What was shown
The authors worked out, on paper, what it would cost to attack everyday symmetric ciphers with a quantum method called Simon's algorithm. Think of a song with a hidden beat: instead of testing every note in turn, the method listens for the repeating pattern and reads the secret from it. The paper presents the first complete implementation of this approach and estimates its price for Chaskey, PRINCE and Elephant. Chaskey and PRINCE look especially vulnerable, and the attack is almost a million times cheaper than quantum key search. Against Elephant it ends up more expensive than exhaustive search. Nothing was run on any machine.
“We find that PRINCE and Chaskey are especially vulnerable to this attack, requiring only 2⁶⁵ qubit operations to recover the key. For comparison, Shor’s algorithm requires 2³¹ similar operations to break RSA-2048.”
— Section 1 Introduction, Our Contributions, in: Quantum Period Finding against Symmetric Primitives in Practice1
- How it was done: a calculation on paper, not run on any machine
- Qubits: The attack needs less than 4 times as many error-protected qubits as breaking RSA-2048, but many more operations.
- Error correction: The estimate assumes a large fault-tolerant machine, one that corrects its own errors while it computes.
- Compared against classical computing: The cost is compared with generic quantum collision attacks and quantum exhaustive key search; no classical attack was run.
Who it affects
This concerns people who design or run systems built on symmetric ciphers such as PRINCE or Chaskey, especially where secrets must stay safe for a long time. For daily operations nothing changes today, because no machine can run this attack. But data captured now could be attacked later, so systems using Even-Mansour or FX constructions with long-term security needs should plan their migration now.
Every organization that relies on public-key cryptography: no market estimate is used here. What sets the pace are official deadlines to replace today's public-key encryption: NSA by 2030 and 2035; UK National Cyber Security Centre by 2031 and 2035; European Commission by 2030; BSI and partner agencies of European states by 2030; Canadian Centre for Cyber Security by 2035. These are government deadlines, not forecasts, and they do not depend on this paper.
What is still missing
The attack needs a fault-tolerant quantum computer, meaning a machine that corrects its own errors, and no such machine exists. It must also run far more operations than the machine that breaks RSA-2048: 2⁶⁵ for PRINCE and Chaskey, against 2³¹ for RSA-2048. The qubit count is the smaller hurdle, less than 4 times that of RSA-2048. The missing piece is the sheer number of operations such a machine can carry out.
Against published roadmaps: the task needs 3.68935×10¹⁹ gates. No announcement we have on file reaches that many gates. The furthest any of them goes:
- UK Department for Science, Innovation and Technology2 (a government setting a target for its own national programme): 1 trillion gates for 2035.
An announcement is not a delivered machine, and this one would still fall short of what the task needs. Roadmaps count gates of every kind, so a machine of that size is necessary for this task but may not be sufficient.
Who is working on it
The paper (November 2020) lists its authors' affiliations as: Institute for Quantum Computing, Department of Combinatorics and Optimization, University of Waterloo, Canada; Department of Materials, University of Oxford, UK. That is who signed this work — it is not a ranking of who is ahead.
This result weakens symmetric designs built on Even-Mansour and FX constructions, or relying on data limits and small state sizes. It favours designs with large state sizes and key schedules, like PRINCE v2.
How this brief was made
This brief was written by software, not by a person: a language model read the full text of the paper, and code then checked every quotation, number and name in this brief against that text before it was published. The rules are set out under Method. Responsible for the rules and for this page: Georg Singer. The paper is a preprint that has not been peer-reviewed. Georg Singer holds no shares in any company or institution named in this brief (as of October 2026).