Organizations should prepare for a quantum computer that breaks encryption without warning by running a post-quantum migration and limiting what can be recorded on long-lived data links at the same time. This guide covers the published qubit estimates, the US deadlines, what a cryptographic inventory delivers, and how Ciena, Nokia and CyberRidge approach the problem.
Planning for a quantum computer that arrives without notice means working on two problems at once. The first is replacing the public-key algorithms that quantum computers can break, which is a multi-year project for most organizations. The second is limiting what an adversary can record from network links in the meantime, because a recording made today can be kept and attacked later. Neither track works alone. Migration replaces the algorithms that protect future traffic, and a physical-layer control limits what can be recorded on a link while that migration is underway.
This guide is written for security architects and network planners who need a reference for sequencing the work. It covers wide area network links only.
Published Qubit Estimates for Breaking RSA-2048
The estimated hardware needed to break RSA-2048 has fallen twice in seven years. The table lists each published figure and its conditions.
| Date | Source | Qubits | Conditions | Status |
|---|---|---|---|---|
| 2019 | Gidney and Ekerå | 20 million noisy qubits | About 8 hours of runtime | Cited in Gidney’s 2025 abstract |
| May 2025 | Gidney, Google Quantum AI | Fewer than 1 million noisy qubits | Under a week, 0.1 percent gate error rate | Published paper |
| Feb 2026 | Iceberg Quantum | Fewer than 100,000 physical qubits | About a month in the main configuration, non-local connectivity | Preprint, not peer reviewed per an independent review |
Between 2019 and 2025 the requirement dropped by about 95 percent. Both reductions came from new methods published in papers, with no hardware announcement beforehand.
The three figures are estimates, not working machines, and they rest on different assumptions about error rates, runtime and qubit connectivity. The Iceberg figure has not been peer reviewed. For planning purposes the useful observation is that the requirement moved through publications, so an organization watching for a hardware announcement would not have seen either change coming.
What a Cryptographic Inventory Delivers
A cryptographic inventory identifies where and how an organization uses cryptography. NIST’s National Cybersecurity Center of Excellence lists cryptographic discovery as one of two workstreams in its post-quantum migration project, and the results support decisions about where to deploy post-quantum technologies first.
An inventory covers future decisions. It does not cover traffic already sent. Encrypted traffic relies on a public-key exchange that quantum computers threaten and a symmetric cipher that they do not. AES with 256-bit keys is treated by the NSA as quantum-resistant.
An adversary who records both the traffic and the key exchange can attack the key exchange later. A CISA, NSA and NIST fact sheet names this practice harvest now, decrypt later.
Do you know Post-Quantum Encryption for Data in Transit: Implementation Guide and the Gap It Leaves Open? Watch to see how a rollout works and which gap remains.
Official Deadlines and Roadmaps
| Reference | Applies to | Date |
|---|---|---|
| Executive Order 14412 | Federal high value assets and high impact systems: post-quantum key establishment | December 31, 2030 |
| Executive Order 14412 | Same systems: post-quantum digital signatures | December 31, 2031 |
| Executive Order 14412 | Covered federal contractors: compliance rule directed | December 31, 2030 |
| NIST draft guidance | RSA-2048 deprecated, then disallowed | After 2030, after 2035 |
| IBM roadmap | 200 logical qubits, then 2,000 logical qubits | 2029, around 2033 |
National security systems are excluded from the order and follow a separate track. Enterprises outside federal work are not bound by it, though the dates serve as a pacing reference. Forecasts differ from deadlines, and Gidney does not expect a machine of this size by 2030, according to reporting on his paper.
The first three rows are policy decisions and the last two are guidance and forecasts. A policy deadline fixes when systems must be migrated. It does not fix when a capable quantum computer exists, so the two should be planned for separately.
Where Recording Still Matters
An organization that begins migrating in 2026 and finishes on the deadline still sends about four to five years of traffic under the algorithms being replaced. Recorded traffic can be kept for as long as the adversary chooses, so the uncertainty about timing does not reduce this exposure.
Photonic Layer Security (PLS) is a category of protection that changes what a tap on the fiber captures, instead of strengthening the key. It works at the physical layer, below any encryption on the link. It applies to wide area network links, meaning the long-haul and metro fiber that connects sites. Local and personal area networks are outside its scope.
