Naru News日本語

Home › Why questions › Quantum

No Code-Breaking Quantum Computer Exists Yet. So Why the Rush Now?

Video published November 11, 2026 (9 min 17 sec) · Checked October 30, 2026 · 7 min read

"The chance of a code-breaking quantum computer being built in the next 10 years is low." That's what a US government watchdog (GAO) report, released in October 2026, says.

Yet in the very same sentence, it goes on: for unprepared government systems, the impact could be catastrophic to the nation's economy and security.

A quantum computer big enough to actually break the locks widely used today doesn't exist anywhere in the world yet. So why the rush, for a machine that doesn't exist yet?

First guess

“Because once the machine is finished, it'll be too late to switch to safer encryption?”

Half right. Replacing the locks really does take years. But there's more to it. Before the machine even exists, what happens to everything we're sending right now?

Answer

Because today's traffic can be harvested now and decrypted later, once the machine exists, and because replacing the locks takes years.

For example, if a secret must stay safe for 10 years after it is sent and the switch takes 5, some secrets can't be kept if the machine arrives sooner than 15 years from now (these years are made-up examples to show the idea).

That's why the switch has already begun: with servers that support it, desktop Chrome since 2024 and the iPhone since iOS 26 can use a double lock that combines the old method with a new one.

Watch the video (9 min 17 sec)

Chapters (13)

