Marin Ivezic

Briefing a board on quantum risk any time soon? Join our free webinar on Monday. We go through the questions directors ask about exposure, timing, budget and accountability, and how to answer them without overstating or understating the threat. Monday, November 2, 20:00 UTC (15:00 New York). Still time to register: quantumacademy.com/webinars/

Washington has been busy on post-quantum this year. EO 14412, signed June 22: post-quantum key establishment for federal high-value systems by the end of 2030, signatures by the end of 2031. OMB M-26-15: agency migration plans due October 22. CNSA 2.0: new National Security System acquisitions compliant from January 1, 2027. And in October, GAO found that none of the 24 CFO Act agencies had fully addressed all three preparatory practices. If you work for an agency or sell to one, join our free webinar on Friday, November 13. We'll walk through what each of these requires. Then we'll look at what contractors should prepare before the FAR Council proposes its PQC rules. 18:00 UTC (13:00 Washington, 10:00 San Francisco). Free, one hour. Everyone who registers gets the recording. quantumacademy.com/webinars/ #PQC #GovCon

French quantum company @Alice__Bob estimates that 22,593 qubits could break RSA-2048 in about three days. It is the smallest estimate I have seen that runs in days. But it needs qubits nobody can build yet. The paper is serious work. The team laid out Shor's algorithm qubit by qubit on a chip of cat qubits, and the elliptic-curve version, the math behind Bitcoin keys, comes in at about an hour on at most 29,588 qubits. The condition is one assumption: no bit-flips during the run. The paper equates that with a bit-flip time of about 100 years per qubit. The best peer-reviewed measurement with quantum control is 22 seconds. Alice & Bob's own preliminary results reach 44 minutes, and about four hours on qubits it has not yet shown it can control as fully. Its largest chip with error-correction results has 12 cat qubits. The paper moves the algorithm side of the Q-Day question. Your deadlines stay where they were: NIST's final IR 8547 still deprecates RSA and ECC after 2030 and disallows them after 2035. My full analysis is postquantum.com/security-pqc…. We go through it live in a free webinar today at 15:00 UTC, and everyone who registers gets the recording: quantumacademy.com/event/web… #QuantumComputing #PostQuantumCryptography #PQC #QDay #Cybersecurity #Cryptography #QuantumSecurity #CISO #CRQC #RSA2048

Today at 15:00 UTC we run our first free webinar, on the 2026 Q-Day estimates (11:00 New York, 16:00 Berlin). If you've read this year's qubit headlines and wondered what they mean for your plans, join us. Can't make it? Register anyway and you'll get the recording. quantumacademy.com/webinars/

The EU's post-quantum roadmap has three dates. The first one is the end of this year. By then, the EU expects initial planning, asset identification and first pilots. High-risk systems by 2030, medium-risk by 2035. The roadmap is guidance to member states, not law. But if you're regulated under NIS2 or DORA, your supervisor will want to see progress, and 'we're planning to plan' won't cut it. So we're running a free webinar on Thursday, November 12, on what that first checkpoint means in practice: an inventory scope, a risk ranking, a pilot and a plan. 13:00 UTC (14:00 Brussels, 13:00 London). Free, one hour. Register and you'll get the recording. quantumacademy.com/webinars/ #PQC #NIS2

(One of) the year's biggest papers on what it takes to break RSA and ECC goes public tomorrow. I have read it. It is serious work, but it is also going to be badly misread. It changes what a codebreaking quantum computer could look like, if one big assumption holds. Expect this paper to dominate the conversation for days, including various sky-is-falling takes. Luckily, our Q-Day estimates webinar was already on the calendar for tomorrow. The paper goes public one hour before we go live. This year Iceberg Quantum, Google, Oratomic and IonQ each published careful resource estimates, and each time the headlines exaggerated. Expect the same tomorrow. We will put tomorrow's paper next to previous ones and go through: - what it actually achieved in this paper and throughout the year (and with what assumptions) - whether any of it moves Q-Day - what to tell your board when it asks, because they will Free one-hour webinar from Quantum Academy and Applied Quantum, tomorrow, 29 October, at 15:00 UTC (16:00 CET, 11:00 ET). It will be one of the first independent readings of the paper. quantumacademy.com/event/web… #QuantumComputing #PostQuantumCryptography #PQC #QDay #CyberSecurity #CISO #Cryptography #QuantumSecurity

