky outcome that encodes the period ambiguously, so you run the whole procedure a handful of times and cross-check. A handful. Not an astronomical number. A handful.

    The period gives the factors. The factors break RSA. The wall never stood a chance, because nobody ever climbed it. Someone listened to it instead.

    The glass breaks

    Now the opera singer can finish her note.

    She never searched the piano for the right pitch. The glass told her, by being a glass, which frequency it would answer. She supplied that frequency, the waves arrived in step, each push reinforcing the last, and the energy piled up until the glass failed. In the last post I said the glass is not being searched, it is being asked, all at once, what its natural rhythm is, and that it cannot help but answer.

    Shor’s algorithm is that question, asked of a number.

    And I want to close the loop that this whole series opened with, because it is the same loop. The bombe did not read every rotor setting. Turing found structure, a scrap of known plaintext and a machine forbidden from encrypting a letter as itself, and used that structure to make vast fields of wrong answers eliminate themselves without ever being visited. Shor found structure too, a rhythm hidden inside factoring, and used interference to make vast fields of wrong answers literally cancel themselves out of existence. Eighty years apart, different physics, same idea. You do not defeat an astronomical number by counting through it. You defeat it by exploiting structure.

    That is the whole story of this series in one sentence, and as of this post, you have now seen the entire mechanism. There is no further trick hiding behind the curtain. Superposition loads the problem. Structure gives the waves something to agree about. Interference silences the wrong answers. Measurement reads the survivor. That is how a quantum computer breaks RSA.

    What we have and have not established

    So why is your bank still standing?

    Everything in this post is proven mathematics and has been since 1994. Shor’s algorithm works, on paper, with no known error and no fine print in the math itself. What I have not shown you is a machine that can run it against a real key. The algorithm asks its hardware for something brutally hard: thousands of qubits holding a delicate superposition in perfect step through billions of operations, when in reality a qubit can lose its quantum character thousands of times faster than the blink of an eye. The gap between the algorithm on paper and the machine in the lab is the entire remaining question, and it is where every headline, every breathless prediction, and every serious government deadline actually lives.

    That gap has a shape, and numbers, and an honest answer to the question everyone asks, which is: how long do we actually have?

    That is the next post.

    Fediverse Reactions
  • The Question Behind the Question

    The Question Behind the Question

    It started with a clock.

    Not a special clock. The one on your wall. Twelve numbers, and a rule so familiar you have never thought of it as a rule: when the hour hand passes 12, it wraps back to 1. Nine o’clock plus five hours is not fourteen o’clock. It is two o’clock. The clock does not care how many total hours have passed. It only cares about the remainder.

    Mathematicians call this modular arithmetic, which means arithmetic that wraps around a fixed number the way a clock wraps around 12. It is the kind of thing that looks like a curiosity, a party trick for number theorists. It is also the crack in the foundation of RSA. Because in 1994, a mathematician named Peter Shor noticed that the problem protecting most of the world’s encrypted traffic, the problem I wrote about last week, is secretly a question about clocks. And questions about clocks have a property that questions about factoring do not.

    They have a rhythm. And rhythms can be heard.

    Where we left off

    I am the person who needed to understand what the cryptographer’s work means for the world I live in, so let me restate the situation in plain terms. In the last post, I walked through why RSA and elliptic curve cryptography are safe from classical computers. The security of RSA rests on a single fact: multiplying two large prime numbers together is easy, but starting from the product and recovering the two primes is brutally hard. Every classical factoring method we know, even the clever ones, chokes when the numbers get big enough. That is why your bank can publish its public key on the open internet and sleep fine.

    And in the post before that, I made the case that a quantum computer is not a faster version of your laptop. It does not try answers more quickly. It plays a different game entirely, one where wrong answers can be made to cancel each other out and right answers can be made to reinforce.

    Here is the problem those two posts leave us with. Cancellation is a wonderful trick, but it only works if the problem has some structure for the cancellation to grab onto. You cannot point a quantum computer at a pile of random possibilities and ask the wrong ones to politely eliminate themselves. There has to be a pattern.

    Factoring, on its face, has no pattern. A 2048-bit RSA number is just a wall. There is no rhythm in a wall.

    Shor’s insight, the reason his name is on the algorithm, was not a quantum insight at all. It was a classical, mathematical insight. He found the pattern. He showed that hiding inside every factoring problem is a completely different problem, and that different problem repeats like a heartbeat.

    The trick: stop asking about factors

    Take the number you want to factor and call it N. Now pick some smaller number, more or less at random. Call it a. Then start computing the powers of a, but on a clock with N positions instead of 12. In other words, compute a, then a squared, then a cubed, and so on, but every time you pass N, wrap around and keep only the remainder.

    Let me make that concrete with a number small enough to do by hand. Say N is 15 and we pick a = 2. Here are the powers of 2 on a 15-hour clock:

    • 2 to the 1st power is 2
    • 2 squared is 4
    • 2 cubed is 8
    • 2 to the 4th is 16, which wraps around to 1
    • 2 to the 5th is 32, which wraps around to 2
    • 2 to the 6th wraps around to 4
    • 2 to the 7th wraps around to 8
    • 2 to the 8th wraps around to 1

    Look at the outputs: 2, 4, 8, 1, 2, 4, 8, 1. The sequence repeats. It cycles through exactly four values and then starts over, forever.

    That cycle length has a name. It is called the period, meaning the number of steps a repeating sequence takes before it starts over. Here the period is 4. And this is not a quirk of the numbers I picked. It is guaranteed. For any N and almost any a, the powers of a on an N-hour clock will eventually loop back to 1 and repeat. The sequence always has a rhythm. The only question is how long the rhythm is.

    Finding that number is called period-finding, and it is the question behind the question. Because here is the part that still strikes me as slightly unfair to classical computers.

    If you know the period, the factors fall out

    Watch what happens with our example. The period was 4. Take a raised to half the period. That is 2 squared, which is 4. Now compute two numbers: one less than that, and one more than that. You get 3 and 5.

    Those are the factors of 15.

