Why quantum cryptography is a philosophy question before it's an engineering one

The actual paradigm shift

Classical public-key cryptography (RSA, ECC, Diffie–Hellman) rests on a specific kind of trust: that certain math problems — factoring a large number into primes, for instance — are hard enough that no realistic amount of computing time will crack them. That's always been a bet on the limits of computation, not a law of nature. If a faster algorithm turns up (classical, or per Shor's algorithm, quantum), the bet is simply lost, all at once, for everything ever encrypted that way. Quantum key distribution proposes something categorically different: security resting on physical law rather than on nobody having found a shortcut yet. Whether that distinction holds up as thoroughly as its proponents claim is itself a real, open philosophical question — not something this page is trying to settle.

Mosca's inequality — why "wait and see" isn't neutral

Michele Mosca's framing (2015): call X how long your data must stay secret, Y how long migrating to post-quantum algorithms actually takes, and Z how long until a cryptographically relevant quantum computer exists. If X+Y>Z, you're already exposed today, not on the day Z arrives — because the attack is "harvest now, decrypt later": intercepted ciphertext can simply be stored and broken retroactively. Large organizations' own migrations commonly run past a decade, which is most of why NIST finalized its first three PQC standards in August 2024 rather than waiting: FIPS 203 (ML-KEM, from Kyber), FIPS 204 (ML-DSA, from Dilithium), and FIPS 205 (SLH-DSA, from SPHINCS+) — two families, lattices and hash functions, both described below.

Illustrative proportions, not a forecast — nobody knows the real value of Z. That uncertainty is the entire point: you can't wait for a confirmed date before X+Y matters.

Where this doesn't apply: symmetric keys

Not everything is equally at risk. RSA and ECC (asymmetric/public-key) fall to Shor's algorithm in polynomial time — a total break. Symmetric ciphers like AES aren't built on the same kind of math and aren't broken the same way: Grover's algorithm only gives a quadratic speedup against brute-force key search, which AES-256's key length already absorbs (an attack that would otherwise take $2^{256}$ steps drops to roughly $2^{128}$, still computationally out of reach). The urgency here is specifically about public-key cryptography, not "all encryption" — a distinction worth keeping precise rather than blurring for effect.

Where the mathematics actually lives today

Building global QKD infrastructure on dedicated fibre is expensive and slow to deploy, which is why the practical answer for most software today is mathematical, not physical: post-quantum cryptography (PQC). NIST's standardized schemes — ML-KEM (Kyber) and ML-DSA (Dilithium) — are built on lattice problems (Learning With Errors): finding the nearest point in an extremely high-dimensional lattice, a search that stays hard for both classical and quantum computers as far as anyone has shown. SPHINCS+ takes a different route, resting on hash functions instead. None of this needs a quantum computer to run — it runs on the hardware everyone already has, which is exactly why it's the more immediately actionable half of this story.

A different deployment: firmware, not TLS

Not every PQC problem looks like a website handshake. Firmware signing keys often can't be rotated after a device ships — if the signing key is ever broken, there may be no way to push a fix to hardware already in the field. NIST addressed this specifically (SP 800-208) with two stateful hash-based signature schemes, LMS and XMSS: each private key can only sign a bounded, pre-committed number of messages, tracked by state, in exchange for security resting on hash functions alone — a stateful alternative to the stateless hash-based SLH-DSA and to the lattice-based ML-DSA, chosen for exactly this narrower, higher-stakes use case rather than as a general-purpose signature scheme.

The question underneath the question

"Harvest now, decrypt later" isn't hypothetical — encrypted traffic recorded today can simply be stored until the hardware to break it exists, which means some of what's private right now already has a quietly ticking expiry date. That reframes cryptography as something closer to actuarial risk than a solved problem: not "is this secure" but "secure for how long, against whom, and is that window long enough for what's actually inside." We don't have a tidy answer to that — we don't think anyone honestly does yet — but it's the actual reason post-quantum migration gets treated as urgent rather than academic, and worth saying plainly rather than leaving implied.

The Church–Turing question, and who's actually tested it

The (extended) Church–Turing thesis, informally: anything efficiently computable by any physically realizable process is efficiently computable by a classical Turing machine. The early landmark challenges to that claim were two specific, real experiments — Google's Sycamore (2019, 53 superconducting qubits) and USTC's Jiuzhang (2020, photonic boson sampling) — each solving a narrowly defined sampling problem believed intractable classically. Worth being precise about what that did and didn't show: the problems were deliberately chosen to be hard for classical hardware and not otherwise useful, and subsequent classical algorithms have since narrowed some of the original claimed gap. Whether any of this actually falsifies the extended thesis, or just moves the goalposts on which classical algorithms exist, is a genuinely open, actively disputed question in computer science and physics — not settled consensus, and not something this page is trying to resolve. KodamaSEC doesn't operate either kind of hardware; this is field context, not a claim about anything we've built.