Directors ask four questions about quantum risk. How exposed are we? When do we have to act? What will it cost? Who owns it? On Monday, November 2, we're running a free webinar on answering them well, without scaring the board and without lulling it. Regulators have made one part easier. The EU wants high-risk systems migrated by 2030, and the US wants federal high-value systems on post-quantum key establishment by the end of 2030. You can plan against those dates instead of guessing when Q-Day arrives. If you serve on a board, or brief one as a CISO or CRO, come along. Monday, November 2, 20:00 UTC (15:00 New York, 21:00 Berlin). Free, one hour. Everyone who registers gets the recording. quantumacademy.com/webinars/ #PQC #BoardOfDirectors

Every post-quantum migration team has to answer the same first question: where is all our cryptography? When GAO reviewed the 24 major federal agencies in October, only one had completed that inventory step. CISA and NIST also have a deadline. Under Executive Order 14412, they have until about March 19, 2027 to publish minimum elements for a CBOM, a cryptographic bill of materials. So on Wednesday, November 11, we're running a free webinar on building an inventory and a CBOM your migration team can actually use, including what to do when a full inventory isn't possible. If you're an architect or a PKI engineer, or you run the migration program, this one's for you. 17:00 UTC (12:00 New York, 18:00 Berlin). Free, one hour. Everyone who registers gets the recording. quantumacademy.com/webinars/ #PQC #CBOM

NIST has published the final version of IR 8547, its plan for retiring quantum-vulnerable public-key cryptography. RSA and elliptic-curve algorithms at every approved key size are now deprecated after 2030 and disallowed after 2035. What changed from the 2024 draft: - P-256, RSA-3072 and Ed25519 had no deprecation step. Now they're deprecated from January 1, 2031, like RSA-2048, and disallowed after 2035. - A deprecated algorithm can still be used, but its owner has to examine the risk and decide. I expect auditors to ask for that decision system by system. - A hybrid with at least one approved input, such as ML-KEM, can be FIPS 140-validated even after its classical half is disallowed. - HQC is the alternative KEM and ML-KEM-768 the default parameter set. NIST says it will monitor developments and adjust its transition efforts as appropriate. What NIST left open: - Key exchange and signatures get the same dates. NIST itself says harvest now, decrypt later makes key exchange more urgent. - In Section 3.1.2, NIST still lets authentication systems wait for a CRQC. Under Table 2, the same algorithms are disallowed after 2035 regardless. - Contracts, registries and archives whose signatures must stay verifiable for decades get no guidance. My full analysis: postquantum.com/security-pqc… I cover the US requirements behind these dates in PQC Compliance: United States, a course I teach at Quantum Academy: quantumacademy.com/courses/p… #PQC #PostQuantum #NIST #Cryptography #Cybersecurity #CISO #PKI #TLS

If you work in security, risk or compliance at a bank, you've had a lot of quantum-safe reading this year. The G7 Cyber Expert Group published its roadmap in January: critical systems first, 2035 as the international target. In September, CISA and the G7 Cyber Security Working Group asked organizations to build post-quantum cryptography into procurement. And on October 20, MAS and HM Treasury discussed supervisory expectations. On Wednesday, November 4, we're running a free webinar to turn all of that into one practical question: what will you show your supervisor in 2027? 13:00 UTC (13:00 London, 14:00 Frankfurt, 21:00 Singapore). Free, one hour. Everyone who registers gets the recording. quantumacademy.com/webinars/ #PQC #Banking