    That is not a coincidence, and the reason is one step of algebra I will describe in words rather than symbols. Saying the sequence returns to 1 after r steps is the same as saying that a to the r, minus 1, is divisible by N. And a classic identity from school algebra says that “something squared minus one” splits into “something minus one” times “something plus one.” So N divides evenly into the product of those two smaller pieces. Since N cannot usually fit entirely inside either piece alone, its prime factors have to split up, some landing in one piece and some in the other. Run a greatest-common-divisor calculation between N and each piece, which is an operation so cheap that computers have done it instantly since the 1970s, and the factors surface.

    There are caveats, and I want to be honest about them because the details matter. The period needs to be even for the “half the period” step to make sense, and occasionally the algebra collapses in a way that tells you nothing. When that happens, you throw away your choice of a, pick a new one, and try again. The math says a random a works often enough that a handful of tries is essentially always sufficient. This is not a lottery. It is a procedure with a retry button.

    So here is the new shape of the world after Shor’s classical insight, before any quantum hardware enters the picture. Nobody needs to factor N directly. They need to find the period of one repeating sequence. Factoring has been converted, exactly and provably, into period-finding.

    Your classical instinct is now asking the obvious question: so what? And your classical instinct is right to ask.

    Why this does not help a classical computer at all

    Because for a real RSA number, the sequence is obscene. The period of that repeating pattern is not 4. It can be a number comparable in size to N itself, which for RSA-2048 means a number with hundreds of digits. A classical computer finds a period the only way it can: compute the sequence, step by step, and watch for the repeat. Walking a sequence whose period has 600 digits is the same astronomical wall we started with. We have not shrunk the problem. We have only changed its shape.

    But the shape is everything.

    Think back to the bombe. Turing did not defeat Enigma by trying every rotor setting and reading the output, because there was no time in the war, or in several universes’ worth of wars, to do that. He defeated it by finding structure: a known scrap of plaintext, and the machine’s own strange rule that no letter could encrypt to itself. The structure let whole continents of wrong answers be discarded without ever being visited. You do not defeat an astronomical number by counting through it. You defeat it by exploiting structure.

    A wall has no structure to exploit. A rhythm does.

    A period is not a property of any single step in the sequence. You cannot look at one value, or a thousand values, and read the period off of them. The period is a global property, a fact about the whole sequence at once. And a global property of a vast space is exactly the kind of thing a classical computer is worst at, because a classical computer can only ever stand in one place in that space at a time.

    It is also exactly the kind of thing a quantum computer was born for.

    The opera singer

    Here is the analogy I want you to carry into the next post, because the next post is the payoff of this entire series.

    An opera singer can shatter a wine glass with her voice. She does not do it with volume, and she certainly does not do it by singing every note on the piano one at a time, tapping the glass after each note to check for cracks. She does it by finding the one frequency the glass already wants to vibrate at. When she sings that note, the glass itself responds. Every wave of sound arrives in step with the glass’s own motion, each push reinforcing the last, until the energy piles up and the glass fails. Sing any other note and the pushes arrive out of step, canceling their own effort. The glass does not budge.

    The glass is not being searched. The glass is being asked, all at once, what its natural rhythm is. And the glass cannot help but answer.

    Now recall the machinery from two posts ago. A quantum computer can hold a superposition, which means it can load the entire repeating sequence, every step of it, into its qubits at once. Qubit is short for quantum bit, and the “not knowing versus not being” distinction from that post applies here with full force: the machine has not secretly picked one step of the sequence that we simply have not looked at yet. The whole sequence is genuinely present, the way the water of a pond is present across the entire pond and not hiding at one point on it.

    What Shor needed was the opera singer’s move. A way to make that loaded sequence ring at its own natural frequency. A way to make every wrong guess about the period cancel itself out, pushes arriving out of step, while the one right answer reinforces, wave after wave after wave, until it is the only thing left standing when you measure.

    That move exists. It is called the Quantum Fourier Transform (QFT), and it is the single most important idea in this entire story. It is also, I promise, less frightening than its name. You have been using a Fourier transform your whole life. Your ears do it every time you pick a single voice out of a crowded room.

    That is the next post.

    Where this leaves us

    Let me pin down what we have and have not established, because I do not want the excitement of the trick to outrun the truth of it.

    We have established that factoring, the wall that protects RSA, is mathematically equivalent to period-finding, and that the conversion between them is cheap and classical. No quantum hardware was involved in anything I described today. Shor’s bridge is pure mathematics, and it was in some sense sitting there waiting to be noticed, the way the flaw in Enigma’s design was sitting there waiting for Turing.

    We have not yet established that a quantum computer can actually find the period. That claim carries the whole weight of the threat to RSA, and it deserves its own post rather than a hand wave at the end of this one.

    But notice what has already changed. Before Shor, breaking RSA meant scaling a featureless wall. After Shor, breaking RSA means hearing a rhythm. Those are different problems in kind, not in degree. And if the last seventy years of this story have taught us anything, from the bombe forward, it is that problems with structure do not stay hard forever. Someone eventually builds the machine that listens.

    Fediverse Reactions
  • Locked in Plain Sight

    Locked in Plain Sight

    The last time you bought something online, your computer did something that should be impossible.

    In the moment the little padlock appeared in your browser, your computer and a server it had never spoken to before agreed on a secret. A shared key that only the two of them knew. They did this out loud, over an open wire, in a coffee shop or an airport or your living room, with every byte of the exchange visible to anyone who cared to look. Your internet provider saw it. Anyone on the same wifi saw it. If someone had been quietly recording the whole conversation, they captured every step of it, start to finish.

    And at the end of it, the two computers shared a secret that the recorder does not have and cannot work out. Not because the computers whispered. They shouted. The eavesdropper heard every word and still walked away with nothing.

    I have spent a good part of my career operating the systems that make that moment work. I am not the person who invented the mathematics behind it. I am the person who needed to understand what that mathematics protects, because I am responsible for machinery that depends on it. This post is about that mathematics. In the first post of this series, I told you the industry I work in is replacing it. Before I can show you why, I have to show you something that sounds like the opposite. I have to show you why it has never been broken, and why, against every classical computer on earth, it never will be.

