# How to ask for telltale signs that quantum computers become danger to classical cryptography?

I recently proposed this question: "Telltale signs that quantum computers become danger to classical cryptography?". It was closed as "primarily opinion based".

How can the question be modified to avoid that pitfall?

I think the subject has practical significance, and something on that tune is worth asking. I had tried to word the question to make answers as falsifiable as feasible:

• I'm not asking when we get to quantum computers becoming a danger to classical cryptography; I'm asking for milestones that most likely are before that;
• I try to work around the problem of secret developments by assuming we are well informed, and restricting to commercial use;
• I ask for rational arguments, with suggestions.

Any idea on how to improve the question?

• Build a quantum computer, and make the question moot! – Squeamish Ossifrage May 21 '18 at 19:16
• To clarify your original question a bit, you might have wanted to ask, "What telltale signs would prove that quantum computing has become dangerous to classical cryptography?" A strict answer to this question must be based upon facts. – Patriot May 22 '18 at 10:45
• @Patriot: interesting, but I think (A) prove is too strong, for it disqualifies something that indicates with merely fair confidence that quantum computers became capable of breaking RSA4096; (B) has implies present, when I'm after advance signs with hopefully some quantifiable delay. – fgrieu May 22 '18 at 11:02
• @fgrieu Oh, I see. Therefore: "What telltale signs would clearly indicate that quantum computers are about to become dangerous to classical cryptography?" – Patriot May 22 '18 at 12:48
• I don't think there are any, except trying to track the advance of quantum computers and mainly stable, linked qubits (which practically define the progress of QC it seems). And possibly NIST suddenly speeding up the standardization of PQC. If they deprecate ECC or RSA then it is probably too late. – Maarten Bodewes May 23 '18 at 0:04
• @Maarten Bodewes: That might not be the only way, but I like that "track the advance of quantum computers" (by the metric of how many) "mainly stable, linked qubits" (they achieve), "which practically define the progress of QC it seems". What's missing for an answer is a threshold and rationale for that, perhaps based on a Quantum Computing equivalent of Moore's law, and perhaps dependent on the classical algorithm and parametrization. There's this idea floating around that RSA4096 might stand where P-384 succumbs, because of the larger number of (q)bits. – fgrieu May 23 '18 at 14:50
• Sure, according to this answer you need upwards to double the key size / modulus of RSA and upwards of ~ six times the key size or order of the curve. And $2 * 4096 \gg 6 * 384 \rightarrow 8192 \gg 2304$. Even a 512 bit curve would only require about 3072 qubits. With a 1024 bit curve you'd be almost as secure, so maybe the brainpool team should generate one. – Maarten Bodewes May 23 '18 at 15:14
• If would be even better if a similar safe curve could be found of course. And a 768 bit one for smart cards maybe. Like this guy did (possibly with a different method of generating B though :P ) – Maarten Bodewes May 23 '18 at 15:23
• @MaartenBodewes Or just, you know, use lattice-based crypto. – forest May 25 '18 at 1:55