The two tracks differ in what they change and where they apply.
| Question | Post-quantum migration | Physical-layer control (PLS) |
|---|---|---|
| What it changes | The algorithms used for key exchange and signatures | What a tap on the fiber captures |
| Traffic covered | Traffic sent after the upgrade is complete on a system | Traffic sent after the control is active on a link |
| Recordings already made | Unchanged | Unchanged |
| Scope | Every system that uses public-key cryptography | Wide area network links only |
Neither track alters a recording made before it was in place. Starting both early limits how much traffic ends up in that category.
Wondering whether a post-quantum upgrade covers recorded traffic? I Thought Upgrading to Post-Quantum Encryption Would Cover Us. It Doesn’t. breaks it down.
Which Links to Protect First
Prioritization follows how long the data must stay secret. Data with a short confidentiality requirement loses little if it is decrypted years later. Data with a requirement that extends past the deadlines in the table, such as long-term research, legal archives, health records, and government or defense communications, carries the most risk from recording today.
- List the wide area links that carry sensitive data.
- Rank them by the number of years the data must remain confidential.
- Protect links with requirements past 2030 first, in parallel with the migration.
Repeat the ranking when links are added or retired, since the list changes with the network.
Ciena, Nokia and CyberRidge Compared
Layer 1 optical encryption is an established category with large incumbents. The table compares the three approaches on the dimensions that matter for recording.
| Dimension | Ciena | Nokia | CyberRidge Carmel |
|---|---|---|---|
| Method | Optical-layer encryption using AES-256-GCM | Layer 1 encryption on the 1830 platform | CyberRidge states that it spreads the signal across a wide spectrum and transmits below the noise level |
| Key handling | Keys from supported post-quantum algorithms or Toshiba quantum key distribution servers, per Ciena | Central server generates keys from physical entropy and pre-shares them, per Nokia | Optical key encodes the signal phase, per CyberRidge |
| What a tap captures | Encrypted data | Encrypted data, and the platform includes optical intrusion detection | Optical noise, per CyberRidge |
| Evidence cited | August 2026 live-network trial at 1.6 Tb/s, vendor-reported | FIPS 140-3 Security Level 2 certification | Company-published specifications: no added latency, up to 100 km unamplified, post-quantum ready status in weeks |
| Relationship to migration | Hybrid support for post-quantum and quantum key distribution | Vendor-described quantum-safe approach | Described by CyberRidge as complementary to migration |
Ciena and Nokia protect the contents of the data stream, and Nokia adds tap detection. In both cases the encrypted signal remains on the fiber. CyberRidge targets the recording itself and states that Carmel works alongside encryption already on the link.
The practical question is which property a given link needs: protection of the contents, detection of tampering, or a limit on what can be recorded. The three approaches address different parts of that question, and a link can combine them.
Bottom Line
- The arrival date cannot be scheduled around, so plan without it.
- The inventory and the post-quantum migration are necessary and protect future traffic.
- Wide area links carrying long-lived data also need a control that limits recording during the migration.
FAQ
Q: When will a quantum computer be able to break RSA-2048?
A: No agreed date exists. Gidney does not expect it by 2030, and IBM’s roadmap lists 2,000 logical qubits around 2033.
Q: What is harvest now, decrypt later?
A: It is the practice of recording encrypted traffic now to decrypt it once a capable quantum computer exists, as described in the government fact sheet.
Q: Do private companies have to follow Executive Order 14412?
A: The order sets deadlines for federal agencies and directs a rule for covered federal contractors. Other organizations are not directly bound, though the dates are a useful reference.
Q: How does Carmel differ from Ciena and Nokia optical encryption?
A: Ciena and Nokia encrypt the data stream at the optical layer. CyberRidge states that Carmel transmits below the noise level so a tap captures noise.
Q: How long does Carmel take to deploy?
A: CyberRidge states that Carmel reaches post-quantum ready status in weeks, compared with years for a full cryptographic migration.
Q: Can Carmel protect traffic recorded before it was installed?
A: No. Carmel applies to traffic sent after it is active on a link, and no product can change an existing recording.