Cryptographers place $5,000 bet whether quantum will matter
- Reference: 1775718010
- News link: https://www.theregister.co.uk/2026/04/09/cryptograhpers_quantum_bet/
- Source link:
Now, two well-known cryptographers are preparing to wager on how this state of uncertainty will collapse into a measurable outcome.
For the past ten years, the US National Institute of Standards and Technology (NIST) has been pushing for the development of Post-Quantum Cryptography (PQC), based on the belief that some day, quantum computers will be capable of decrypting data encrypted with legacy algorithms.
[1]
There's some skepticism about that. Last year, Peter Gutmann, a professor of computer science at the University of Auckland, New Zealand, [2]dismissed PQC in an interview with The Register. He noted that quantum computers have yet to factor the number 35 (6 bits) due to their inability to correct errors. Elliptic Curve Cryptography private keys have a default key length of 256 bits, so quantum computers still have a long way to go.
[3]
[4]
But a week ago, Google [5]said it revised its estimates for the quantum computing resources required to solve the logarithm problem (ECDLP-256) upon which elliptic curve cryptography is based. Running [6]Shor's algorithm – the quantum method used to solve factoring and discrete logarithm problems – would take about 20 times fewer physical qubits than previously estimated, Google researchers [7]claim .
That doesn't clarify when a quantum computer might be cryptographically relevant. NIST wants quantum-vulnerable algorithms ousted by 2035. No one is certain whether that's a reasonable estimate, though security vendors insist the quantum threat is nigh.
[8]
But Google's claimed advance and intermittent reports of quantum progress like those [9]published on Thursday by ETH Zurich suggest the concerns being raised should be dealt with sooner rather than later – unless you have [10]rejected recent quantum research as unsound .
Filippo Valsorda, a cryptography engineer and open source maintainer who worked previously for Google, this week cited Google's shot across the bow and [11]adjacent research in a [12]blog post , arguing that the transition to PQC needs to move faster.
[13]AWS CEO: It's funny when people ask me if AI is overhyped
[14]Atlassian gussies up Confluence for the AI era
[15]Talk ain't cheap: DARPA offers grants for new AI-to-AI communication protocol
[16]AMD's AI director slams Claude Code for becoming dumber and lazier since last update
Alluding to Gutmann's contrarian take as shallow, Valsorda pointed to [17]statements by Scott Aaronson, chair of computer science at the University of Texas at Austin and one of the leading experts on quantum computing, that emphasize the urgency of treating PQC seriously.
"In summary, it might be that in 10 years the predictions will turn out to be wrong, but at this point they might also be right soon, and that risk is now unacceptable," Valsorda wrote.
Matthew Green, an associate professor of computer science at the Johns Hopkins University, took note of Valsorda's post and in a reply to a Bluesky [18]thread [19]said , "I think this is a good precautionary analysis but I'd bet huge amounts of money against a relevant quantum computer by 2029 or even 2035."
[20]
Valsorda and Green discussed the matter politely, with Green noting that a one-sided approach would be just to buy some bitcoin and post the public key – the implication being that a cryptographically relevant quantum computer (CRQC) would be able to decrypt the Elliptic Curve Digital Signature Algorithm (ECDSA) protecting that private key, enabling the theft of the funds.
But the bitwise pair appears instead to have settled on a two-sided affair, outlined in [21]a wager proposal drawn up by Green.
The bet is for $5,000. Valsorda will pay if a shared secret from ML-KEM-768 – a [22]recently approved quantum-resistant algorithm – is recovered from a public key and ciphertext, either from a classical or quantum attack. And Green is on the hook to pay if a shared secret from X25519 – a widely used elliptic curve algorithm – is recovered from a pair of public points on the curve, whether through classical or quantum means.
In theory, X25519 should be easier for a CRQC to defeat than ML-KEM-768, which is designed to offer a more robust defense against quantum cryptanalysis. So Green is essentially betting that advances in cryptanalysis will reveal weaknesses in Module-Lattice-Based Key-Encapsulation (ML-KEM) before quantum systems come into play.
As of Wednesday morning Pacific Time, the bet was not yet official. Valsorda told The Register in an email that unforeseen events got in the way, but he expects the wager will be formalized soon.
"Life got in the way, I think we'll pen it today or tomorrow," he said.