This Thursday we kick off a series of free webinars at Quantum Academy, run with Applied Quantum. First topic: the Q-Day estimates. In 2019, researchers put the cost of breaking RSA-2048 at about 20 million physical qubits. In February 2026, Iceberg Quantum got it under 100,000 in a simulation. In March, Google estimated under 500,000 for 256-bit elliptic curves and set 2029 as its own migration deadline. Big drops. Then again, Google's Willow has 105 physical qubits and Quantinuum's Helios has 98. On Thursday we'll go through what changed and what Google and Quantinuum actually demonstrated in October. Then we'll get to the part you care about: your migration plan. If you have to explain these numbers to a board, come along. Thursday, October 29, 15:00 UTC (11:00 New York, 16:00 Berlin). Free, one hour. Everyone who registers gets the recording. quantumacademy.com/webinars/ It's the first of 18. The full list, through February, is on the same page. #PQC #QuantumComputing

An organization with strong PQC governance and no cryptographic inventory is not ready for the post-quantum transition, whatever an averaged score says. So I rebuilt my free PQC Readiness Scorecard around one rule from my PQC Migration Framework v3.0: your readiness level is the level of your weakest domain. The scorecard rates seven domains from 0 to 5: inventory, governance, pilots and deployment, vendors, compliance, crypto-agility, and risk. You earn a level in a domain only when every question at that level and below is a Yes. Partial and Don't know never count. Every Don't know goes on a list of knowledge gaps for you to chase. Crypto-agility also gets its own headline result. An organization can be far into its migration and still unable to change an algorithm on a date it chooses. I want that gap visible. In the results you also get the dated regulatory obligations for your jurisdictions and sectors, a checklist for each domain's next level and a one-page board summary. The scorecard is free and needs no account. Your answers never leave your browser. Why I rebuilt it, and how to use it: postquantum.com/post-quantum… #PQC #PostQuantumCryptography #QuantumSecurity #CryptoAgility #Cybersecurity #CISO #RiskManagement #QuantumReadiness

A bank supervisor should be able to measure quantum-vulnerable cryptography across its whole sector without having access to any single bank's cryptographic inventory. Collecting the inventory should be the exception. Supervisors ask three kinds of questions about a sector's cryptography. How many banks still use only classical key exchange on internet-facing systems? How many run a library affected by a newly disclosed flaw? How many depend on the same HSM firmware or certificate authority? Each answer is a sum. Each bank can compute its part from its own CBOM. The FDA already works this way. It answers drug safety questions across 541.5 million patient identifiers without collecting the records themselves, because health care organizations run the same program on their own data and send back the results. A supervisor that collects every bank's CBOM creates a ranked list of the sector's weakest systems in one place. Bloomberg reported that intruders intercepted the email of about 103 regulators at the OCC, the US national bank supervisor, from mid-2023 until the OCC found them in February 2025. In my new piece I set out the methods, their limits and five things a CISO can do before the first request for a CBOM arrives: postquantum.com/post-quantum… #PostQuantum #PQC #QuantumSecurity #CBOM #Cybersecurity #BankingSupervision #FinancialServices #CISO

I now treat every quantum-beats-classical claim in biology as a simulation until the authors prove otherwise. Italian researchers reviewed 53 peer-reviewed studies, and 36 never ran on a quantum computer. The review, by Manuel Arcieri, Paolo Zuliani and colleagues at Sapienza University of Rome and the University of Tuscia, appeared in Frontiers in High Performance Computing on 24 September. Of the 36 studies without quantum hardware, 25 simulated quantum circuits on classical machines and 11 used quantum-inspired algorithms on ordinary computers. Across all 53, 41 tested toy or heavily reduced datasets. Only 16 published both code and data. All 40 studies that compared themselves with a classical method reported parity or better. The authors say none of them demonstrated a quantum advantage. The papers I checked also report losses inside. One team reports AlphaFold3 ahead of its quantum pipeline on structural accuracy for 5 of 23 protein fragments. In another study, standard machine learning beat quantum annealing in every two-class comparison trained on the full data. Exactly one study combined quantum hardware, realistic-scale data, a classical baseline, and open code and data. Its own authors say the benefit cannot be put down to quantum behavior alone, since classical simulated annealing matched or beat their D-Wave annealers in several comparisons. The test I would put to any quantum pipeline: replace the quantum step with a strong classical solver, keep everything else the same, and compare. postquantum.com/quantum-rese… #QuantumComputing #Bioinformatics #QuantumMachineLearning #ComputationalBiology #DrugDiscovery #Genomics #Reproducibility #OpenScience

