What Is Y2Q?
Y2Q, short for Years to Quantum, is the time remaining until a quantum computer can break the public-key cryptography that protects most digital communication today. The name borrows from Y2K, but unlike Y2K, Y2Q has no known date.
The threat comes from Shor's Algorithm, published by Peter Shor in 1994. On a large, error-corrected quantum computer it factors integers and computes discrete logarithms in polynomial time, which would break RSA and discrete-log schemes, including finite-field Diffie–Hellman/DSA and elliptic-curve cryptography. A machine able to do this at real key sizes is called a cryptographically relevant quantum computer, and the day one exists is often called Q-Day. The replacements are covered in Post-Quantum Cryptography.
Where the Y2K Comparison Fits, and Where It Breaks
Y2K came from systems storing only two digits of the year, so the rollover from 99 to 00 risked being read as 1900. The world had years of warning, and the rollover is remembered as largely uneventful. QuEra's guide, Preparing for Y2Q, draws on this comparison.
The similarities are real: the problem is embedded in systems everywhere, and early work pays off. The differences matter more:
- No fixed date. Y2K had a calendar deadline. Y2Q depends on hardware progress that no one can schedule.
- Silent failure. Many Y2K failures were expected to surface as system errors or bad outputs. Encrypted data can be decrypted without leaving a trace.
- A harder fix. Y2K remediation required finding and correcting date-handling logic and data formats across code, databases, interfaces and embedded systems. Y2Q needs cryptographic algorithms replaced across protocols, devices and certificates.
What a Cryptographically Relevant Quantum Computer Would Need
Breaking RSA-2048 would take billions of logical gate operations on roughly thousands of logical qubits, protected by quantum error correction. The number of physical qubits required is an output of assumptions about error rates, cycle times and code choice, not a fixed figure.
| Estimate | Physical qubits | Run time | Basis |
|---|---|---|---|
| Gidney and Ekerå, 2021 (arXiv 2019) | about 20 million | about 8 hours | Surface code on a planar nearest-neighbor grid, 0.1% physical gate error rate, 1 microsecond surface-code cycle and 10 microsecond control-system reaction time |
| Gidney, 2025 (preprint) | under 1 million | under a week | Similar hardware assumptions, improved algorithms and codes |
Two lessons follow. Estimates have fallen as algorithms and codes improved, so hardware is not the only variable. And these are calculations, not demonstrations: no quantum computer has run Shor's algorithm at cryptographic scale.
Harvest Now, Decrypt Later and the Migration Clock
The practical urgency comes from harvest now, decrypt later: an adversary records encrypted traffic today and decrypts it once a capable machine exists. Data that must stay confidential for decades may be at risk long before Q-Day if it is captured today under quantum-vulnerable protection.
Mosca’s 2018 article states this planning rule as a simple inequality. If \(x\) is how long data must stay secret, \(y\) is how long migration takes, and \(z\) is the time until a cryptographically relevant quantum computer exists, then risk arises when
\[ x + y > z \]
Because \(z\) is uncertain, planning focuses on shrinking \(y\). In August 2024, NIST published its first post-quantum standards: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA). NIST IR 8547, finalized in October 2026, says NIST will deprecate quantum-vulnerable public-key cryptography after 2030 and disallow its use under NIST standards and guidelines after 2035.
Grover's Algorithm gives only a quadratic speedup against symmetric keys, so AES-256 is generally considered sufficient. See Quantum Readiness for the broader organizational picture.
How Hardware Progress Sets the Y2Q Clock
Y2Q is a cryptography problem, but its clock is set by fault-tolerant computing. Every estimate above assumes machines that run deep circuits with logical error rates far below today's physical rates.
Hardware choices change the estimate in different directions. Neutral atoms held in optical tweezers can be rearranged, giving connectivity beyond nearest neighbors, which opens error-correcting codes that may need fewer physical qubits per logical qubit. Their error-correction cycles are typically slower than those of superconducting devices, which lengthens run time. Neither property alone fixes a date, which is why responsible planning treats Y2Q as a range rather than a prediction.
FAQ
When will Y2Q arrive?
No one knows. Resource estimates show what a machine would need, but they do not predict when it will be built. Because migration takes years, security guidance recommends starting now rather than waiting for a date.
Does Y2Q mean all encryption will break?
No. Shor's algorithm threatens public-key schemes based on factoring and discrete logarithms, such as RSA, finite-field Diffie–Hellman/DSA and elliptic-curve cryptography. Symmetric ciphers like AES-256 and standard hash functions require separate analysis for preimage and collision resistance; quantum attacks can be mitigated by choosing adequate hash output lengths.
What is harvest now, decrypt later?
It is an attack in which encrypted data is recorded today and stored until a quantum computer can decrypt it. It matters most for information with a long confidentiality lifetime, such as health, government or industrial records.
What should organizations do about Y2Q now?
Inventory where public-key cryptography is used, rank systems by how long their data must stay secret, and plan migration to NIST-standardized post-quantum algorithms. Building crypto-agility, the ability to swap algorithms without redesigning systems, shortens the migration time.
Key Takeaways
- Y2Q, or Years to Quantum, is the time until a cryptographically relevant quantum computer can break RSA and discrete-log cryptography, including finite-field Diffie–Hellman and elliptic-curve cryptography, and it has no known date.
- Resource estimates for RSA-2048 have fallen from about 20 million to under 1 million physical qubits, but they are calculations under stated assumptions, not demonstrations.
- Harvest now, decrypt later makes long-lived data vulnerable before Q-Day, so migration should be planned against data lifetime.
- NIST finalized its first post-quantum standards in 2024, and AES-256 remains considered adequate against known quantum attacks.
.webp)