    The padlock and the key

    Start with the trick that makes the coffee shop moment possible, because it is one of the genuinely great ideas of the twentieth century.

    For most of the history of secret-keeping, encryption had a chicken-and-egg problem. If you and I want to exchange coded messages, we first need to agree on the code. But to agree on the code secretly, we already need a secure channel, which is the thing we were trying to create. For centuries the only answer was to meet in advance, or to trust a courier with the code itself. Enigma had this problem too. The daily settings had to be printed in codebooks and physically distributed to every U-boat and field unit, and captured codebooks were among the most valuable prizes of the war.

    Public key cryptography dissolved the problem. The idea is to split the code into two halves that are mathematically linked but do different jobs.

    One half is called the public key, and you can think of it as an open padlock. I can hand open copies of my padlock to anyone. I can pile them on a table in the town square. Anyone who wants to send me something snaps my padlock shut on a box, and from that moment even the sender cannot reopen it.

    The other half is called the private key, and it is the one physical key that opens that padlock. It never leaves my possession. It is never transmitted, never shared, never in the coffee shop at all.

    Lock with the public half, unlock with the private half. Anyone can lock. Only one party can unlock. That asymmetry is the entire trick, and it is why this family of systems is also called asymmetric cryptography. It is what your browser and that unfamiliar server were doing while the padlock icon appeared. The exact recipe varies from protocol to protocol, and in the first post I named the family members you have most likely seen on the ingredients list, RSA, ECC, and Diffie-Hellman. They differ in the details, and the differences will matter later in this series. But every one of them rests on the same kind of mathematical object, and for the rest of this post I am going to hold up the oldest and easiest one to see into. RSA.

    Easy one way, impossible the other

    Here is RSA’s foundation, and I promise this is the only arithmetic in this post.

    Pick two prime numbers. Multiply them. That is the whole move.

    Take 61 and 53. Multiply them and you get 3,233, and you got it in a second or two, or instantly if you reached for a calculator. Now run it backward. I hand you 3,233 and tell you it is the product of exactly two primes. Find them. There is no formula. You check. Does 3 divide it, does 7, does 11, does 13. That backward search has a name. Finding the numbers that multiply together to produce 3,233 is called factoring, and 61 and 53 are its factors. Forward is one multiplication. Backward is factoring, and factoring is a search.

    An RSA public key is built around a number like 3,233, except unimaginably larger. The key size is the length of that number measured in bits, the same units your hard drive is measured in. The standard today is RSA-2048, which means the public number is 2,048 bits long. Written out in ordinary digits, it is 617 digits long. The two secret primes behind it are around 300 digits each.

    The forward direction does not care about the size. Your phone multiplies two 300-digit primes in less time than it takes the screen to refresh. The backward direction is where the universe runs out of patience.

    The best public factoring record stands at 829 bits. In February 2020, a research team factored a 250-digit number using roughly 2,700 years of processor-core time, spread across a large cluster of machines running for months. That is the record. Not 2,048 bits. 829.

    And here is the part that matters. The difficulty of factoring does not climb gently as the numbers grow. Every bit you add multiplies the work. The 829-bit record is not a step on the road to 2,048 bits. Scale the mathematics behind the 2020 record up to a 2,048-bit key and the workload grows by a factor in the hundreds of billions. The 2,700 core-years becomes hundreds of trillions of core-years. Turn a hundred thousand processor cores loose on it, a respectable supercomputer’s worth, and the job runs for billions of years. The universe has only existed for 13.8 billion.

    You may have heard this put more dramatically, that breaking RSA would take “longer than the heat death of the universe.” The heat death of the universe is cosmology’s forecast for the very end, the point almost unimaginably far in the future when the last stars have burned out and no usable energy remains anywhere, on a timescale so vast that the current age of our universe rounds to zero against it. And the dramatic phrase is true, but only of the naive attack. Checking possible divisors one at a time really would outlast the heat death of the universe, comfortably. The clever structural methods that set the 2020 record are what collapse the job from beyond-the-end-of-everything down to merely billions of years. Hold that collapse in your mind. It is what exploiting structure buys you, it is the spine of this series operating in plain daylight, and it is still nowhere near enough. For every practical purpose, billions of years is forever.

    This is the design. The security of RSA is the size of the gap between multiplying and factoring. You publish the product to the whole world, padlocks piled in the town square, and you sleep well, because recovering the primes from the product is beyond every computer that exists.

    RSA is nearly fifty years old. It was published in 1977, and it has been protecting the internet for roughly thirty of those years, since the mid-1990s, when the first secure web connections made online commerce possible. In all that time, against every classical computer and every classical algorithm ever pointed at it, properly sized RSA has never been broken.

    The question underneath the question

    If you have been reading this series from the beginning, something should be nagging at you right now, and I want to drag it into the open.

    In the first post, we watched the Germans make exactly this argument. Enigma had 159 quintillion possible settings. Counting through them was impossible, therefore Enigma was unbreakable. And the argument was wrong, because counting was never the only option. You do not defeat an astronomical number by counting through it. You defeat it by exploiting structure. Turing did not out-count Enigma. He found a structural flaw, the rule that no letter could encrypt to itself, and compiled it into a machine.

    So the honest question about RSA is not “how long would it take to check all the possibilities?” We already know that question can lie to you. The honest question is the one Turing would ask. Does factoring have structure a machine can exploit?

    Mathematicians have been probing that question for a very long time, longer than RSA has existed, because factoring fascinated number theorists for centuries before it guarded anything. And the answer, classically, is that factoring has some structure, and it is not enough. The best classical factoring methods are enormously cleverer than trial division. That 2020 record was not set by checking divisors one at a time; it was set by an algorithm that exploits real mathematical structure in the problem, and it is the reason the record is 829 bits instead of far less. But even the cleverest known classical method still faces work that grows explosively as the keys get longer. The structure that has been found chips at the edges of the mountain. It does not tunnel through it.

