Go Maintainer Warns: Quantum Computers Will Break All Current Encryption Within Three Years

The world faces an imminent cryptographic crisis that could render virtually all digital security obsolete within three years, according to a stark warning from one of the technology industry's most respected security experts.

Filippo Valsorda, the current maintainer of the cryptography library in the Go programming language and former lead of the Go Security team at Google, has joined a growing chorus of voices sounding the alarm about quantum computing's threat to global cybersecurity. His warning comes at a time when the technology industry is already grappling with AI's massive resource demands and geopolitical tensions, yet this cryptographic threat remains largely under the radar.

(Image credit: Getty Images)

The Three-Year Timeline That Changes Everything

Valsorda's assessment represents a dramatic acceleration of previously accepted timelines. Where experts once believed there was until 2035 to prepare for quantum-resistant cryptography, new developments have compressed that window to just three years.

"That other article is now wrong," Valsorda stated, referring to his own earlier work. "We don't have the time if we need to be finished by 2029 instead of 2035."

This compressed timeline means the computing world must undergo a complete cryptographic overhaul in roughly one-tenth the time previously anticipated. The implications are staggering: every secure connection, encrypted file, digital signature, and blockchain transaction currently protected by today's encryption methods could become vulnerable to quantum attacks within this short window.

Why Current Encryption Will Fail

Today's most widely used encryption methods, particularly Elliptic Curve Cryptography (ECC), rely on mathematical problems that are computationally difficult for classical computers to solve. However, quantum computers operate on fundamentally different principles that make these problems trivial.

Quantum computers leverage quantum mechanical phenomena like superposition and entanglement to perform certain calculations exponentially faster than classical computers. For cryptographic purposes, this means problems that would take classical computers billions of years to solve could potentially be cracked by sufficiently powerful quantum computers in hours or minutes.

The Cryptocurrency Catastrophe

One of the most immediate concerns highlighted in recent reports, including those from Google engineers, is the vulnerability of all cryptocurrency systems. Digital currencies like Bitcoin and Ethereum rely heavily on cryptographic signatures for transaction verification and wallet security.

If quantum computers can break these signatures, attackers could potentially forge transactions, steal funds from wallets, and completely undermine the trust model that makes cryptocurrencies function. Given the hundreds of billions of dollars in value tied up in cryptocurrency markets, this represents an existential threat to the entire sector.

The Bandwidth and Performance Problem

Transitioning to post-quantum cryptography isn't simply a matter of swapping algorithms. The new quantum-resistant methods come with significant performance penalties that could impact virtually every aspect of digital infrastructure.

Consider a typical secure website connection using X.509 digital certificates. With current ECC methods, the key exchange requires only tens of bytes for transmitting signatures. Switch to post-quantum methods, and that figure balloons to multiple kilobytes—a 100x to 1000x increase in data transmission.

This massive increase has cascading effects:

• Bandwidth consumption: Every secure connection requires more data transfer
• Latency: Larger certificate chains mean slower connection establishment
• Storage: Systems must store larger keys and certificates
• Processing power: Post-quantum algorithms are computationally more intensive

The IoT Challenge

Internet of Things devices present a particularly thorny problem. Many IoT devices operate with severely constrained resources—limited memory, minimal storage, and low processing power. These constraints were designed around today's efficient cryptographic methods.

Post-quantum cryptography may be simply infeasible for many existing IoT devices. A smart thermostat, security camera, or industrial sensor that cannot handle the larger keys and increased computational demands of post-quantum methods may become permanently insecure or require complete replacement.

Critical Infrastructure at Risk

Valsorda specifically called out trusted execution environments as particularly vulnerable. Intel's SGX (Software Guard Extensions) and AMD's SEV-SNP (Secure Encrypted Virtualization-Secure Nested Paging) technologies provide hardware-based security for sensitive computations and data protection.

If quantum computers can break the encryption protecting these environments, it would compromise the security of cloud computing, secure enclaves, and any system relying on hardware-based isolation. This could expose everything from financial transactions to government secrets to potential quantum attacks.

The "Harvest Now, Decrypt Later" Threat

Perhaps most concerning is the "harvest now, decrypt later" strategy that sophisticated adversaries may already be employing. Intelligence agencies and cybercriminals could be collecting encrypted data today with the expectation that they'll be able to decrypt it once quantum computers become powerful enough.

This means that sensitive information being transmitted today—diplomatic communications, trade secrets, personal data, medical records—could already be compromised, even if the encryption appears secure by current standards. The three-year timeline means this data could be exposed within the operational lifetime of many organizations.

The Hard Cut vs. Gradual Transition Debate

Valsorda advocates for an immediate, uncompromising transition to post-quantum cryptography, arguing that "any non-PQ key exchange should now be considered a potential active compromise." He dismisses hybrid approaches that combine classical and post-quantum methods as counterproductive "band-aids" that will only slow down the necessary transition.

This represents a significant shift from the gradual, transitional approaches that many in the industry have been pursuing. The argument is that partial measures create a false sense of security while delaying the full transition needed to protect against quantum threats.

What Needs to Happen Now

The transition to post-quantum cryptography requires coordinated action across the entire technology ecosystem:

Software Developers must begin implementing post-quantum algorithms immediately, even if it means accepting performance penalties in the short term. Libraries and frameworks need to support both classical and post-quantum methods during the transition period.

Hardware Manufacturers need to design new processors and devices with post-quantum cryptography in mind, optimizing for the performance characteristics of these new algorithms.

Standards Bodies must finalize and promote post-quantum cryptographic standards, ensuring interoperability across different systems and vendors.

Organizations need to inventory all systems using cryptography, assess their vulnerability to quantum attacks, and develop migration plans that account for the performance and compatibility challenges.

Governments may need to mandate post-quantum cryptography for critical infrastructure and provide guidance and support for the transition.

The Path Forward

The cryptographic community has been working on post-quantum algorithms for years, and several promising candidates have emerged. The National Institute of Standards and Technology (NIST) is currently in the process of standardizing post-quantum cryptographic algorithms, with final standards expected in the coming years.

However, the compressed timeline means that even with standards in place, implementation and deployment must happen at an unprecedented pace. The transition from RSA to ECC took over a decade; moving to post-quantum cryptography must happen in a fraction of that time.

Why This Matters Now

While the technology industry focuses on AI advancements, semiconductor manufacturing challenges, and geopolitical tensions, the quantum cryptography threat represents a foundational challenge to digital security that affects every aspect of modern life.

From online banking and e-commerce to secure communications and national security, cryptography underpins the trust that makes the digital world function. A failure to address this threat could undermine confidence in digital systems and potentially cause economic and social disruption on a massive scale.

The three-year timeline isn't a distant future concern—it's within the operational planning horizon for most organizations. Companies developing products with multi-year lifecycles, governments planning infrastructure upgrades, and individuals relying on digital services all need to factor this threat into their immediate planning.

As Valsorda's warning makes clear, the time for gradual preparation has passed. The computing world faces a hard deadline, and the consequences of missing it could be catastrophic for global cybersecurity.

The cryptographic community now faces its most significant challenge since the invention of public-key cryptography. Whether the industry can mobilize quickly enough to meet this threat remains one of the most critical questions in technology for the coming years.