Hanoi (VNA) - Quantum computers are closer than ever. The year 2026 has been internationally designated the "Year of Quantum Security" -- and the window to prepare is closing fast.
For over 70 years, global digital security has rested on a mathematical assumption that seemed unassailable: factoring large integers is computationally intractable. This is the bedrock of RSA -- the algorithm protecting banking transactions, medical records, email, and defence communications across the world. That assumption is now under serious threat.
| 28-49% CRQC Probability / 10 yrs Global Risk Institute 2025 | ~2030 Q-Day Forecast Forrester & Google Quantum AI | x10 Qubit Reduction for RSA-2048 Google, UC Berkeley, Stanford 2025-26 | 42-54 mo. Enterprise PQC Migration Industry estimate |
I. WHAT IS A QUANTUM COMPUTER -- AND WHAT DOES IT DO TO INFORMATION?
A classical computer processes information in bits -- the smallest unit, taking only one of two values: 0 or 1. Every banking transaction, email, and medical record ultimately reduces to a sequence of these binary digits.
A quantum computer operates on entirely different principles, exploiting two strange phenomena from quantum mechanics:
- Superposition: A qubit -- the quantum unit of information -- can exist simultaneously in both state 0 and state 1, until it is measured. Think of a coin spinning in the air: it is both heads and tails at once, until it lands. With n qubits, the computer can process 2-to-the-n states simultaneously.
- Entanglement: Qubits can be linked together such that the state of one instantly influences another, regardless of distance. This enables coordinated parallel computation at a scale that has no classical equivalent.
The result: rather than testing possibilities one by one like a classical computer, a quantum computer explores billions of possibilities simultaneously -- like navigating a maze by trying every path at once, rather than one turn at a time.
For encryption, a classical computer is like a thief trying every key on a lock one at a time. A quantum computer tries all of them simultaneously. -- A common illustration in quantum science education
I-A. WHAT DOES A QUANTUM COMPUTER DO TO ENCRYPTED INFORMATION?
Today, all sensitive information -- banking passwords, patient records, corporate email, and military communications -- is protected by encryption algorithms such as RSA and ECC. Their strength rests on a single mathematical challenge: multiplying two large prime numbers together is easy, but working backwards from the product to find the original primes is effectively impossible for a classical computer -- requiring billions of years of computation. This is the lock protecting the entire global digital economy.
A quantum computer breaks that lock using two specific algorithms:
- Shor's Algorithm (1994): Uses superposition and entanglement to factor integers in polynomial time. Instead of billions of years, the computation takes hours. This completely breaks RSA, ECC, and Diffie-Hellman -- that is, the entire asymmetric encryption infrastructure currently in use.
- Grover's Algorithm (1996): Accelerates search by the square root, reducing the effective security of AES-128 to the equivalent of AES-64 -- cutting symmetric encryption strength in half.
To put this concretely: RSA-2048 -- the current standard protecting the majority of internet traffic -- would require the world's best classical computer approximately 300 trillion trillion years to crack. A sufficiently powerful quantum computer could achieve the same result in under 24 hours.
II. A VERIFIED THREAT: THE SHIFT OF 2025-2026
In 1994, mathematician Peter Shor proved that a sufficiently powerful quantum computer could break RSA in polynomial time. Then in 2025-2026, three landmark papers from Google, UC Berkeley, and Stanford fundamentally changed the picture: the quantum resources required to break RSA-2048 dropped by an entire order of magnitude from all previous estimates.
While current NISQ-era quantum computers (1,000-10,000 physical qubits, high error rates) are not yet capable of breaking encryption, the next generation -- FTQC (Fault-Tolerant Quantum Computers) with millions of physical qubits equivalent to thousands of logical qubits -- represents the threshold at which Q-Day becomes possible.
III. Q-DAY: WHEN, AND HOW SERIOUS?
Q-Day is defined as the moment when a CRQC (Cryptographically Relevant Quantum Computer) becomes powerful enough to break RSA and ECC within 24 hours. According to the Global Risk Institute's 2025 report, 26 leading experts assess the probability of a CRQC emerging within 10 years at 28-49%, and within 15 years at 51-70%.
