The AI systems we build today will be broken by quantum computers.
“Most AI infrastructure encrypts with RSA or ECDSA. Shor's algorithm breaks both. Cryptographically relevant quantum computers are 10–15 years out. Most production systems will still be running then.”
The Harvest-Now-Decrypt-Later Threat
This is not a future problem. It is a present problem with a future detonation date.
Nation-state adversaries are already collecting encrypted AI inference traffic — agent-to-agent communications, model API calls, training pipeline data transfers. All of it encrypted with ECDH key exchange and ECDSA signatures. All of it vulnerable to Shor's algorithm once cryptographically relevant quantum computers exist.
They do not need to break the encryption today. They collect it now. They decrypt it later.
The 10–15 year estimate for cryptographically relevant quantum computers is a median estimate with fat tails. Some credible forecasts put it at 7 years. IBM's quantum roadmap has demonstrated consistent doubling of qubit counts. NIST finalized post-quantum cryptography standards in August 2024 precisely because they believed the threat was close enough to warrant migration now.
The AI systems you deploy today will still be running in 2030. The question is whether their cryptographic foundations will still hold.
What Breaks Under Shor's Algorithm
Shor's algorithm runs in polynomial time on a quantum computer and breaks:
RSA — factoring large integers (basis of RSA public key) ECDH — discrete log on elliptic curves (basis of key exchange) ECDSA — elliptic curve digital signatures (basis of code signing, TLS) DH/DHE — classical Diffie-Hellman
What does NOT break:
AES-256 — symmetric encryption (Grover's algorithm gives √ speedup, doubling key size handles it) SHA-2/3 — hash functions (similar Grover's speedup, manageable) ML-KEM — lattice-based key encapsulation (hardness: Learning With Errors problem) ML-DSA — lattice-based signatures (hardness: Module Lattice problems)
Lattice problems are believed quantum-resistant because Shor's algorithm and Grover's algorithm do not provide useful speedups against them. The underlying mathematical hardness remains intact under quantum computation.
The migration path is clear: swap ECDH → ML-KEM-768, swap ECDSA → ML-DSA-65.
NIST PQC Standards: What to Use
NIST finalized the post-quantum cryptography standards in August 2024. Three algorithms you need to know:
ML-KEM-768 (CRYSTALS-Kyber) — Key encapsulation mechanism. Replaces ECDH for key exchange. Security level: 128-bit post-quantum (equivalent to AES-128 against quantum adversary). Public key: 1184 bytes. Ciphertext: 1088 bytes. Fast: ~50μs key generation, ~60μs encapsulation on modern hardware.
ML-DSA-65 (CRYSTALS-Dilithium) — Digital signature scheme. Replaces ECDSA for signing. Security level: 128-bit post-quantum. Public key: 1952 bytes. Signature: 3293 bytes. Fast: comparable latency to Ed25519.
SLH-DSA (SPHINCS+) — Hash-based signature scheme. Stateless, conservative security assumptions. Larger signatures (~8KB) but extremely well-understood security proof.
For AI infrastructure, the migration looks like: 1. All TLS connections between agents → hybrid X25519+Kyber (transitional) 2. Agent signing keys → ML-DSA-65 3. Key exchange in agent-to-agent protocols → ML-KEM-768 4. Long-term storage encryption → AES-256 (already safe)
How I Built This into axiom-engine
axiom-engine uses ML-KEM-768 for all key encapsulation and ML-DSA-65 for all agent action signatures. This was not an afterthought — it was the initial design.
Every ZK receipt generated by the axiom-engine zkVM is signed with ML-DSA-65. This means the cryptographic proof of an agent action remains verifiable and tamper-evident not just today, but after the quantum threshold.
The implementation uses the pqcrypto-kyber and pqcrypto-dilithium Rust crates — constant-time implementations, no side-channel vulnerabilities from conditional branches on secret data.
One practical note: post-quantum keys are larger than classical keys. ML-KEM-768 public keys are 1184 bytes vs 64 bytes for Ed25519. ML-DSA-65 signatures are 3293 bytes vs 64 bytes for Ed25519. For most agent infrastructure this is acceptable — the overhead is in storage and network, not computation. For extremely latency-sensitive paths, hybrid modes (classical + PQ in parallel) let you maintain backward compatibility while gaining quantum resistance.
The cost of migrating now is low. The cost of not migrating and having your entire AI infrastructure's historical communications exposed is not recoverable.
Saraswat Das · Jun 2026