Quantum computing bombshells that are not April Fools

https://scottaaronson.blog/?p=9665

by Strilanc • 4 months ago

265 108 4 months ago

scottaaronson.blog

ChrisArchitect• 4 months ago

Discussion on the Google one,

Safeguarding cryptocurrency by disclosing quantum vulnerabilities responsibly

https://news.ycombinator.com/item?id=47582418

tombert2• 4 months ago

Here's hoping that my stock for D-Wave ends up being worth something.

Quantum computing seems super cool, but I've been a little skeptical of it actually ever yielding anything useful. I would love to be wrong, it seems neat, and I have read through a few books on the subject and played with simulators, so I'm not completely talking out of my ass here, but quantum as a whole has kind of felt like vaporware to me.

As I said, I have stock in D-Wave, obviously it would be in my best interest for quantum to end up as cool as it seems.

esseph• 4 months ago

You can rent Quantum computing time from IBM cloud today:

https://www.ibm.com/quantum/products

https://quantum.cloud.ibm.com/docs/en/guides/plans-overview

I have NOT used it, but the idea is interesting.

AlexCoventry• 4 months ago

You can rent it, but it's basically worthless at this stage.

t3122272• 4 months ago

hello,

as always: imho (!)

i've used the ibm quantum platform together with python/qiskit during my last project - which was something like: simulate quantum-networks on "real" quantum-computers...

ibm's support, introductions / documentation anbd usability of the platform is really great.

idk ... not comparable / much better than most of the quantum-computing hardware startups i know / looked at. of course, its easy if you have "deep pockets" like ibm does ... ;))

ok, back to the quantum platform:

it had a free-tier on the "old" quantum-platform - until july 2025: 10 minutes of compute on a set of machines - back then up to 127 qubits - per month ... no identification necessary / just an email-address.

sadly this "very generous" free-tier was killed of during the transition to the all new "quantum cloud platform" during spring/summer 2025 ...

and it really works like a charm :)

just my 0.02€

crispyambulance2• 4 months ago

I got some too. Obviously the principles behind quantum computing are perfectly sound. It's just those pesky engineering obstacles.

One of the companies around today or in the near future will be the one who makes it work at a practical scale. It will have enormous impact, but I think it will be a slow-burn kind of thing as making effective use of quantum computers will take a long time to evolve, IMHO.

Unfortunately, Google and IBM are also working on this stuff and they have deep pockets. They might do it, but even if they don't they may very well decide to acquire whoever does.

These stocks (IONQ, RGTI, QBTS, XNDU) are a sort of thinking-man's LOTTO ticket which will have its numbers called anytime within the next 5 to 20 years (probably closer to 20). I think they're worthwhile to hold in affordable quantities to see what happens. It might hit big, or it might fizzle out for a variety of reasons. There will also be some hype-driven market sugar-rushes along the way that are an opportunity to rake in a modest profit. This has happened already with IONQ, RGTI and QBTS earlier this year. It will certainly happen again when the patagonia-vest people get jazzed about something.

eru3• 4 months ago

You might benefit from https://en.wikipedia.org/wiki/Index_fund

bawolff6• 4 months ago

D-Wave is not making the type of quantum computers these breakthroughs would apply to, even if scaled up, as far as i know.

pathOf_aFineMan2• 4 months ago

They recently bought a more gate based quantum computing company [1]

[1] https://www.dwavequantum.com/company/newsroom/press-release/...

pmarreck• 4 months ago

Can quantum computing do even basic math yet? I think this was the holdup. Or perhaps I'm missing the point.

GeoSys2• 4 months ago

It doesn't do basic math ... just the hard one :)

bawolff6• 4 months ago

I think this was the holdup

It isn't...

qnleigh2• 4 months ago

This is a good question, and currently the answer is no. Quantum computers can only run very short, simple algorithms right now, because the qubits they're built out of are noisy. You need a lot of error correction, which the community is working on.