    Nobody has proven that a devastating classical shortcut is impossible. That proof does not exist, and its absence is one of the famous open problems in mathematics. RSA’s security rests on something less formal and, after five decades, quite convincing. The smartest people on earth have been searching for the tunnel, with career-defining glory waiting for whoever finds it, and nobody has.

    Hold that phrasing, because I chose it carefully. Classically, no one has found structure in factoring that turns the mountain into a doorway. That sentence has a second half, and it is coming in the next post.

    The smaller, faster padlock

    Before we get there, I owe you the other name from the ingredients list, because it is quietly running most of your day.

    ECC, short for elliptic curve cryptography, is the same padlock idea built on a different mathematical foundation. Instead of hiding a secret in the difficulty of factoring, ECC hides it in a different one-way problem, a cousin of factoring involving mathematical objects called elliptic curves. You do not need the details, and I am not going to pretend to walk you through them. The shape is what matters. Easy in one direction, effectively impossible in reverse, against every classical computer on earth.

    ECC is the younger sibling. It was proposed in 1985, eight years after RSA, by two mathematicians working independently, and it spent roughly two decades as a specialist’s tool before the mobile era pulled it into the mainstream. Call it forty years old, with about fifteen of them spent carrying serious internet traffic.

    What ECC buys you is efficiency. The one-way problem behind it is, as far as anyone knows, even more stubborn per bit than factoring is. A 256-bit ECC key delivers roughly the same classical security as a 3,072-bit RSA key. Same strength, a fraction of the size. Smaller keys mean faster handshakes, less data on the wire, less battery burned doing the math. That is why ECC took over the mobile internet. When your phone set up the connection you are quite possibly reading this over, odds are the padlock moment ran on elliptic curves.

    File one fact away before we move on. ECC’s entire advantage is that its keys are small. Small keys, same security. Later in this series, that advantage is going to come back and matter again, in a way you will not expect.

    The lever everyone reaches for

    There is one more classical fact you need, and it is the one this whole post has been building toward.

    When people who run cryptographic systems get nervous, there has always been one reliable lever to pull. Make the keys bigger. And classically, that lever is magnificent. Because the attacker’s work grows explosively with key size while the defender’s work grows only modestly, every step up in key size costs you a little and costs the attacker a world. Moving from RSA-2048 to RSA-3072 slows your handshakes slightly. It multiplies the factoring effort by a factor large enough that nobody bothers writing it out. This is why the industry has stayed comfortably ahead for thirty years. When machines got faster, keys got longer, and the mountain grew faster than anyone could climb.

    The instinct runs deep, and you can watch it operating right now. As quantum computing headlines pile up, plenty of organizations are quietly reasoning as follows. If a new machine threatens RSA-2048, we will move to RSA-4096, or RSA-8192, eat the performance cost, and buy ourselves a decade or two, the way bigger keys have always bought time. It is a perfectly sensible plan, built on the entire history of the field.

    It is built on one more assumption, too. It assumes the attacker’s difficulty grows explosively with key size. That has been true of every attacker so far, because every attacker so far has been classical, and classically, no tunnel through the mountain has ever been found.

    You already know where this is going, because you read the first two posts.

    The machine we met in the last post does not count, and it does not climb. It arranges. And in the next post, I am going to show you the thing Shor discovered in 1994. Factoring, the problem I have just spent an entire post telling you has resisted structural attack for centuries, has a hidden structure after all. Classical machines cannot exploit it. It is invisible to them in a way that will become precise later. But it is exactly the kind of structure the new machine was born to exploit.

    And that is why the lever fails. I will show you the details when we have the machinery to see them, but I will state the headline now, and your classical instinct is going to refuse to believe it, which by this point in the series you should recognize as a familiar feeling. Against the new machine, making the keys bigger barely helps. Doubling the key size does not multiply the machine’s difficulty astronomically. It roughly doubles it. RSA-4096 is not a fortress against this machine. It is the same door with a second lock of the same make.

    The unbreakable lock of our era is sitting in plain sight, in the town square, in your browser, in the recording that eavesdropper made of your coffee shop purchase. For thirty years, plain sight has been perfectly safe, and everything in this post is the reason why. The next post is about the flaw Turing would have gone looking for. The rhythm hidden inside the numbers, and the trick that turns finding a factor into hearing a note.

    Fediverse Reactions
  • The Same Trick, Different Physics

    The Same Trick, Different Physics

    In the last post, we walked through how Alan Turing’s bombe broke a German cipher that 159 quintillion possible settings had supposedly made unbreakable. The breaking did not come from raw speed. It came from finding a structural rule in how Enigma was wired, a single tiny quirk that no letter could ever encrypt to itself, and compiling that rule into electrical hardware. The bombe did not check possibilities. It arranged copper wires so that the right rotor setting was the only configuration whose internal logic did not destroy itself. The wrong settings collapsed under their own contradictions. The right one survived. A relay clicked. The Germans gave up 159 quintillion settings. Turing gave back the daily key within the hour.

    That principle is the spine of this whole series. You do not defeat an astronomical number by counting through it. You defeat it by exploiting structure.

    This post is about the modern version of that move. A quantum computer is, at its core, a machine built to exploit a different kind of structure than the bombe did, on a substrate so different from copper wires that almost everything your intuition tells you about computers will have to be set aside. By the end of this post, you will have a working model of what a quantum computer actually is, what it does, and why “it tries every possibility at once” is the wrong way to think about it. That model is what the rest of the series is going to build on.

    Let me start with the central claim, and then we will unpack it.

    The same trick, different physics

    When a quantum computer runs the algorithm that breaks RSA, it does not try every possible answer one by one. It arranges a physical system so that every candidate answer is present at the same time, in a combined state, and then it manipulates that combined state so the right answer reinforces itself and the wrong answers cancel each other out.

