What was shown
The authors designed, on paper, the quantum circuit that would attack GFSPX, a lightweight cipher, meaning one built for small devices. Picture a search through an unsorted phone book: a classical computer reads page by page, while Grover's method is a quantum shortcut for exactly this kind of search. They counted every basic operation, called a gate. The attack costs 1.55×2¹⁵⁸ gates for the version labelled r=2 and 1.12×2¹⁵⁹ for r=3. NIST, the US standards body, sets Level 1 as the minimum security bar: 2¹⁷⁰ gates. An attack cheaper than that bar means the cipher fails it. Nothing was run on any machine; this is a calculation.
“The total quantum cost of the Grover attack on GFSPX is estimated at 1.55×2¹⁵⁸ for r=2 and 1.12×2¹⁵⁹ for r=3, see the last column of Table 7. Because these costs strictly fall below the 2¹⁷⁰ threshold within the allowable MAXDEPTH limits (Table 8), GFSPX fails to meet NIST’s Level 1 post-quantum security criteria.”
— Section 5, Grover Analysis of GFSPX, in: Quantum Circuit Realization and Grover Cryptanalysis of the Hybrid ARX-SPN Cipher GFSPX1
- How it was done: a calculation on paper, not run on any machine
- Qubits: The circuit needs 628 qubits, the machine's basic units, built from a 209-qubit base; the paper does not state their kind.
- Error correction: The depth estimate assumes a fault-tolerant machine, one that corrects its own errors; nothing was executed.
- Compared against classical computing: no comparison stated in the paper
Who it affects
This concerns designers and evaluators of lightweight encryption for small devices. Anyone using GFSPX with a 128-bit key learns that it does not meet NIST's Level 1 bar against quantum attackers. It does not show that any deployed system is at risk. For everyone else, nothing changes today.
Every organization that relies on public-key cryptography: no market estimate is used here. What sets the pace are official deadlines to replace today's public-key encryption: NSA by 2030 and 2035; UK National Cyber Security Centre by 2031 and 2035; European Commission by 2030; BSI and partner agencies of European states by 2030; Canadian Centre for Cyber Security by 2035. These are government deadlines, not forecasts, and they do not depend on this paper.
What is still missing
The paper's own figures set the gap. The attack costs 1.12×2¹⁵⁹ gates for r=3, against a bar of 2¹⁷⁰. It needs 628 qubits of unstated kind, and its depth estimate assumes error correction, while nothing was executed. The paper gives no classical comparison, so it does not show how this attack stacks up against one on today's computers, or that any deployed system can be broken.
Against published roadmaps: the task needs 8.18441×10⁴⁷ gates. No announcement we have on file reaches that many gates. The furthest any of them goes:
- UK Department for Science, Innovation and Technology2 (a government setting a target for its own national programme): 1 trillion gates for 2035.
An announcement is not a delivered machine, and this one would still fall short of what the task needs. Roadmaps count gates of every kind, so a machine of that size is necessary for this task but may not be sufficient.
Who is working on it
The paper (May 2026) lists its authors' affiliations as: Institute of Applied Mathematics, Middle East Technical University, Universiteler, Çankaya, 06800, Ankara, Türkiye; Department of Mathematics , Siirt University, Universite st, 56100, Siirt, Türkiye; Physics Department, Ankara University, Dogol st, 06100, Ankara, Türkiye. That is who signed this work — it is not a ranking of who is ahead.
The estimate suggests this hybrid design, which mixes two common cipher building styles, is somewhat harder to attack than comparable lightweight ciphers, yet a 128-bit key alone still falls short of Level 1.
How this brief was made
This brief was written by software, not by a person: a language model read the full text of the paper, and code then checked every quotation, number and name in this brief against that text before it was published. The rules are set out under Method. Responsible for the rules and for this page: Georg Singer. The paper is peer-reviewed, published in Physica Scripta, Vol. 101, 285103 (2026). Georg Singer holds no shares in any company or institution named in this brief (as of October 2026).