The thing is, unlike ordinary computers, quantum computers can factor numbers about as easily as they can multiply them. So as soon as they can multiply two large integers, they'll also be able to factor the result and break RSA encryption based on keys of that size.

This blog post gives a good sense of the state of the art and what progress might look like:

Why haven't quantum computers factored 21 yet? https://algassert.com/post/2500

Foobar85684• 4 months ago

And isn't the response already known in the validation process?

northlondoner3• 4 months ago

I think "basic math" here means arithmetic or similar. Solutions exists, but current machines are noisy:

V. Vedral, A. Barenco, and A. Ekert, Quantum net- works for elementary arithmetic operations, Physi- cal Review A 54, 147 (1996).

amluto5• 4 months ago

One thing I find rather amazing about all of this is the degree to which the Bitcoin community has tried, for years, to claim that quantum computers will be another other than a complete break.

Sure, it takes a pretty nice quantum computer or a pretty good algorithm or a degree of malice on the part of miners to break pay-to-script-hash if your wallet has the right properties, but that seems like a pretty weak excuse for the fact that the entire scheme is broken, completely, by QC.

Does there even exist a credible post-quantum proof protocol that could be used to “rescue” P2SH wallets?

Strilanc7• 4 months ago

The best proposal I have heard for rescuing P2SH wallets after cryptographically relevant quantum computers exist is to require vulnerable wallets to precommit to transactions a day ahead of time. The precommitment doesn't reveal the public key. When the public key must be exposed as part of the actual transaction, an attacker cannot redirect the transaction for at least one day because they don't have a valid precommitment to point to yet.

warkdarrior• 4 months ago

24-hour latency to make a payment? What is this, the 20th century?

amluto5• 4 months ago

That’s kind of adorable. Would you need to pay to record a commitment? If so, how? If not, what stops someone from DoSing the whole scheme?

bawolff6• 4 months ago

On the brightside at least we'll have a clear indicator for when quantum computers actually arrive.

Mistletoe• 4 months ago

If Bitcoin is broken then your bank encryption and everything else is broken also.

As far as I know quantum computers still can't even honestly factor 7x3=21, so you are good. And the 5x3=15 is iffy about how honest that was either.

https://news.ycombinator.com/item?id=45082587

Bitcoin uses 256-bit encryption, it's a universe away from 5x3=15.

Strilanc7• 4 months ago

You are assuming that progress on factoring will be smooth, but this is unlikely to be true. The scaling challenges of quantum computers are very front-loaded. I know this sounds crazy, but there is a sense in which the step from 15 to 21 is larger than the step from 21 to 1522605027922533360535618378132637429718068114961380688657908494580122963258952897654000350692006139 (the RSA100 challenge number).

Consider the neutral atom proposal from TFA. They say they need tens of thousands of qubits to attack 256 bit keys. Existing machines have demonstrated six thousand atom qubits [1]. Since the size is ~halfway there, why haven't the existing machines broken 128 bit keys yet? Basically: because they need to improve gate fidelity and do system integration to combine together various pieces that have so far only been demonstrated separately and solve some other problems. These dense block codes have minimum sizes and minimum qubit qualities you must satisfy in order for the code to function. In that kind of situation, gradual improvement can take you surprisingly suddenly from "the dense code isn't working yet so I can't factor 21" to "the dense code is working great now, so I can factor RSA100". Probably things won't play out quite like that... but if your job is to be prepared for quantum attacks then you really need to worry about those kinds of scenarios.

[1] https://www.nature.com/articles/s41586-025-09641-4

MattPalmer10862• 4 months ago

All serious financial businesses already have a quantum strategy and are actively working on transitioning their cryptography to post-quantum secure algorithms.

Bitcoin doesn't use 256 bit encryption, unless you mean 256-bit hashing. The cryptographic algorithms that are mostly under quantum threat are asymmetric, e.g. digital signatures.

bawolff6• 4 months ago

If Bitcoin is broken then your bank encryption and everything else is broken also.