    If that sentence did not quite click, if “the wrong answers cancel each other out” sounded more like a slogan than an explanation, good. You are paying attention. That sentence is the entire mystery of this series compressed into one line, and I am not going to pretend a single analogy can unpack it here. It is going to take the next few posts to earn it. For now, just hold the shape of the claim. The machine does not check the answers. It arranges them so that the right one survives. We will spend the rest of the series making that real.

    Here is what I want you to notice. The shape of that claim is exactly the same as what the bombe did.

    The bombe arranged electrical circuits so that the right rotor setting was the only configuration where contradictions did not destroy themselves. A quantum computer arranges a quantum system so that the right answer is the only one whose components do not destroy themselves. The substrate is utterly different. Copper wires and electrical current have been replaced by something much stranger. But the principle is the same. Create physical conditions where the right answer is the only one that survives.

    Let me try to give you a handle on this before we go any further.

    Imagine a room full of people all shouting random numbers at the same volume. You cannot hear any individual number, because the room is just noise. Now imagine you could rearrange the room so that everyone shouting the correct number found themselves shouting in unison, while everyone shouting any wrong number found themselves paired with someone shouting the exact opposite, cancelling each other to silence. At the end, only one number is audible. You did not check any of the shouters. You did not interview them one at a time. You arranged the room so that the right number was the only one left.

    That is what a quantum computer does. The room is a quantum system. The shouting is the system’s physical evolution. The arrangement is the algorithm: the careful sequence of operations that sets up the cancellation pattern. The number left audible at the end is the answer.

    I want to flag something now, because it is going to happen to you repeatedly as you read the rest of this series.

    Your mind is going to keep wanting to ask “but how many possibilities does it check? How many times does it try?” That question is going to feel obvious. It is going to feel like the right question. It is also going to be the wrong question, every single time. It belongs to the old machine, the classical machine, the bombe and your laptop. The whole point of the new machine is that it does not check and does not try. It arranges.

    Every time you catch yourself reaching for “how many,” stop and ask “what is the arrangement?” That instinct will fight you. Especially when it fights you, hold the new model. You are not failing to understand. You are watching your old mental model lose ground to a new one, and that takes time.

    The next three sections explain the three concepts you need in order to understand how the arrangement actually gets made. They are called superposition, entanglement, and measurement. Each one is a piece of the answer to the question “how do you build a room where the right number is the only one left.”

    Superposition

    A qubit’s state is not a value. It is a combination.

    A classical bit, the thing your laptop uses, has a value. It is a 0 or it is a 1. At any given instant, it is definitely one or the other. You could open up your laptop, freeze time, and find out which. There is always a fact of the matter.

    A qubit, short for quantum bit, is not like this. A qubit’s state is a specific weighted blend of 0-ness and 1-ness, both genuinely present at the same time. The weights are numbers that determine how the qubit behaves during the computation and what is likely to be observed when it is measured. There is no underlying fact of the matter about whether the qubit is “really” 0 or 1 before measurement. The combination is the state.

    This is the single most important conceptual shift in the entire series. If you get this one, everything else follows. If you do not get this one, nothing else will quite work. So let me try an analogy.

    Imagine dropping two stones into a still pond at the same time. Two sets of ripples spread out from where the stones landed, and where the ripples meet they combine. At any given point on the water’s surface, the height of the water is the sum of what the two waves are doing at that point. Where two crests meet, the water rises higher than either wave alone would have made it. Where a crest meets a trough, they cancel and the water lies flat. The combined ripple pattern is not two separate waves sitting next to each other. It is one pattern, a real and unified state of the pond’s surface, with properties that neither original wave had on its own.

    A qubit in superposition is like that combined wave pattern. It is not secretly a 0 or a 1. It is a real combination, a single unified state, with its own properties that no definite 0 or no definite 1 has on its own. The combination is the state, the same way the rippling water surface is the state of the pond. Asking “but which one is it really” is like asking which of the two original ripples the water surface really is. The question has no answer, because the premise is wrong. There is only the combined surface.

    There is one place this analogy is imperfect, and I want to flag it. The two stones in a pond are real, separate things. You watched them fall. The ripples have an origin. A qubit in superposition does not have two separable origins like that. The combination is more fundamental than the combining-of-two-things picture suggests. But the part that matters, that the combination is a real state with its own properties rather than a hidden version of one of its parts, is the part that transfers.

    This is also why you have probably heard a qubit described as “a coin that is both heads and tails until you measure it or look at it.” That analogy is wrong, and it is wrong in a specific way that matters.

    A spinning coin in the air has a definite state at every instant. It is heads or tails or somewhere in between, and it is something specific at every moment, even if you cannot see it because it is moving too fast. A coin under your hand, after it has landed, also has a definite state. It is heads or it is tails. You just do not know which yet. Both of these are examples of what physicists call classical uncertainty: there is a fact of the matter, and you have not seen it.

    A qubit in superposition is not classical uncertainty. There is no hidden fact of the matter. The combination is the state, and there is nothing underneath it. This is the difference between not knowing and not being. The coin is heads or tails and you do not know. The qubit is genuinely a combination, and there is no “really” underneath.

    This is also why the other thing you have probably heard, “a quantum computer tries every possibility at once,” is wrong. A qubit in superposition is not running parallel computations on parallel values in parallel universes. It is a single physical system in a combined state, evolving as one thing. There are no parallel copies. There is one system, in one state, and that state happens to be a combination.

    Hold onto the pond. We are going to drop more stones into it.

    Entanglement

    Two qubits can become correlated in a way that has no classical equivalent.

    This is the second concept, and it is the one that lets superposition do work. A single qubit in superposition is interesting on its own, but it does not yet break anything. What breaks RSA is what happens when many qubits are in superposition together, in a way where their states are linked.

    Let me start with what entanglement is not.

    Imagine you have a pair of gloves, one left and one right. You pack them into two identical boxes without looking, ship one box to Tokyo and one to São Paulo, and never look inside either box. A friend in Tokyo opens her box and finds a left glove. The instant she sees the left glove, she knows São Paulo has the right one. There was no signal sent. There was no communication. The information was determined the moment you packed the boxes. You just did not know which box had which glove until she looked.

