> We should start moving toward quantum-resistant cryptography now so that by the time these machines become practical, sensitive information will have fallen out of most archives.

I think we actually are. NIST already gathered submissions for post quantum crypto[0] last year.

And people like djb are also clearly interested in it[1][2].

[0] https://csrc.nist.gov/projects/post-quantum-cryptography/rou...

[1] https://blog.cr.yp.to/20170719-pqbench.html

[2] https://sphincs.org/

I know very little about the topic. Will post-quantum crypto require new hardware? The few techniques I have heard about rely on special networks capable of transmitting quantum particles, not just bits.

If new network infrastructure is required, I can't imagine how we would ever get quantum computer resistant cryptography before it's way too late.

>Will post-quantum crypto require new hardware?

No. We just need to switch from existing public-key cryptographic algorithms to quantum-resistant public-key cryptographic algorithms. There are already a variety of such algorithms developed (see https://en.wikipedia.org/wiki/Post-quantum_cryptography). All that remains is to study them further and agree on a standard.

Symmetric ciphers such as AES are already quantum-resistant for 256-bit keys. (Grover's algorithm is the best known quantum attack for such algorithms. Cracking an N-bit key classically is approximately as hard as cracking an (N/2)-bit key on a quantum computer with Grover's algorithm.)

> It would cause economic ruin, social turmoil, and worse on a huge scale.

I don't think this is true at all. No one has the capacity to store everything and governments would be the ones that come closest. Why would they cause all those bag things? It does not make sense.

I am not saying they won't use it, but it will not have nearly those effects that you list.

> No one has the capacity to store everything

Don't be so sure about that: https://en.wikipedia.org/wiki/Utah_Data_Center

1. Even if it is of infinite capacity, one datacenter will not be able to store everything. The data needs to be moved there as well.

2. My point was that there's no way NSA will use the data stored there in ways that will give the effects mentioned in the grandparent post.

The person storing it and accessing don't necessarily have to work for the same nation-state.

> I wonder whether we'll first use quantum computers to perform cryptanalysis against archived unencrypted traffic.

To break contemporary public-key crypto you need quantum computers orders of magnitude larger than anything built so far. To break something like Curve25519 you need 1600 or so logical qubits.

Are there any credible opinions on whether quantum computers will experience Moore’s Law-like exponential growth or not?

Serious question: Why would it? Isn’t “Moore’s Law” just an empirical observation about late 20th century technology that is trotted out in front of undergraduates, confusing them about what a “law” even is? There’s not a theoretical reason to expect it to apply to any other information systems is it?

Moore’s law confuses the hell out of me as a kid. It went against everything I understood about what a law meant, and it made an 8-9 year old me think that there was some mystical physical forces that essentially required processing speed to increase.

I couldn’t understand how that worked and for the longest time thought either I was really stupid, or the whole world had lost its mind promoting something that obviously could not be true.

It took a couple of years for me to realize that it simply wasn’t a “law” in the first place and to recognize differences in academic speak and popular media.

If I had left out the phrase "Moore's Law-like" would the question have been less controversial?

It's not that uncommon for new technologies to experience exponential improvement for some period of time. It doesn't seem like an unreasonable question to ask.

Moore's Law was based on past experiences, understanding of the processes and deductions about what future issues are likely to be based on current trends.

My gut feeling is that this question right now is like asking for Moore's Law in 1950.

I think it's closer to the 90s. The tooling to make very small features consistently already exists at good enough performance and they can fabricate much of this with the same systems used for traditional chips. Not the same materials being deposited, but they don't have to invent x-ray lithography and CVD/FIB/E-Beam Lithography/ALD/etc.

The hard part is figuring out the best general engineering approach, i.e. what to make the qubits out of, how to entangle them, what materials to use. Once you figure that out and do small demonstration units I'd fully expect the right design to be scalable quickly. But the actual production of the right design should be less of a barrier.

Still a barrier, but nowhere near 50s levels.

There are credible opinions about everything, including credible opinions from experts that the laws of physics won't allow quantum computers to ever operate at the scale we're talking about here.

Do you have a reference?

Thank you,

Sensitive information won't fall out of NSA's Utah facility. They will also be among the first to get quantum code breakers. There is going to be a rapture of sorts. A lot of people will disappear.

What do you mean? Are you saying that people that have aided terrorists or whatnot will be held to account? Is that a bad thing?

Without due process: yes, it is a bad thing.

Google has experimented with post-quantum algorithms too: https://security.googleblog.com/2016/07/experimenting-with-p...

Do not worry about this. The powers that control this ability also happen to control the information we receive. Thus nothing will happen that catastrophic (I hope).

The only thing THEY will gain is putting together the missing pieces of some puzzles (or discover new ones pieces/puzzles).

> cryptanalysis against archived UNencrypted traffic

What?

Gah. I meant encrypted. That's the only way the sentence makes sense. :-)