Its a lot easier for your bank to change encryption methods than it is for bitcoin. Presumably you mean TLS here (where else do banks use encryption? Disk encryption?). People are already deploying experiments with quantum-proof TLS.

As far as I know quantum computers still can't even honestly factor 7x3=21, so you are good. And the 5x3=15 is iffy about how honest that was either.

This is probably the wrong way to look at it. Once you start multiplying numbers together (for real, using error corrected qubits), you are already like 85% there. Like if this was a marathon, the multiplying thing is like a km from the finish line. By the time you start seeing people there the race would already be mostly over.

honzaik• 4 months ago

1) yes, everything is affected, but everything else is being migrated to PQC as we speak

2) "256-bit encryption" has different meanings in different contexts. "256-bit security" generally refers to cryptosystem for which an attack takes roughly 2^256 operations. this is true for AES-256 (symmetric encryption) assuming classical adversaries. this is not true for elliptic curve-based algorithms even though the standard curves are "256-bit curves", but that refers to the size of the group and consequently to the size of the private key. the best general attacks use Pollard's rho algorithm which takes roughly 2^128 operations, i.e., 256-bit curves have 128-bit security.

in the context of quantum attackers, AES-256 is still fine although theoretically QCs halve the security; however its not that big of a deal in practice and ultimately AES-128 is still fine, because doing 2^64 "quantum operations" is presumed to be difficult to do in practice due to parallelization issues etc.

the elliptic curve signatures (used in Bitcoin) are attacked using Shor's algorithm where the big deal is that it is asymptotically polynomial (about O(n^3)) meaning that factoring a 256-bit number is only 256^3/4^3 = 262144x more difficult compared to factoring 15. this is a big difference from "standard" exponential complexity where the difficulty increases exponentially by factors of 2^n. (+ lets ignore that elliptic curve signatures dont rely on factoring but the problem is essentially the same because Shor does both because those are hidden subgroup problems)

the analysis is more complex but most of it is essentially in that paper and explains it nicely.

ozim• 4 months ago

Your bank doesn’t depend only on cryptography. It would be still a lot of effort to simply make transfer from a bank account. Quantum computer will not magically give an answer for a password of a hash you don’t have. TLS is moving to post quantum as we speak.

For crypto currency you have all the data you need to break whole system ready in your hands as you will be able to produce private key from public keys of wallets. Cryptocurrency depends only on cryptography.

amluto5• 4 months ago

If your bank’s encryption is broken in the future, then, to recover, you will need to change your password, and that’s all. Bitcoin does not have that luxury.

Also, your bank can switch to securing TLS with post-quantum key exchange algorithms with little difficulty and with no particular scalability or re-architecting challenges.

As for “256-bit”, the best known quantum attack against symmetric ciphers is Grover’s algorithm, and Grover’s algorithm will never break a targeted 256-bit symmetric key in the lifetime of the universe even if run by a hypothetical alien civilization with a Dyson sphere. (It might plausibly break one of many targeted keys in a multi-key attack run by advanced aliens, but this won’t steal your money and it could be easily mitigated by moving to 384 or 512 bits.)

int32_64• 4 months ago

the Bitcoin community has tried, for years, to claim that quantum computers will be another other than a complete break.

Who specifically is claiming this? Satoshi literally mentioned the need to upgrade if QC is viable on bitcointalk in 2010.

ViscountPenguin• 4 months ago

Call me crazy, but I think if bitcoin is ever broken they're more likely to move to a centralized ledger than a more secure decentralized ledger. Roughly nobody invested in bitcoin cares about the original mission, they just care about their asset prices.

eru3• 4 months ago

And the asset prices (at least partially) depend on true believers in the mission.

zeofig• 4 months ago

The problem here is the word "will". Because they don't exist.

socketcluster4• 4 months ago

Maybe it's a good time to start promoting my 5 year old, lightweight, hand-crafted, battle-tested, quantum-resistant blockchain: https://capitalisk.com/

It's about 5000 lines of custom code. Crypto signature library written from scratch.