    This is classical correlation, and it is exactly what entanglement is not. The gloves had definite identities the whole time. The boxes were left-or-right from the start. The only thing that changed when your friend opened the box was your knowledge.

    Now picture the pond again. Drop two stones in at once, but this time the stones are special. They are wired together in a way that the ripples they make are not just two separate ripple patterns combining on the surface. The two ripple patterns share a state. Whatever the surface of the water is doing in the region around the first stone is bound up with what the surface is doing in the region around the second stone, in a way that you cannot describe one without referencing the other. The two ripples are not independent waves that happen to overlap. They are a single combined pattern that belongs to the pond as a whole, and trying to talk about “just the first ripple” misses what is actually there.

    That is entanglement. Two qubits in an entangled state are not two separate qubits, each in its own superposition, that happen to be near each other. They are a single combined state that belongs to the pair, and you cannot describe one qubit without referencing the other. Measure one of them and you have not just discovered what it was, you have constrained what the other one will be, even if they are physically far apart.

    The reason this matters for breaking RSA is this. Superposition gets all the candidate answers into the same physical system at once. Entanglement is what lets those candidates interfere with each other. Without entanglement, you would have a bunch of qubits each independently in superposition, and there would be no way for the wrong answers to cancel each other out. With entanglement, the qubits share a joint state, and that joint state can be arranged so the components reinforce and cancel in exactly the way we need.

    Go back to the room of shouters from a few sections ago. The reason that room works is that the shouters are not independent. The cancellation pattern, where everyone shouting a wrong number is paired with someone shouting the exact opposite at the exact same volume, so the two voices meet in the air and become silence, requires the shouters to be coordinated. If they were each shouting independently, with no relationship to each other, you could not engineer cancellation. You would just have noise. Entanglement is what coordinates the shouters. It is what makes the cancellation possible.

    The discomfort you might be feeling right now, that the gloves-in-boxes case sounds almost like entanglement but does not quite reach it, is the right discomfort to feel. Classical correlation is information you do not yet have about a fact that already exists. Quantum entanglement is genuine correlation between qubits whose states are not yet determined. The difference between not knowing and not being, which we named in the last section about superposition, applies to entanglement too. The gloves are left-or-right and you do not know. Entangled qubits are genuinely a joint state, and there is no separable underlying truth about either of them until you measure.

    Measurement

    When you measure a quantum system, the superposition ends.

    The system, which had been in a combined state, commits to a definite outcome. One of the possibilities that was combined in the superposition becomes the observed result, and that is what you read out. The weights in the superposition determine the probabilities of each possible outcome, but the outcome itself is one definite thing, not a combination.

    This is the moment of knowing, and it is the quantum analog of the bombe’s relay clicking, motor stopping, and operator writing down the setting. The machine has not searched. It has arranged its physical state so that, when observed, the right answer is overwhelmingly likely to be what comes out.

    Imagine reaching into the room of shouters and asking, after the arrangement is complete, “what number is being shouted?” If the room has been arranged correctly, the right answer is the only one audible, and that is what you hear. If the room has not been arranged, if the shouts are still random and uncoordinated, you would just hear one number at random with no useful relationship to anything. The arrangement is what gives the measurement meaning. Without the arrangement, the measurement is noise.

    This is where you have to be careful, because measurement in a quantum system is probabilistic, but it is probabilistic in a specific way that is easy to misunderstand.

    A coin under your hand has a 50/50 chance of being heads or tails. The randomness there is your ignorance. The coin is one or the other, and your odds are 50/50 because you do not know which.

    A qubit in a 50/50 superposition gives you heads or tails with equal probability when you measure it, but the randomness is not your ignorance. The randomness is built into the physics. The qubit was not secretly heads-or-tails before you measured. The combined state genuinely was a combination, and the act of measurement is what forced the system to commit. The probability is not a measure of what you do not know. It is a measure of how the combined state was weighted.

    That distinction matters because the weights are what a quantum algorithm controls.

    When Shor’s algorithm runs, the quantum computer does not produce a uniform superposition where every possible answer has the same weight. It produces an arranged superposition where the right answer has overwhelming weight and the wrong answers cancel each other out. Measurement on that arranged state does not give you a random answer. It gives you the right answer, with high probability, in one shot. If the measurement comes out wrong (and sometimes it does, because the cancellation is rarely perfect), the algorithm just runs again. A handful of runs is enough to converge on the right answer.

    Hold that, because it is the part of the picture that closes the loop on something we said earlier.

    When your mind keeps asking “but how many times does it try?”, remember that the quantum computer is not trying anything in the classical sense. It is running the arrangement, measuring once, and getting an answer that is overwhelmingly likely to be correct. The handful of extra runs are not “trying again”; they are insurance against the small probability that the measurement, on any given run, happened to land on one of the components that did not quite cancel. The arrangement does the work. The measurement reads it out.

    Both machines have a moment of physical recognition. The bombe’s relay clicks. The quantum computer’s measurement registers an answer. Neither machine has searched for anything. Both have arranged physical conditions where the right answer is what survives, and the moment of recognition is when the physics presents the survivor for us to see.

    What to carry forward

    You are now equipped with the mental model the posts that follow are going to build on. A quick summary of what you should be holding in your head when you finish reading this one.

    A quantum computer is not a faster classical computer. It is a different kind of machine, operating on different physics, doing a different kind of thing. It does not check answers. It arranges physical conditions where the right answer is the only one that survives, and then it measures.

    A qubit is not a faster bit. It is a unified state that is a real combination of 0 and 1, not a hidden version of one of them. Asking which one it really is misses what the state actually is.

    Entanglement is not just correlation. Two entangled qubits share a joint state that cannot be described one at a time. This is what coordinates many qubits in superposition so the right answer can reinforce itself and the wrong answers can cancel each other out.

    Measurement is not searching. It is the moment the arrangement is read out. A well-designed quantum algorithm arranges the system so that, when measured, the right answer is overwhelmingly likely to appear in a single shot.

