Wut. This is just false. D-Wave provides the "quantum computers" that others have and they're completely irrelevant when it comes to breaking ECC (or RSA, for that matter; ECC is broken by a variant of Shor's algorithm, which is used to break RSA). They're quantum annealing chips, not general-purpose quantum computers; they literally can't run Shor's algorithm, now or ever.

We're orders of magnitudes out (qubit-wise, on real quantum computers) from breaking RSA or ECC in practice, and the difficulty level is on the same order for both.

I'm not convinced that D-Wave's hardware is relevant to anything beyond D-Wave's profits. It's neat that their technology works, I guess, but it isn't clear at this point that it does anything better than a classical computer could.

I'm actually a cryptography engineer. RSA encryption standards are hard to implement correctly. Frequently they contain padding oracles. There are safe ways to do RSA people don't do in standards.

ECC eschews all that complexity. Writing a safe ECC implementation especially for Edwards or Montgomery curves is pretty simple.

PGP is mortebund and has a lot of cruft.

RSA does some things that are really cool like accumulators, Pallier, etc. But if you are doing them you are doing black magic.

That comment goes off the rails once it starts talking about quantum computers breaking encryption (and only ECC, not RSA).

Yes, (real) Quantum computers can break ECC and RSA encryption. I have no idea why they think the NSA (and apparently Google as well) has secret Quantum Computers that are capable of breaking ECC, but not RSA.

Not to say I agree with that comment. But I think the case for why ECC would be easier to break than RSA using quantum computing is that key sizes of ECC are much smaller so would require less qbits to break.

You can break a 160 bit EC with a 1000 qubit quantum machine. An equivalent 1024 RSA bit key needs about 2000 qbuits. (The following paper has a cool table and formula for working out how many you need for each)

https://arxiv.org/pdf/quant-ph/0301141.pdf

My incredulity is in the idea that Google and the NSA apparently have 1000 qubit machines that can do that, but not 2000 qubit ones (and you should be very confident that will remain the case in future).

Note that once you're at the "I have a stable 1000 qubit machine that can perform complex calculations" realm, you can consider doing things like entangling it with that other 1000 qubit machine you have lying around, bringing yourself rapidly into the 2000 qubit realm. Getting to the first part is really hard. If you can pull that off, you're probably only a few years away from the second. The main thing that's stopping us from doing that today is that the (physcial) qubits we've made so far aren't stable enough; getting to a single logical qubit is anticipated to take 1000 physical ones.

https://en.wikipedia.org/wiki/Physical_and_logical_qubits

The few thousands qubits that you mentioned is logical qubits. With error correction you need tens of millions of physical qubits to break RSA or ECC.

Google and NSA can produce more of the same thing. But they probably have no major secret sauce for things such as error correction that the public does not have.

Curves are 2 to 3 times easier to break than RSA using Shor's algorithm on a hypothetical quantum computer but that is not enough of a factor to really make a difference.