EdwardDiego• 4 months ago

Crypto signature library written from scratch.

That's a sentence every white hat cryptography enthusiast loves to hear lol.

socketcluster4• 4 months ago

It's a very simple signature algorithm. They're welcome to try and crack it. If there is an issue with it, it shouldn't be hard to identify within those few hundred lines. Nobody found any issues in the last 5 years though.

Isn't it a good thing that there exists at least one blockchain in the world which isn't based on the same crypto library used by every other project? What if those handful of libraries have a backdoor? What if the narrative that "you shouldn't roll out your own crypto" is a psyop to get every project to depend on the same library in order to backdoor them all at once at some future date?

Strange how finance people always talk about hedging but in tech, nobody is hedging tech.

GeoSys2• 4 months ago

So does BTC need to hard fork? Good luck getting to a consensus again ...

r4indeer• 4 months ago

If QC gets to the point where breaking RSA and ECC in the real world is actually going to happen, I'd imagine you will find a consensus rather quickly.

haakon• 4 months ago

If an upgrade becomes necessary, it would be a soft fork. (Consensus would still be a challenge)

sMarsIntruder2• 4 months ago

I’m impressed by the BTC obsession: this will definitely impact the banking sector as a whole even before. Quantum FUD, here we come.

tsimionescu3• 4 months ago

The banking sector can relatively trivially move to a new encryption scheme - this is one of the huge advantages of centralized systems. Also, the banking sector, rather than trying to provide anonymity/pseudonimity, has KYC - they can relatively simply disable remote access if they think a current system is no longer secure, and get everyone to come in to a physical office and get a secure version, after manually verifying they are the rightful holder of the account.

Tldr; Bitcoin relies entirely on encryption, banking does not. So broken encryption is a catastrophe for Bitcoin, but just a bad week for banking.

freetonik5• 4 months ago

I worked at a quantum computing company that builds superconducting QC chips (so, not really applicable to one of the “bombshells” from the article). My team was designing the software stack which allows to control the QC, run quantum jobs/algorithms, and calibrate the parameters.

I’ve made two attempts to explain the work we’ve been doing and to explain the current realistic state of the industry:

1. A talk at PyCon: https://youtu.be/tT1YLP5T71Y

2. A free ebook “ Quantum Computing For Software Engineers” https://leanpub.com/quantum-computing-for-software-engineers

The company I left a few months ago is planning its IPO this year. Like almost all other quantum companies, it’s gonna be a SPAC merger, not a pure IPO. Those traded companies mentioned in the other comments are mostly SPACs as well.

sigmoid102• 4 months ago

If they're going public I imagine they already sell some kind of QC chips. But, like, who buys them? Yesterday there was a new paper [1] that shows how Shor's algorithm could break realistic encryptions with as little as 10,000 qubits (instead of millions), but as far as I know quantum hardware is still orders of magnitude below even that target. So how big can the market actually be? Shipping to universities or other QC companies for playing around with some actual hardware is nice and all, but in the end someone will be left holding the bag. There is zero profit to be made at the end of the chain.

[1] https://arxiv.org/html/2603.28627v1

freetonik5• 4 months ago

During my 3.7 years at the company, we had dozens of sales of full-stack quantum computers, chips + cryostat + control electronics + software, ranging from 5 to ~100 physical qubits. Naturally, the buyers are mostly research institutions and univercities who need a real quantum computer to do research on quantum computation and simulation (to a lesser degree with the superconducting technology, though).

(Often the research is done purely within clasically-simulated quantum computers, i.e. virtual QCs, but to verify and make the research publishable they need to run at least partial sub-problems on a real chip.)

Another, smaller, market is HPC centers. They buy and install quantum computers into existing HPC infrastructure because a) they have a few customers who need it (sometimes those same research institutions/universities), and b) they need to solve the integration problem for the future when QCs are actually used for real-world problems and big customers come to HPCs to run both classical and quantum high-performance jobs.