    And if you catch your mind doing this in the next few weeks, that is normal. You will read about quantum computing somewhere else, see the words “tries every possibility at once” or “exists in many states simultaneously,” and feel the classical model trying to reassert itself. That feeling is the old habit fighting the new model. It does not mean you do not understand. It means the model has not fully settled in yet. Hold the new model. The old habit fades.

    Today, the cryptography that protects your bank login, your encrypted messages, your software updates, and roughly every secure connection you make in a day has its own hidden structural weakness. It is not a flaw in the engineering. It is a property of the mathematics itself. And a quantum computer is the machine that can compile that weakness into physics, the same way Turing’s bombe compiled Enigma’s weakness into copper.

    The next post is about the mathematics. The post after that is about the structural weakness. The post after that is about how the machine turns that weakness into the cancellation I could not unpack here. By the end of the series, you will have followed the same kind of move Turing made, from a structural rule that looks like nothing, all the way to the machine that breaks the unbreakable. The substrate is different. The principle is the same.

    Fediverse Reactions
  • The Machine That Proved You Can Break the Unbreakable

    The Machine That Proved You Can Break the Unbreakable

    It started with a certificate.

    I work in public key infrastructure. The shorthand for what I do is PKI, and the practical version is that I spend my days working with the systems that make it safe to type your bank password into a web browser. I’m the person who needed to understand what the cryptographer’s work means for the world I live in, and I did the work to find out, and now I am going to walk you through it. For the last thirty years, almost all of that work has rested on a small family of math problems that everyone in my field knows by name: RSA, ECC, Diffie-Hellman. These are the foundations of your bank login, your encrypted messages, your software updates, and roughly every secure connection on the internet.

    The industry I work in is in the middle of replacing all of it.

    The reason we’re replacing it is a kind of computer that does not yet exist. Quantum computers, the real ones, capable of breaking the cryptography that protects the internet today, are still years away. But the migration to new algorithms is happening now, and it is happening because of a credible threat from a machine almost nobody, including most of the people in my own industry, actually understands.

    I needed to understand it. So I started reading.

    What I found was that the articles available to a smart non-specialist reader are not very good. They tell you that quantum computers try every possibility at once. They tell you a qubit (short for quantum bit) is both 0 and 1 at the same time. They tell you it’s like a coin that’s both heads and tails until you look at it. Each of these explanations gestures at something profound, and then backs away before saying what the something actually is. After a few weeks of reading, I started to suspect that most of the writers did not understand the thing they were trying to explain.

    This is the first of several posts about what I found when I kept going. By the end of the series, you will have a real understanding of how a quantum computer breaks the cryptography that protects almost every secure connection you make in a day. There will be no hand-waving. There will be some work for you to do, and I will not waste your effort.

    But to get there, we have to throw out almost everything you have been told about what quantum computers are. The best way I have found to do that is to start somewhere most of us have already been: with a man named Alan Turing, a machine called the bombe, and a code the Germans thought could not be broken.

    This first post is about that machine and that code. It is about how something the Germans considered mathematically impossible to break was broken anyway, day after day, by exploiting a single tiny weakness in the machine. The reason we are starting here is that the same principle is what makes quantum computers dangerous to the cryptography we use today. Once you see what Turing did at Bletchley Park, the rest of the series is the modern version of the same story.

    The code the Germans trusted

    If you have not seen The Imitation Game, I highly recommend it. The film is a useful entry point to a story that matters here, and most of what I am about to walk you through will land more easily if you have a picture in your head of Bletchley Park, Alan Turing, and the rooms where the work happened. If you have already seen it, I am going to take you a layer deeper than the film does, into how the machine actually knew it had won.

    Here is the setup. The Germans, during the Second World War, encrypted nearly all of their military communications with a machine called Enigma. Enigma was about the size of a typewriter. It had a keyboard, a set of rotors that scrambled letters as you typed, a plugboard that swapped letters around before and after the rotor stage, and a daily setting that changed all of those configurations at midnight. The Germans used it for everything from U-boat coordinates to weather reports to the communications of the German high command.

    The reason the Germans believed Enigma was unbreakable came down to one number.

    A standard three-rotor Enigma with a ten-pair plugboard had exactly 158,962,555,217,826,360,000 possible settings. About 159 quintillion. The Germans looked at that number and concluded, reasonably, that no machine of their era could ever grind through 159 quintillion possibilities by counting. They were right about that part. They were wrong about everything else.

    The German Navy used an even more complex four-rotor version of Enigma, which made the math harder still. The British codebreakers eventually broke that one too, but it took longer, and there was a period in 1942 when they could not read U-boat traffic at all. Hold that detail. We will come back to the idea of “just make the key bigger” later in the series, because it is exactly the move companies will reach for when they hear that quantum computers can break the cryptography we use today.

    The hidden crack

    Enigma had one rule baked into its physics that the Germans did not understand was a vulnerability.

    Because of how the machine’s reflector was wired, no letter could ever encrypt to itself. An A could become any of the other twenty-five letters of the alphabet, but never an A. A B could become anything except a B. This sounds like a tiny detail. It was the crack that broke everything.

    To see why, think about a detective working a case. The detective knows one ironclad rule: the culprit cannot have been somewhere else at the time of the crime. Every suspect with a verified alibi is eliminated instantly. Not by proving them innocent. By structural impossibility. The detective does not have to investigate those suspects further. The alibi rules them out.

    Enigma’s quirk worked the same way. Any guess that required a letter to encrypt to itself was instantly, structurally impossible. Alibied out. No further checking needed.

    This is the first move you should hold on to, because it returns later. The way you break something that looks unbreakable is not by checking every possibility. It is by finding a structural rule that lets you eliminate entire categories of possibilities at once.

    Cribs

    Even with the no-self-encryption rule, the machine Turing designed could not work in a vacuum. That machine was called the bombe, a name borrowed from the bomba kryptologiczna built by Polish cryptographers who had been attacking Enigma since the 1930s and whose work Turing’s design built on. A later refinement by Gordon Welchman, the diagonal board, was what made the bombe practical, by ruling out most of the false leads that would otherwise have buried the real answer. The bombe needed a foothold. That foothold was something codebreakers called a crib: a guessed fragment of plaintext (the original message, before encryption). The encrypted version, the scrambled output that came over the radio, is called the ciphertext.