"Q-Day could arrive as early as 2029 -- drastically narrowing the preparation window previously predicted by cybersecurity specialists. When Q-Day arrives, decryption will no longer take billions of years -- but hours or days." -- CNN, May 17, 2026
2026 forecasts from Forrester and Google Quantum AI suggest Q-Day may arrive five years sooner than the previous 2035 estimate. Google has announced its 2029 target to "secure the quantum era" with post-quantum cryptography.
IV. "HARVEST NOW, DECRYPT LATER" -- A PRESENT-TENSE THREAT
This is the most dangerous strategy that many organisations are overlooking: threat actors -- including nation-states -- are already collecting and storing encrypted data today, waiting until quantum computers are powerful enough to decrypt it. The HNDL (Harvest Now, Decrypt Later) strategy makes the PRESENT the moment of risk -- not the future.
Data with the longest security lifespans faces the greatest risk:
- Medical records: requiring confidentiality for 50+ years
- Financial records: spanning decades
- National intelligence: multi-generational sensitivity
Healthcare, financial, defence, and government organisations must begin migrating to PQC today -- not next year.
V. THE TECHNICAL SOLUTION EXISTS: NIST 2024 STANDARDS
On 13-14 August 2024, the US National Institute of Standards and Technology (NIST) published the first three post-quantum cryptography standards, secure against both classical and quantum computers:
- FIPS 203 (ML-KEM/Kyber): Key encapsulation
- FIPS 204 (ML-DSA/Dilithium): Digital signatures
- FIPS 205 (SLH-DSA/SPHINCS+): Hash-based signatures
In June 2025, President Trump signed an executive order requiring federal agencies to accelerate PQC deployment. The US Department of Defense set a 2030 migration deadline. The NSA requires all national security systems to be quantum-safe by January 2027.
The European Union is developing a "Quantum-Safe-by-Design" framework. Realistic enterprise migration timelines are estimated at 42-54 months -- meaning organisations that do not begin today will not complete the transition before Q-Day arrives.
VI. STRATEGIC IMPLICATIONS FOR VIETNAM
Vietnam is entering a phase of deep digital transformation, with a national strategy for AI and the digital economy targeting 2030. This presents both a challenge and a rare opportunity: new digital infrastructure being built now can -- and should -- be architected from the ground up with PQC, rather than facing the cost and complexity of migration later.
Priority sectors for immediate PQC deployment:
- National electronic banking and payment systems (Napas, VietQR)
- National population and health databases
- Defence and security information systems
- 5G telecommunications infrastructure
As the WEF emphasised in May 2026, the transition to quantum-safe security CANNOT be treated as a routine software update -- it depends on every layer of the digital ecosystem, from vendors to supply chains. Integrating PQC into Vietnam's national information security legal framework is a strategic step that cannot be delayed.
VII. THREE PRIORITY ACTIONS EVERY ORGANISATION MUST TAKE NOW
Drawing on hands-on experience deploying quantum cloud computing systems, IMG Innovations recommends three concrete actions:
- Cryptographic Inventory: Catalogue all algorithms, keys, protocols, and sensitive data currently in use across your systems.
- HNDL Risk Assessment: Identify which data requires the longest-term confidentiality and is therefore most exposed to collection today.
- PQC Migration Roadmap: Deploy FIPS 203/204/205 per NIST 2024 standards, prioritising systems holding the most sensitive data.
CONCLUSION
Quantum computers are not a distant threat -- they are a countdown clock whose second hand is accelerating. The HNDL strategy ensures that data encrypted today is already being collected for future decryption. This is a problem of the PRESENT.
The world already has the technical answer: NIST's 2024 PQC standards provide a solid foundation. What is lacking is speed and determination in deployment. Organisations, governments, and enterprises must act now -- before Q-Day transforms from a warning into a catastrophe./.