Here is an excerpt from my book I linked above, just to give a bit more context:

---

Since quantum computers are essentially analog devices that allow you to control, in a limited fashion, a set of quantum objects, you can do some research in foundational quantum physics. [...] Still, given the current state of the industry, classical computers outperform most quantum systems. But the research applied to smaller QCs can be scaled once the hardware scales.

Of course, the main area is quantum computing itself. From abstract, mathematical notions of algorithms to very low-level questions of calibration, many universities and research organizations are eager to have a quantum computer available to prove their theories and discover new properties. Commercial companies that deal with material science, battery technology, agriculture, and chemistry are buying quantum computers (or at least buying access to one) because they want to be ready if and when truly large-scale QCs become available. [...]

And finally, integration research. This is the least known and least discussed topic in the industry but is very important. Its significance is one of the motivations for writing this book. Quantum computers, being research tools, are not normal products. They are driven by software, like anything else, but this software changes rapidly and is rarely written with long-term evolution in mind. If you buy a quantum computer today, chances are your code will not work on any other quantum computer, or even on the next iteration of the same machine. At the same time, researchers often need to work with multiple types of machines simultaneously, and HPC (high-performance computing) centers, i.e. supercomputing data centers, want to integrate quantum computers into their existing infrastructure and provide a "quantum compute" service to their users.

freetonik5• 4 months ago

There is zero profit to be made at the end of the chain.

Think of all the "sales" that comprise such things as space missions (ones without immediate real-world use) or large hadron collider. Or any other large, expensive, long scientific project. If you measure the outcome purely in money within decades, these things can be said to be zero or negative profit.

How much profit was at the end of the chain of the current Artemis lunar mission? Well, zero or negative, but lots of companies and people up the chain made meaningful progress and made a living. Quantum computing is just like that in my opinion.

The biggest problem in my eyes is the "game" of commercialization. This technology is in early research phase, but it's so expensive and not immediately game-changing that the public funding was never enough. So, companies started to play the "we sell products" and "we do IPO" games, which IMO doesn't make sense.

regularfry• 4 months ago

At this point my bet is that the breakthrough isn't going to be qbits per chip, it's going to be entanglements-per-second in quantum networking. If you could string together simpler processors in a cluster at anything approaching interesting scales then all of a sudden the orders of magnitude become a lot less constrained and it's just a money problem.

notpublic• 4 months ago

Excellent talk!

ProllyInfamous2• 4 months ago

Thank you for posting/sharing.

My mid-sized US city (Chattanooga) has recently announced a partnership with Vanderbilt and EPB (local govt-owned fiber ISP) which creates a Quantum Computing Research Facility [$,$$$,$$$,$$$] [1].

As locals are covering this news, I keep having this thought that nobody (perhaps less than a few?) even knows what those words mean (certainly not me). You speak confidently and clearly enough that I'm incline to believe it's kind of real.

So thanks for sharing your P[0]V with this dumbass (former data center) electrician (me). All the "Quantum"-phrasing represents to me is more local job opportunities.

>@3m27s: "Quantum computing is basically trying to treat some isolated piece of the universe to behave slightly less randomly, for a very brief timeframe, so that it is useful to you when you try to solve some problem."
>@20m: [simple flow-chart of interacting with Quantum Processing Unit]
>@final.words: [paraphrasing] "Right now you buy a quantum computer simply to research quantum computers. Ours is $14MM"
>@final.meme: <https://i.imgur.com/WKaN3mL.png> [2]
>Q&A further listening recommendation: <https://www.preposterousuniverse.com/podcast/2024/05/13/275-...>
>"If you learn the examples on <https://quantum.country> you will be among top 1% of QC newhires."

[0] that quantum computing is "kind of real", which is how it always feels when being-described

[1] <https://www.vanderbilt.edu/chancellor/initiatives-and-outrea...>

[2] explain yourself (you really think you can include this slide in your presentation and then not talk about its implication(s)?!)

freetonik5• 4 months ago

The meme refers to the notion where an observation (i.e. interaction) collapses the wave function to a single value. As in, prior to observation, a system in a quantum superposition is said to be "in multiple states at the same time", and after the obsevation only one state exists, while all other possibilities are gone (or exist in other worlds, according to one of the interpretations of quantum mechanics [0]).

