What is Shor's algorithm?
Shor's algorithm was introduced by mathematician Peter Shor in 1994. It uses quantum-mechanical principles, such as superposition and interference, to find periods in number theory. This allows it to solve the factorization problem far more efficiently than known classical methods.
Why does it matter?
- It challenges the security of RSA encryption.
- It demonstrates a concrete area where quantum computers can offer an advantage.
- It drives the development of post-quantum cryptography (new secure algorithms).
In practical terms, Shor's algorithm threatens public-key systems based on integer factorization and discrete logarithms. That includes RSA (used in many certificates, key exchange, and secure connections) and elliptic-curve cryptography such as ECDSA, which Bitcoin uses for transaction signatures. For Bitcoin, this is mainly a signature risk, not a direct break of the blockchain hash function itself.
What are the consequences if this becomes practical?
The scary part is not just "future risk." Attackers can steal encrypted data today and decrypt it later when quantum machines are strong enough. That could expose private medical records, legal files, company secrets, and government communications years after they were collected.
HTTPS/SSL impact: modern HTTPS relies on TLS with certificates and public-key cryptography (RSA or ECC) to prove a website's identity and establish secure session keys. If those algorithms become breakable, attackers could potentially impersonate trusted websites, perform man-in-the-middle attacks, and decrypt traffic that was captured earlier.
- RSA and ECC-based identity can fail: forged signatures could let attackers impersonate users, services, or software updates.
- Financial trust can be hit: payment systems and secure sessions that rely on vulnerable public-key cryptography would need urgent replacement.
- Bitcoin users face key-exposure risk: if a public key is exposed on-chain, a powerful quantum attacker could in principle derive the private key and steal funds before confirmation defenses react.
How does it work, at a high level?
- Choose a large integer to factor.
- Translate the problem into period finding.
- Use a quantum subroutine with the Quantum Fourier Transform.
- Extract the period and compute the factors classically.
In practice, this requires error-corrected quantum computers with many stable qubits.
Status in 2026
We still do not have quantum computers that can realistically break strong RSA keys at large scale. Even so, governments, organizations, and vendors are already preparing for the transition to post-quantum standards.
Tips for using symmetric encryption today
If you want practical protection right now, this app can be a useful tool: Trygg on the App Store.
- Use a long, unique passphrase for every shared file or vault.
- Share the passphrase through a different channel than the encrypted file (for example phone call vs. chat).
- Rotate passphrases regularly and never reuse old ones for new data.
- Keep app and phone OS updated to reduce implementation and device risks.
- Verify the recipient identity before sharing secrets, even if the file is encrypted.
Symmetric encryption is strong when keys stay secret, but key sharing is the weak point. Good key hygiene matters as much as the encryption algorithm itself.
Visualization: how encryption works (RSA)
Move the slider to choose a message number, then press Animate flow. This demo encrypts with a public key and decrypts with a private key.
Why Shor's breaks this: RSA security depends on multiplying two large primes being easy, while reversing that process (factoring n = p * q) is hard for classical computers. Shor's algorithm makes that reverse step efficient on a large enough quantum computer. Once an attacker factors n, they can compute Euler's totient and derive the private key d, which means ciphertext can be decrypted and signatures can be forged.
Keys used in this demo
Public key: (e = 7, n = 143)
Private key: (d = 103, n = 143)
This is intentionally tiny to make the math visible. Real RSA uses much larger values.
- 1. Sender has plaintext m = 42.
- 2. Encrypt with public key to get ciphertext c.
- 3. Receiver decrypts with private key to recover m.
Mini-FAQ
Can Shor's algorithm be used against everything today?
No, today's machines are still too small and noisy for large,
practical attacks.
Does this mean all encryption is broken?
No, but it does mean we need to gradually migrate to post-quantum
cryptography.