Full transcript0:00Not here yet, but "catastrophic"?NaruThe chance of a code-breaking quantum computer being built in the next 10 years... is low.
NaruThat's what a US government watchdog report, released in October 2026, says. And in that very same sentence, it goes on...
NaruFor unprepared government systems, the impact could be catastrophic to the nation's economy and security.
NaruA quantum computer big enough to actually break the locks widely used today doesn't exist anywhere in the world yet.
NaruWhy the rush, for a machine that doesn't exist yet?
NaruThe Chief is the type who worries quantum computers will wipe out humanity. When he heard this, he turned pale, thinking, 'This is it.'
ChiefGo find out!
NaruHe wants me to find out whether we really need to rush.
NaruTurns out, this story reaches all the way into your phone.
NaruNaru News!
0:56How today's lock worksNaruFirst, how today's lock works. Multiplying two big prime numbers is easy. But finding those primes again from the answer is very hard.
NaruOne widely used lock relies on exactly that gap.
1:11Trying it on the Chief's MacNaruWe tried it on the Chief's Mac.
NaruMultiply the two 10-digit primes we picked, and you get a 20-digit answer. The multiplication took less than a millionth of a second.
NaruNow, finding the original two from that 20-digit answer, by trying one divisor after another, took...
NaruAbout two minutes.
NaruAnd with more digits? In 2020, when a team of researchers cracked a 250-digit number, it took the equivalent of 2,700 years on a single processor core.
NaruAnd a widely used lock uses numbers 617 digits long. Far, far beyond 250.
1:531994: what Shor's shortcut really isNaruBut then, 1994. Mathematician Peter Shor showed that a quantum computer could take a shortcut through this search. More than 30 years ago.
NaruThe key to the shortcut is repetition. Let's try it with a small number.
NaruSay we want to split 15 back into its two primes. Start at 1 and keep doubling. Whenever you pass 15, subtract 15.
Naru1, 2, 4, 8. Next is 16, so subtract 15, and we get 1. After four steps, we're back where we started.
NaruGo halfway, two steps in, where we had 4, and multiply it by itself. Half plus half makes exactly four steps. So 4 times 4 is 16, the number we just subtracted 15 from. Exactly one more than 15.
NaruLine up 16 balls in a 4-by-4 square, and take one away: 15 left. Move the bottom 3 over to the right, and you get 3 rows of 5. 15 is 3 times 5. There are the original primes!
NaruThe same idea gets 3 and 17 out of 51. Even for huge numbers, once you know how many steps it takes to come back, an ordinary computer can quickly work out the primes. If that doesn't work, you start over, tripling instead of doubling, for example.
NaruThe hard part is finding that number of steps. With a 617-digit number, the number of steps to come back can be astronomically large. Counting one by one would never finish, and no fast way to find it on an ordinary computer is known.
NaruThat's where a quantum computer comes in. Sound is a repeating vibration too. Your ear can tell a pitch without counting each vibration, right? In the same way, a quantum computer doesn't count one by one. It uses overlapping waves to bring out clues to the length of the repeat.
NaruBut the parts a quantum computer calculates with are error-prone. No machine has yet been built that's big enough to correct those errors and crack 617 digits.
4:00First report, rejectedNaruGot it! If the machine doesn't exist yet, we can just change the locks once it does. We'll make it in time!
ChiefRejected!
Naru...He says, so what happens to everything we're sending right now?
4:12Answer 1: harvest now, decrypt laterNaruHere's the first answer: harvest now, decrypt later.
NaruCollect encrypted traffic now and store it away. Then open it once a code-breaking machine exists.
NaruIt's like stealing a safe you can't open, locking it away in a warehouse, and waiting for the day you can make a key.
NaruSo secrets that need to stay secret for years, like state secrets or medical records, may already be targeted today, by a machine that doesn't even exist yet!
4:42Answer 2: replacing locks takes yearsNaruThen why not just change the locks right now?
NaruThe second answer: replacing the locks takes years.
NaruResearcher Michele Mosca thinks in three spans of time. How long the secret must stay secret. How long replacing the locks takes. And how long until the machine arrives.
5:01QuizNaruQuiz time!
NaruEvery secret must stay safe for 10 years after it is sent. Replacing the locks takes 5. What if a code-breaking machine arrives in 12 years? A: The switch starts first, so everything is safe. B: Some secrets can't be protected. C: Everything is exposed the day it arrives.
NaruThe answer is B: some secrets can't be protected.
NaruThe switch finishes in year five. Focus on the last secret sent under the old lock, just before that.
NaruIt also needs ten years of secrecy after it's sent. So its deadline is about fifteen years from now.
NaruBut if the machine arrives in year twelve, that secret is opened three years before its deadline.
NaruSo: ten plus five, fifteen years. If the machine comes sooner than that, some secrets can't be kept.
6:00What "low within 10 years" really saysNaruSo when will the machine come? Remember that opening sentence: the chance within 10 years is low.
NaruBut the same report also says estimates vary. In the 2024 expert survey it cites, asked about the chance of it arriving within 15 years, by around 2039, 21 of 32 experts picked the 'about 50 percent' answer or a higher one.
Naru2039 is 13 years from now, in 2026. That's sooner than the 15 years in our example.
Naru'Low within 10 years' never said '15 years is fine.'
6:46Answer 3: it has already begunNaruSo when does the switch to new locks begin?
NaruThe third answer: it already has.
NaruIn August 2024, the US standards agency standardized a new, quantum-resistant way to agree on the keys for a connection.
NaruIts foundation isn't prime multiplication, but the problem of recovering a secret from calculations with small, deliberately added errors.
NaruNo shortcut for it has been found, even with a quantum computer.
NaruBut what if the new method has a hidden flaw? So for now, it's combined with the old way of agreeing on keys, and the connection's key is made from both. A double lock, so to speak.
NaruIf a weakness turns up in the new one, the old method's protection still stands.
7:38Your phone, tooNaruDesktop Chrome, since 2024. The iPhone too, since iOS 26. With servers that support it, both can use this double lock.
NaruAnd in September 2026, of the browser traffic reaching Cloudflare, a major company that relays internet traffic, about 70 percent was already on the new lock, on the stretch to Cloudflare.
NaruIn other words, your phone's connections may already be switching to the new lock, without you even noticing!
NaruAnd you can check for yourself. Cloudflare's 'Radar' page shows whether this browser's current connection to Cloudflare is using the new lock. The link is in the description.
NaruKeep your phone and computer up to date. The new locks arrive with the updates, and start being used with servers that support them.
8:35What we learnedNaruWhy rush now, for a machine that doesn't exist yet? Because today's traffic can be harvested now and decrypted later. And because replacing the locks takes years. That's why the switch has already begun. Naruhodo!
Chief...Without anyone noticing, huh.
NaruAnd the Chief approved it! He says he'll put his worries about humanity on hold, for now.
8:58Did you know?NaruDid you know the switch to new locks had already begun? Tell us in the comments.
NaruThis has been Naru News!
NaruIf you went 'naruhodo!', please hit like and subscribe!