The clock is ticking. ®
Get our [23]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2add4v7t_62inX8AWFQVXtwAAAEs&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://www.theregister.com/2025/07/17/quantum_cryptanalysis_criticism/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44add4v7t_62inX8AWFQVXtwAAAEs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33add4v7t_62inX8AWFQVXtwAAAEs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://research.google/blog/safeguarding-cryptocurrency-by-disclosing-quantum-vulnerabilities-responsibly/
[6] https://www.theregister.com/2025/07/17/quantum_cryptanalysis_criticism/#:~:text=Shor%27s
[7] https://arxiv.org/abs/2603.28846
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44add4v7t_62inX8AWFQVXtwAAAEs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://ethz.ch/en/news-and-events/eth-news/news/2026/04/a-new-trick-brings-stability-to-quantum-operations.html
[10] https://www.theregister.com/2025/07/31/microsoft_quantum_paper_science/
[11] https://arxiv.org/abs/2603.28627
[12] https://words.filippo.io/crqc-timeline/
[13] https://www.theregister.com/2026/04/07/aws_garman_humanx_ai_underhyped/
[14] https://www.theregister.com/2026/04/08/atlassian_brings_ai_and_agents/
[15] https://www.theregister.com/2026/04/08/darpa_wants_ai_agent_communication/
[16] https://www.theregister.com/2026/04/06/anthropic_claude_code_dumber_lazier_amd_ai_director/
[17] https://scottaaronson.blog/?p=9425
[18] https://bsky.app/profile/filippo.abyssdomain.expert/post/3mitkixqo2s2c
[19] https://bsky.app/profile/matthewdgreen.bsky.social/post/3miue4a2cas2n
[20] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33add4v7t_62inX8AWFQVXtwAAAEs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[21] https://www.dropbox.com/scl/fi/if3wfey7p8oe0xpi1n2pg/long_bet_agreement.pdf?rlkey=gmm8g5fly1vg86rohpc4dpyvc&e=2&st=o1s685pi&dl=0
[22] https://csrc.nist.gov/pubs/fips/203/final
[23] https://whitepapers.theregister.com/
Exactly my thought. I would probably consider 10 years a mostly-safe-for-most-things time span, so if Real Quantum Computing [TM] is available in about 20 years (say... 2045) I'd like to stop using vulnerable enrcyption 10 years earlier (2035).
Some secrets … need to be preserved for years or decades
Official documents like cabinet papers - often 40, 50 and 75 years. Of course governments typically leak faster than that.
I would probably take an even money bet for USD5000 that the strongest eliptic curve cryptosystems used today could resist business as usual crypoanalysis for the next fifty years.
I mean at any point during those five decades I would generate new keys and provide on request fresh cryptotext using the same cryptoalgorithm agreed from the beginning - previously provided cryptotext is disqualified - and the other party isn't permitted to build a massive single purpose machine to win the bet - the business as usual stipulation. For a paltry $5000 which would be mouse money in 2076, that is unlikely.
Of course if I were still around in fifty years… :)
Quantum computers are like fusion energy
They're just 2000 qbits away.
factorise 35
They can't factorise 35 without errors. I'll start worrying when they try to factorise, to choose a number at random, 42 and with error correction they come up with 6 and 9.
A Change of Tack ... to Both Avoid and Prevent Future Epic Storms and Create New Worlds
For the past ten years, the US National Institute of Standards and Technology (NIST) has been pushing for the development of Post-Quantum Cryptography (PQC), based on the belief that some day, quantum computers will be capable of decrypting data encrypted with legacy algorithms.
Nowadays is that future belief somewhat fundamentally altered in order to recognise the more realistic/fantastic possibility that, rather than quantum developments being necessarily initially and primarily hardware-centric, extremely rapid and surprisingly exclusive and secret stealthy progress has been, and is being, and is to be made in understanding and exploring/expanding and utilising the fact that it actually wholly exists as software which has its bases in virtually realised projects and programming capable of secure quantum communication and decryption of digital metadata stored in encrypted legacy system algorithms for supreme and novel unadulterated and noble leadership in remote general command and overall control.
And a pending treat it would be foolish to threaten, methinks ..... however, as it appears all too often to be the case that lessons are never well learned, step forward the fool and prove the following observation too true to deny and declare false .........
'Two things are infinite: the universe and human stupidity; and I'm not sure about the universe.' ...... Albert Einstein
Quantum computer == nuclear fusion
I suspect both will be "10 years off" for the next few decades.
Would you hear about it?
If quantum computers break (or have already broken) current cryptography, it seems probable that the security services would very strongly protect that information. That might seem fanciful. However, the breaking of Enigma seems to have been well hidden for a very long time. I expect that the circle of those in the know expanded over the years but it was likely a very small circle initially.
Personally, I'm not convinced about quantum computers but that may be down to my poor understanding.
If quantum computers crack current cryptography, do you expect to hear about it quickly? Perhaps.
For what little it may be worth, I agree that quantum computing is unlikely to threaten existing cryptosystems for many years, if ever. But secrets have a shelf life. "We attack at dawn" could be an extremely valuable military secret, but by noon tomorrow it's essentially worthless. Some secrets (e.g. those capable of identifying living agents) need to be preserved for years or decades, and it might be possible for an attacker to capture encrypted messages today and then decode them when the means to do so become available.