A zero-knowledge proof that your vendor's software has no Log4Shell only shows that the affected log4j versions are missing from the vendor's SBOM. Whether they are also missing from the software depends on how that SBOM was produced. TU Berlin's TrustBOM, presented at EDOC 2026 in September, is the fifth design I have reviewed for sharing facts about an SBOM without sharing the SBOM, and the closest of the five to something an enterprise could install. The vendor records a commitment to each release's SBOM on a public blockchain and keeps the SBOM private. Customers then ask for proofs that specific vulnerable packages are absent, at about 0.9 seconds of GPU proving time per package. Like the four designs before it, TrustBOM assumes the SBOM is complete. A package the SBOM tool missed, or wrote under a different name, passes every check. The public code has a second problem: its verifier reads the identity of the program it checks from the vendor's own file, so a dishonest vendor could get any claim accepted. That bug takes a small change to fix, while completeness cannot be proved from the SBOM at all. If a vendor offers you zero-knowledge attestations, ask how it knows its SBOM lists everything, and ask where your verifier gets the identity of the program it checks. postquantum.com/security-pqc… #SBOM #ZeroKnowledgeProofs #SoftwareSupplyChain #SupplyChainSecurity #ThirdPartyRisk #Cybersecurity #CISO #CBOM

I haven't seen a closer rehearsal for Q-Day in the web PKI than the eMudhra CA key failure that;s making noise these days. Chrome blocked six of the eight keys in 100 minutes. Fixing Linux, runtimes, containers and IoT will take years. For 17 months, anyone with eMudhra's public certificates could compute the private keys of eight publicly trusted intermediate CAs. eMudhra traced the weak keys to a flaw in its key ceremony script (i.e. no quantum computer was involved). A researcher reported the problem on October 17 and proved control by signing a message with each key. Chrome and Firefox moved fast because Google and Mozilla push blocklists to their browsers directly. Every other verifier needs a package, an install or a rebuild. On October 20, RHEL and its rebuilds, SUSE, NixOS and Amazon Linux 2023 had only manual workarounds, and fixes for Node.js, Bun and FreeBSD were still pending. Go programs get Go's new block only when someone rebuilds them. So do Rust programs that bundle webpki-roots, and container images with stale trust stores. I expect IoT devices and appliances to be the slowest, because their trust store is part of the firmware. Fixing one takes a firmware update, which vendors ship only for models they still support. Then someone has to install it, and most people running these devices will never hear the name eMudhra. A device that doesn't check revocation will keep trusting the keys until the certificates expire, in 2028 or 2040. Removing trust is the fast direction, since every trust store can already do it. Adding trust is slower. Let's Encrypt created its own root in June 2015 and kept another CA's cross-signature in its chains until June 2024, nine years later, so that older devices would accept its certificates. On Q-Day, the owner of a CRQC could compute any RSA or elliptic-curve CA key, and one trusted classical key is enough to impersonate a site. The only clients protected that day will be the ones that already verify post-quantum certificates and have stopped accepting classical ones. This quarter I'd distrust a test CA through the normal update channels and record when each class of system stops accepting it. Rolling out a post-quantum root to the same systems will take at least that long. And every client will also need new code to verify it. postquantum.com/security-pqc… #PQC #PKI #Cybersecurity