    The Germans were creatures of habit. Weather reports broadcast on regular schedules always began with the word WETTER, the German word for weather. Routine military messages ended with HEIL HITLER. Operators, against orders, repeatedly used their girlfriends’ names or simple keyboard patterns like QWERTZU as the message-specific settings that prefaced the real ciphertext. The film The Imitation Game dramatizes this as a single character whose German counterpart always used the name Cilly. The real history calls these patterns Cillies, and they were not the work of one operator. They were a class of operational discipline failures committed across the entire German military for years.

    The codebreakers did not see the plaintext. They inferred it. From radio traffic analysis, captured codebooks, and operational pattern recognition, they knew which intercepted messages were weather reports, and they knew weather reports began with WETTER. They could not read the message yet. They could guess what its first six letters had to be.

    A guess, combined with a structural rule, was enough.

    How the bombe worked

    Turing’s insight was that you could compile the logical implications of a crib into an electrical circuit.

    Here is what that means in plain language. Suppose you guess that a particular stretch of ciphertext is the encryption of WETTER. If your guess is right, and if the rotor positions you are testing are right, then a chain of letter relationships is implied. The first ciphertext letter must be the encrypted form of W. The second must be the encrypted form of E. And so on. Those relationships form a web of constraints. The bombe energized the entire web at once with electrical current.

    For most rotor settings, the web of constraints contradicted itself. The current would flow through the wires and find that the rotor setting required letter A to equal letter B, and also required letter A to equal letter C, and also required letter A to equal letter Q. Three different requirements for the same letter. Impossible. Current would distribute itself across all twenty-six possibilities for some test letter, which the machine read as “everything is still possible, no information yet, this setting is wrong, move on.”

    For one rotor setting in the entire space, the contradictions collapsed. Every implication held. Current flowed through exactly one wire for the test letter, with the other twenty-five dark. A relay clicked. A motor stopped. An operator wrote down the setting.

    The bombe had not read anything. It had not decrypted a message. It had found the one rotor configuration where the hypotheses generated by the crib did not contradict themselves.

    The speed of it

    The mechanical part of the bombe was not slow. The top drum of each rotor assembly spun at about one hundred rotations per minute. A single bombe could run through all 17,576 possible rotor positions in roughly twenty minutes. With thirty-six rotor sets working in parallel, and often several bombes running at once, the codebreakers at Bletchley Park were frequently cracking the daily Enigma key within an hour of getting a viable crib.

    Twenty minutes. Out of a space of 159 quintillion settings.

    The Germans were not wrong that 159 quintillion was a number too large to count through. They were wrong to assume that counting through it was the only way to break their cipher.

    You do not defeat an astronomical number by counting through it. You defeat it by exploiting structure.

    That sentence is the spine of everything we are going to talk about for the rest of this series. Hold it. We will come back to it more than once.

    What the bombe was actually looking for

    There is one more thing to notice about how the bombe worked, because it is the move that connects directly to quantum computing.

    The bombe did not test rotor settings by decrypting messages and checking whether the result looked like German. It would not have known German if it saw it. It searched for consistency. At the right rotor setting, the implications generated by the crib held together. At every wrong setting, they contradicted themselves.

    Read that again, because it is the part most explanations of the bombe miss. The bombe did not check answers. It arranged a physical situation where every wrong setting destroyed itself, and the right one was simply the setting left standing.

    What the bombe tells us about computers

    The bombe was not a general-purpose computer. It was a single-purpose machine, built to attack one cipher, and it could not do anything else. But the way it worked tells us something important about what every computer is, including the one you are reading this on.

    A computer is a physical machine that arranges electricity, or light, or atoms, according to rules, and produces an output we can read. The bombe was electromechanical. Your laptop is silicon. Different substrates, same kind of thing.

    What makes a machine computational is that the mathematical structure of a problem can be compiled into physical structure. The bombe’s wires were Enigma’s logical relationships rendered in copper. Your laptop’s transistors are the rules of arithmetic and logic rendered in silicon. The bombe did not think about Enigma. The bombe was Enigma’s logic, run backward in electricity.

    Every computer that has ever existed works the same fundamental way. Your laptop, your phone, the bombe, the supercomputers at national laboratories. Each one has definite states, deterministic transitions, and symbols manipulated according to rules. Faster, bigger, more parallel, but the same model. This is what computation has been since Turing wrote down the formal definition of it in 1936, three years before he walked into Bletchley Park.

    This kind of computer is what we now call classical. Not because it is old, but because it follows the rules of classical physics, the physics of the everyday world. The states are definite. The operations are deterministic. The world the machine lives in is the world you live in.

    What comes next

    Turing’s bombe broke a code that the Germans had every reason to believe was unbreakable. The breaking did not come from a faster machine grinding through more possibilities. It came from finding a tiny structural rule, a single quirk in how Enigma was wired, and compiling that rule into physics. Once the rule was in copper, the impossible became routine. Most days for the rest of the war.

    Today, the cryptography that protects almost every secure connection on the internet has its own hidden structural weakness. It is not a flaw in the engineering. It is a property of the mathematics itself. And there is a machine being built right now, by companies you have heard of and some you have not, that can compile that weakness into physics the way Turing compiled Enigma’s weakness into copper.

    That machine is a quantum computer. It is not a faster version of your laptop. It is a different kind of machine, operating on different physics, doing a different kind of thing. The next post is about what that means. We are going to take the principle the bombe established, that you defeat an astronomical number not by counting through it but by exploiting structure, and we are going to see how a quantum computer does the same trick on a substrate so different from copper wires that almost everything your intuition tells you about computers will have to be set aside.

    The Germans of 1940 could not have imagined the bombe. We are about to look at the machine that the cryptographers of today cannot yet build, but are racing to defend against anyway.

    Fediverse Reactions