So, in that meme, the guy looks at one girl (the observed state) and "ignores" all other girls (all other possible states).

[0] https://en.wikipedia.org/wiki/Many-worlds_interpretation

looshch• 4 months ago

I worked at a quantum computing company

the moment i read it i immediately thought about Rakhim, then i checked your username and indeed it was you. Fun!

pyuser583• 4 months ago

Does quantum have any money making prospects?

Breaking encryption is illegal. Making encryption is difficult to profit from.

Other than that, what’s the value add?

pseudohadamard• 4 months ago

Scaring people, then selling them stuff that you claim will deal with the scare. It's practically a license to print money.

lkm0• 4 months ago

To put this in context, we've had a streak of improvements to Shor's algorithm that have put the horizon much closer. In 2022, people from Microsoft estimated that it would take more than 10M (physical) qubits to implement factoring. We're now standing at a 1000x improvement. It's still years away for sure, but who can be unhappy with all that progress?

ms paper: https://arxiv.org/abs/2211.07629

Strilanc7• 4 months ago

Caution: that 10M estimate assumes gate error rates 10x lower than the ones assumed in the papers from TFA.

jb19913• 4 months ago

This site is almost impossible to read on mobile unless you have good vision. Normally I can just hit the button in my phone browser to read it in reader mode, but this site doesn’t support that either. It’s a shame.

I am surprised that in 2026 more websites don’t seem so concerned about responsive design, especially when the goal is to read the content.

geoffbp2• 4 months ago

Reading mode in your browser…?

cubefox2• 4 months ago

Normally I can just hit the button in my phone browser to read it in reader mode, but this site doesn’t support that either.

jb19913• 4 months ago

I would love to use reading mode in my browser if this site supported it. As I noted.

cubefox2• 4 months ago

Yeah, I have the same issue (Firefox). Every website nowadays should have a responsive layout that works for smartphones.

Jbird2k• 4 months ago

iPhone user here I have a button that I can adjust the text size on this site.

jb19913• 4 months ago

which browser on iphone?

Overpower04162• 4 months ago

Sooo it’s essentially claiming that the impossible thing is essentially a bit less impossible, but currently still impossible. Nice

falcor842• 4 months ago

The whole thing is that we have proofs that this is possible, and have been seeing continuous engineering progress. Having followed this for awhile, it seems to me that saying quantum computing is "still impossible" at this stage is like saying that GTA VI is still impossible, based on its unpredictable timelines.

Overpower04162• 4 months ago

Sorry, I meant a quantum computer that is actually built where these theories can actually be applied. Current quantum computers are as useful as current nuclear fusion reactors.

I am just over any sensational headlines from the past 10 years. They really need to drop a tweet like "Check out my quantum computer that is actually useful" like Sam Altman did with GPT to convince me.

Andebugulin• 4 months ago

Feels a bit nice to live not only with the disturbance caused by unpredictability of AI, but by unpredictability of QC too, refreshing

northlondoner3• 4 months ago

Note that. The primary mechanism in error-correction paper is "selective quantum observations". It means we don't need to use all available resource but selectively error-correct. Similar idea is also recently explored in quantum chaos, whereby system is still chaotic but localisation can be observed in the ancillary system.

https://arxiv.org/abs/2512.22169v3

northlondoner3• 4 months ago

Related phenomenon is quantum Zeno Effect, https://en.wikipedia.org/wiki/Quantum_Zeno_effect Zeno Effect appears over selective observation, rather than selective states.

nebben64• 4 months ago

I'm 6 days late but if anyone reads this: what does it mean we should "upgrade now to quantum-resistant cryptography" ? If I'm using RSA am I supposed to switch to something else?

Quantum computing bombshells that are not April Fools

Related Stories