Is RSA Encryption Quantum Safe? RSA, ECC and AES-256

RSA encryption is not quantum safe. RSA gets its security from how hard it is to factor very large integers. A big enough fault-tolerant quantum computer running Shor’s algorithm could do that factoring in polynomial time. That would expose RSA keys, and the same applies to elliptic curve cryptography. Symmetric ciphers such as AES-256 are a different story and remain secure.

For organizations that run operational technology (OT) and critical infrastructure, this matters most on the encrypted connections between sites, to cloud environments and for remote users. Most of these connections still set up their session keys with RSA or elliptic curve Diffie-Hellman. This article covers what is broken, what is not, which algorithms replace the vulnerable ones, and the deadlines regulators have set.

Will quantum computers break RSA?

Yes, once a cryptographically relevant quantum computer exists. No such machine exists today, but the estimated hardware needed to build one has dropped sharply in recent years.

Why Shor’s algorithm is the problem

The best classical factoring method, the general number field sieve, takes sub-exponential time. That is why RSA moduli of 2048 bits and up are out of reach for conventional computers. NIST cryptographers Dustin Moody and Angela Robinson write that what makes Shor’s algorithm so notable is that it would run in polynomial time on a quantum computer. Increasing the RSA key size therefore does not solve the problem. It only raises the attacker’s cost by a modest amount.

How resource estimates have changed

Published estimates of the machine needed to break RSA-2048 have fallen quickly:

• 2021 estimate: RSA-2048 could be factored in about 8 hours with 20 million noisy qubits (Gidney and Ekerå, Quantum, 2021).
• 2025 estimate: in May 2025, quantum researcher Craig Gidney wrote: “I reduced the expected number of qubits needed to break RSA2048 from 20 million to 1 million.”

Gidney does not claim such a machine will exist soon. He backs the NIST timeline anyway, saying he does so because “I prefer security to not be contingent on progress being slow.”

Expert forecasts still vary widely. The NIST NCCoE notes that some believe that CRQCs may emerge by 2030, others expect 15 to 20 years, and others believe it may take 30+ years due to the challenges of achieving fault-tolerant quantum systems.

Is elliptic curve cryptography vulnerable to quantum computers?

Yes. Elliptic curve cryptography depends on the discrete logarithm problem, and Shor’s algorithm solves that too, so ECDH key exchange and ECDSA or EdDSA signatures are just as exposed as RSA.

Many engineers assume elliptic curves are stronger because their keys are shorter. Against a quantum attacker the shorter keys are a weakness. A 2026 resource analysis concluded that, for breaking 256-bit elliptic curve discrete logarithms, a planar degree-four device with half a million qubits remains the better understood and also likely more feasible engineering path. That is fewer qubits than the 2025 estimate for RSA-2048.

NIST’s transition material lists the quantum-vulnerable algorithm families plainly: RSA, (EC) Diffie-Hellman, MQV, ECDSA, EdDSA. In OT networks these show up in IPsec and TLS tunnels between substations or plants, in links from field sites to cloud historians, in remote maintenance access, and in the certificates that authenticate all of these.

Is AES-256 quantum safe?

Yes. NIST states that even with the impact of quantum computers, AES-128, AES-192, and AES-256 will remain secure for the foreseeable future.

The quantum algorithm that applies to symmetric ciphers is Grover’s algorithm. It gives only a quadratic speedup on brute-force key search, and it cannot be split efficiently across machines. IETF RFC 9958 notes that running 256 quantum computers in parallel will only reduce runtime by a factor of 16. For that reason the IETF considers 128-bit algorithms quantum-safe for the foreseeable future. Even so, some organizations, such as the French National Agency for the Security of Information Systems (ANSSI) [ANSSI] and the National Security Agency (NSA) (CNSA 2.0) [CNSA2-0], recommend the use of AES-256.

The practical point for network teams: the bulk encryption inside your tunnels is not the weak spot. The weak spot is the public-key handshake that creates and exchanges the symmetric keys. If that handshake is broken, an attacker gets the session keys, and a strong cipher no longer protects the recorded traffic.

Which encryption algorithms are quantum resistant?

The quantum-resistant algorithms that are standardized today are NIST’s ML-KEM for key establishment and ML-DSA and SLH-DSA for signatures. Stateful hash-based signatures and symmetric primitives with at least 128-bit strength also qualify.

On August 13, 2024, NIST approved three PQC standards-FIPS 203, FIPS 204, and FIPS 205. NIST expects that ML-DSA, SLH-DSA and ML-KEM will provide the foundation for most deployments of post-quantum cryptography.