Coinbase, which says it holds about 12% of all bitcoin, has published what it needs from Bitcoin's post-quantum signatures. Every other large bitcoin custodian should publish its own list now, while Bitcoin's developers are still choosing the schemes. Shashank Agrawal, who leads protocol security for Coinbase's on-chain development, asked for three things. A stateless signing mode, because Coinbase signs from independent servers in several zones. Output types that hide public keys until they're needed. And at least one scheme that looks promising for multi-party computation (MPC), which Coinbase uses so that no single machine holds a complete private key. Two of the three already exist in drafts. SHRINCS, a hash-based scheme drafted by Bitcoin developers, allows stateless-only signing, at about 5.8 KB of key and signature per spend. Today's Schnorr key and signature take 96 bytes. BIP-360's P2MR hides public keys until a script is used. Multi-party signing is the hard one. Threshold ML-DSA designs were published in August. A hash-based method appeared as a preprint in September. Coinbase expects full MPC for lattice schemes two to three years after its first post-quantum signing pipeline, which is due around mid-2027. Bitcoin's developers can only weigh the constraints they can see. Coinbase described one custody setup. Multisignature vaults and HSM-only signers have constraints of their own. I read Coinbase's list against the SHRINCS draft, BIP-360 and this year's threshold-signing research: postquantum.com/security-pqc… #PostQuantum #PQC #Bitcoin #Coinbase #Cryptography #DigitalAssets #Custody #QuantumSecurity

QuIC, Europe's quantum industry association, wants faster EU export licensing for quantum technology. I agree with most of its requests, but its paper gives no figure for how long licensing takes. QuIC's members report lost customers and high legal fees. Some say customs officers sent files back because they could not verify a classification, which added weeks to a single shipment. The members have not said how long they wait, how often or at which step, so QuIC cannot show which of its requests would win back the most time. The Commission's own annual report on the Dual-Use Regulation has no processing times either. France publishes an average of 30 calendar days for individual dual-use licenses. The UK publishes quarterly medians, 18 and 16 working days on its two licensing systems in the first quarter of 2026, and missed its own target. British exporters can see by how much. QuIC's members do not need to wait for Brussels. They have the application and decision dates for every license they have filed since the EU-wide quantum controls took effect in November 2025. With medians and 90th percentiles by member state and destination, the Commission could see the typical wait and the cases that cost contracts. The Commission's Export Control Forum in Brussels on November 20 would be a good place to show them. postquantum.com/quantum-poli… #QuantumComputing #QuantumTechnology #ExportControls #DualUse #TradeCompliance #EUPolicy #QuantumIndustry #Europe

Quantinuum announced a quantum error-correction record on Monday. It is a great result, but in my view it does not bring a CRQC / Q-Day any closer. Despite what some comments and media proclaim. On its Helios machine, the team protected one logical qubit, built from 73 physical qubits, through repeated rounds of error checking. It failed about five times per million rounds. Each time the team enlarged the code, the error rate fell about twelvefold on average. On Google's Willow chip in 2024, the error rate fell about twofold per step. With errors falling that fast, a trapped-ion machine would need far fewer physical qubits for each error-corrected qubit. By my arithmetic, each logical qubit would need about 660 physical qubits in Quantinuum's layout to fail only once in a trillion rounds, roughly twelve times fewer than at Willow's 2024 rate. Each round of error correction on Helios takes about a fifth of a second, against 1.1 microseconds on Willow. IonQ estimated last month that 19,397 trapped ions could recover one Bitcoin private key in about 26 days per attempt, assuming 200-microsecond operations. Rescaled to the speed of Helios's gates today, each attempt would take about 12 years. To finish an attack in weeks, a trapped-ion machine would need operations more than a hundred times faster than Helios's. After this paper, I would lower the qubit estimate for a trapped-ion attack and leave the time estimate where it was. My full analysis postquantum.com/industry-new… #QuantumComputing #QuantumErrorCorrection #PostQuantumCryptography #PQC #Cybersecurity #QDay #Quantinuum #CISO