Explained in pictures

61 × 53 = 3233 is easy and instant; finding the two originals from 3233 is very hard. A common lock relies on this gap — How today's lock works (the numbers are just an example). In the top row, multiplying two primes (61 and 53) takes an instant. In the bottom row, finding the original two from the answer, 3233, becomes very hard once the numbers are big. The lock on the right relies on exactly that gap. A widely used lock uses numbers 617 digits long, and on the Chief's Mac, just recovering two primes from a 20-digit answer by trial division took about two minutes.

15 balls in 3 rows of 5, after taking one away from 16. 15 = 3 × 5 — The key to Shor's shortcut, repetition, tried on a small number. Start at 1, keep doubling, and subtract 15 whenever you pass 15: 1, 2, 4, 8, 1. After four steps, you're back where you started. Go halfway, two steps in, where we had 4, and multiply it by itself: 16, exactly one more than 15. So line up 16 balls in a 4-by-4 square, take one away, and move the bottom 3 (orange) over to the right. You get 3 rows of 5, so 15 = 3 × 5. There are the original primes.

A thief carrying a safe nobody can open toward a warehouse lined with safes — An analogy for "harvest now, decrypt later." Encrypted traffic is like a safe nobody can open. The thief steals it, locks it away in a warehouse, and waits for the day a key can be made. In the same way, encrypted traffic collected and stored today can be opened once a code-breaking machine exists. So secrets that need to stay secret for years, like state secrets or medical records, may already be targeted today, by a machine that doesn't even exist yet.

A 20-year timeline: the switch takes 5 years, the last secret sent just before it must stay safe until year 15, and a machine arriving in year 12 leaves a red 3-year gap — The answer to the video's quiz, as a timeline (the years are made-up examples to show the idea). Orange is the 5-year switch. The last secret sent under the old lock, just before it finishes, needs 10 years of secrecy (the navy bar), so its deadline is year 15. But if the machine arrives in year 12 (the purple line), that secret is opened three years before its deadline (the red part). Ten plus five is fifteen: if the machine comes sooner than that, some secrets can't be kept.

A timeline from 2026 to 2045: 2039, the year in the survey, is 13 years from now, before the example's year 15 — The year from the survey, placed on a timeline. In the 2024 expert survey the report cites, asked about the chance of a code-breaking machine arriving within 15 years, by around 2039, 21 of 32 experts picked the 'about 50 percent' answer or a higher one. 2039 (orange) is 13 years from now, in 2026. That's sooner than the 15 years in our example (navy). 'Low within 10 years' never said '15 years is fine.'

The classic method's lock and the new method's lock, with arrows from both to the session key. A double lock, so to speak — How the switch works today. On the left is the old way of agreeing on keys; on the right, the new, quantum-resistant way standardized in August 2024. What if the new method has a hidden flaw? So for now they are combined, and the connection's key (yellow) is made from both. A double lock, so to speak. If a weakness turns up in the new one, the old method's protection still stands.

Checking on Cloudflare Radar whether this browser's current connection uses the new lock. Only the stretch from the browser to Cloudflare can be seen — How to check your own browser. The "Browser support" section of Cloudflare Radar (radar.cloudflare.com/post-quantum) shows whether this browser's current connection to Cloudflare uses the new lock. The orange line at the bottom is the only stretch you can see. It tells you nothing about the dotted stretch beyond, and it does not judge your other apps or sites.

More details

Why is today's lock hard to break?

One widely used lock (RSA) relies on a gap: multiplying two big primes is easy, but finding those primes again from the answer is very hard.