For a reference profile, the US National Security Agency’s CNSA 2.0 suite is a useful benchmark: ML-DSA-87 and ML-KEM-1024 together with SHA384, SHA512, AES-256, LMS, and XMSS comprise the CNSA Suite 2.0. More algorithms are on the way. HQC was also recently selected for standardisation in 2025 by NIST, and NIST is developing a FALCON-based signature standard.

Hybrid key exchange during the transition

European agencies recommend not relying on a single new algorithm at the start. The EU standardization rolling plan says the recommendations encourage to implement hybrid solutions with both PQC and current asymmetric cryptography. A hybrid design merges a classical exchange and a post-quantum exchange into one key, so the result holds as long as either component holds.

One example of this design is Quantum Network’s QPN gateway. It combines a classical key agreement and an ML-KEM key agreement into one session key, renews both handshakes every two minutes, and encrypts payload traffic with ChaCha20-Poly1305, checking every packet with Poly1305 authentication tags.

When will RSA and ECC be deprecated?

Under NIST IR 8547, quantum-vulnerable algorithms at 112-bit security strength are deprecated after 2030, and all quantum-vulnerable public-key algorithms are disallowed after 2035. The EU wants high-risk use cases, critical infrastructure among them, migrated by the end of 2030.

The NIST IR 8547 timeline

NIST published the initial public draft of NIST IR 8547 on November 12, 2024. It proposes:

• 112-bit security strength (for example RSA-2048): deprecated after 2030, disallowed after 2035.
• 128-bit and higher security strength (for example elliptic curve P-256 or RSA-3072): disallowed after 2035.
• Symmetric algorithms: NIST-approved symmetric primitives providing at least 128 bits of classical security continue to be approved.

The 2035 date comes from US National Security Memorandum 10, which sets the goal of mitigating as much of the quantum risk as is feasible by 2035. NIST also expects high-risk systems transitioning much earlier. National Security Systems face a tighter deadline: the CNSA 2.0 suite [CNSA2] requires National Security Systems to be fully compliant by 2031.

The EU roadmap for critical infrastructure

EU Member States adopted the Coordinated Implementation Roadmap in June 2025, following Commission Recommendation (EU) 2024/1101. According to the Commission, all Member States should start transitioning to post-quantum cryptography by the end of 2026. At the same time, the protection of critical infrastructures should be transitioned to PQC as soon as possible, no later than by the end of 2030. A Commission briefing on the roadmap names the high-risk sectors: critical infrastructure (eg water, energy, health care, finance and transportation), with all remaining migrations due by the end of 2035.

Henna Virkkunen, Executive Vice-President of the European Commission, said that post-quantum cryptography is essential to ensure a high level of cybersecurity, fortifying our systems against future threats.

How should OT and critical infrastructure operators plan the migration?

Start with the network connections that carry long-lived sensitive data, move their key exchange to hybrid post-quantum cryptography, and make sure the cryptography can be swapped again later without replacing equipment.

Inventory the tunnels, not just the servers. List every encrypted path: site to site, edge to cloud, and remote access for staff and contractors. For each one, record the key exchange algorithm, the certificate type, and who controls each end. NIST advises that organizations must identify where vulnerable algorithms are used and plan to replace or update them.

Rank paths by data lifetime. Apply the X plus Y test from NIST IR 8547 to each path. Engineering data, grid topology and control traffic that stays sensitive for ten years or more should move first.

Protect PLCs and controllers without touching them. Controllers and other OT endpoints often cannot be updated with new cryptographic libraries. Encrypting at the network layer, at the edge of each site, covers their traffic without changing the devices. As one example, Quantum Network’s QPN gateway encrypts at Layer 3, so nothing has to be installed on the equipment behind it. It works alongside existing firewalls and routers and supports site-to-site, edge-to-cloud and remote access setups, including air-gapped networks.

Design for crypto agility. The EU roadmap materials stress that cryptographic routines and ciphers can be easily upgraded or replaced without having to completely replace the underlying application or device. Choose designs where you can change the post-quantum algorithm through an update if cryptanalysis moves on.

Separate key exchange from signatures in your plan. Quantum-safe key exchange protects confidentiality against harvest-now-decrypt-later collection right away. Moving signatures and PKI to ML-DSA or hash-based schemes takes longer, because certificate chains and device trust stores have to change as well. Plan both tracks, but begin with key exchange.

CISA sums up the situation: although quantum computing technology capable of breaking modern public-key encryption does not yet exist, government agencies and critical infrastructure entities-including both public and private sector organizations-must begin preparing now.