On the Chief's Mac, multiplying the two 10-digit primes we picked took under a millionth of a second. Recovering them from the 20-digit answer by trial division took 118 seconds, about two minutes.

When a team of researchers cracked a 250-digit number in 2020, it took the equivalent of 2,700 years on a single processor core. A widely used lock (2048-bit) uses numbers 617 digits long.

What is the quantum computer's shortcut?

In 1994, mathematician Peter Shor showed that a quantum computer could take a shortcut through factoring and discrete logarithms. The shortcut works on public-key encryption built on these, such as RSA and elliptic-curve cryptography, not on all encryption.

The key to the shortcut is repetition. Even for huge numbers, once you know how many steps it takes to come back, an ordinary computer can quickly work out the primes. With 51, for example, doubling comes back after 8 steps. Halfway, at 4 steps, we have 16, and the factors 51 shares with 16's neighbors, 15 and 17, are 3 and 17. If that doesn't work, you start over, tripling instead of doubling, for example.

The hard part is finding that number of steps. With a 617-digit number, it can be astronomically large. Counting one by one would never finish, and no fast way to find it on an ordinary computer is known.

Sound is a repeating vibration, and your ear can tell a pitch without counting each vibration. In the same way, a quantum computer doesn't count one by one. It uses overlapping waves to bring out clues to the length of the repeat.

But the parts a quantum computer calculates with are error-prone. No machine has yet been built that's big enough to correct those errors and crack 617 digits.

What is "harvest now, decrypt later"?

It means collecting encrypted traffic now, storing it away, and opening it once a code-breaking machine exists. The report warns of this risk too.

That's why "we can just change the locks once the machine exists" doesn't work. What we're sending right now could be collected before the locks are changed.

How do you work out whether there's enough time?

Researcher Michele Mosca thinks in three spans of time: how long the secret must stay secret, how long replacing the locks takes, and how long until the machine arrives. If the first two added together are longer than the third, data sent before the switch may not stay secret long enough.

Anything sent after the switch is on the new lock, so the risk is to secrets sent under the old lock before the switch finishes. The 10, 5, and 12 years in the video's quiz are made-up numbers to show the idea.

When will the machine arrive?

The report, released in October 2026 (based on an audit that ran through September 2025), says the chance within 10 years is low, but it also says estimates vary.

The Global Risk Institute survey it cites (December 2024) asked how likely a quantum computer able to break 2048-bit RSA within 24 hours is to be built within 15 years of the survey, by around 2039. 21 of 32 experts picked the 'about 50 percent' answer or a higher one.

What's different about the new lock?

In August 2024, the US standards agency (NIST) finalized quantum-resistant standards. ML-KEM, for key agreement, isn't built on prime multiplication. Its foundation is the problem of recovering a secret from calculations with small, deliberately added errors (a lattice problem, Module Learning with Errors).

No shortcut for this problem has been found, even with a quantum computer, and it is, at present, believed to be secure even against adversaries with a quantum computer.

Has my phone already switched?

It may have started to. Desktop Chrome has enabled hybrid key agreement, the old method combined with the new one, by default since 2024. Since iOS 26, the iPhone advertises support for the same hybrid (X25519MLKEM768) in TLS 1.3 by default. In both cases, it is used only when the server supports it and picks it.

In September 2026, about 70 percent of browser traffic reaching Cloudflare, a major company that relays internet traffic, was protected by this hybrid on the stretch from the browser to Cloudflare.

The new locks arrive with the updates and start being used with servers that support them. Keep your phone and computer up to date.

Takeaway

With encryption, don't look only at when the machine arrives. Add up how long secrets must stay safe and how long replacing the locks takes. That's why the switch has already begun.

Sources and how we checked

AI wrote this page from the video script and the sources above. A different AI from the one that wrote the script checked it against the text of those sources (October 30, 2026). A person with a master’s degree in science and a Japanese high-school science teaching license also read and checked it before publishing. Numbers are as of that date. If anything was hard to follow, you spot a mistake, or there’s a question you’d like us to look into, please write to [email protected].

Next questions