Quantum Computing on kenji.blog

An Ultra-Beginner Guide to Quantum Programming with Qiskit

Fri, 11 Sep 2026 20:00:00 +0900

1. Introduction

Modern computers (classical computers) have dramatically changed our lives, supporting every aspect of society with their advanced computational power. However, it is known that for certain specific problems (such as factoring extremely large numbers, simulating complex molecular structures, and optimization problems), even the most cutting-edge supercomputers of today would require a time longer than the age of the universe.

What holds the potential to break through these “limits of classical computers” is the Quantum Computer. By utilizing the mysterious properties of quantum mechanics (superposition and quantum entanglement) as computational resources, it is believed that specific problems can be dramatically accelerated.

In this article, we will take our first steps into the world of quantum programming using Qiskit, an open-source quantum computing framework provided by IBM. This is an extremely detailed introductory guide that carefully explains everything from the basics of physics and mathematics, to actually writing code in Python and running quantum circuits on a simulator.

2. Fundamentals of Physics and Mathematics Behind Quantum Computing

To understand quantum programming, you first need to grasp the basic concepts of quantum mechanics. Here, we will explain the three important pillars: qubits, superposition, and quantum entanglement.

2.1 Classical Bits and Qubits (Quantum Bits)

The unit of information in classical computers is the “Bit”. A bit always takes one of two states: 0 or 1.

On the other hand, the smallest unit of information in a quantum computer is called a Qubit (Quantum bit). A qubit can not only take the state of 0 and 1, but it can also hold both states simultaneously.

Mathematically, the state of a qubit $|\psi\rangle$ is represented as a linear combination (superposition) of the basis states $|0\rangle$ and $|1\rangle$.

$$ |\psi\rangle = \alpha|0\rangle + \beta|1\rangle $$

Here, $\alpha$ and $\beta$ are complex numbers, representing the probability amplitudes of observing the states $|0\rangle$ and $|1\rangle$, respectively. Based on the fundamental principles of quantum mechanics, the sum of probabilities must equal 1, thus satisfying the following normalization condition:

$$ |\alpha|^2 + |\beta|^2 = 1 $$

graph LR A["Classical Bit"] --> B["Determined state: 0 or 1"] C["Qubit"] --> D["Superposition: Both 0 and 1"] D --> E["State is determined probabilistically by measurement"]

2.2 Superposition

As mentioned earlier, the state where $|0\rangle$ and $|1\rangle$ are mixed together is called Superposition.

For example, when a single qubit is in a perfectly equal superposition state, $\alpha = \frac{1}{\sqrt{2}}$ and $\beta = \frac{1}{\sqrt{2}}$.

$$ |\psi\rangle = \frac{1}{\sqrt{2}}|0\rangle + \frac{1}{\sqrt{2}}|1\rangle $$

When this state is measured, $|0\rangle$ and $|1\rangle$ are observed with a 50% probability each. If you have 2 qubits, you can create a superposition of 4 states: $|00\rangle, |01\rangle, |10\rangle, |11\rangle$. With $n$ qubits, $2^n$ states can be represented simultaneously, which is one of the sources of the parallel processing power of quantum computers.

2.3 Quantum Entanglement

The most powerful and mysterious property in quantum computing is Quantum Entanglement. This phenomenon, which Einstein called “spooky action at a distance,” is a property where two or more qubits become strongly linked to each other. When the state of one qubit is determined, the state of the other qubit is instantaneously determined, no matter how far apart they are physically.

One of the most famous quantum entangled states, the “Bell State”, specifically the $\Phi^+$ state, is expressed as follows:

$$ |\Phi^+\rangle = \frac{|00\rangle + |11\rangle}{\sqrt{2}} $$

In this state, the states $|01\rangle$ and $|10\rangle$ do not exist. Therefore, if the first qubit is measured and is $|0\rangle$, the second qubit is guaranteed to be $|0\rangle$ without even needing to be measured. Conversely, if the first is $|1\rangle$, the second will also necessarily be $|1\rangle$.

3. Quantum Logic Gates

Just as classical computers perform calculations using logic gates like AND, OR, and NOT, quantum computers also manipulate the state of qubits using Quantum Gates. Since a quantum state is a vector, a quantum gate is represented as a “unitary matrix” acting on that vector.

3.1 Pauli Gates (Pauli-X, Y, Z)

Pauli gates are fundamental operations on a single qubit.

・Pauli-X Gate (NOT Gate) Equivalent to the classical NOT gate. It flips $|0\rangle$ to $|1\rangle$, and $|1\rangle$ to $|0\rangle$. (A 180-degree rotation around the X-axis on the Bloch sphere)

$$ X = \begin{pmatrix} 0 & 1 \\ 1 & 0 \end{pmatrix} $$

・Pauli-Y Gate Performs a 180-degree rotation around the Y-axis. It has the effect of flipping both the phase and the bit.

$$ Y = \begin{pmatrix} 0 & -i \\ i & 0 \end{pmatrix} $$

・Pauli-Z Gate (Phase Flip Gate) Leaves the state of $|0\rangle$ as is, but flips the phase of the $|1\rangle$ state (multiplies by $-1$). (A 180-degree rotation around the Z-axis)

$$ Z = \begin{pmatrix} 1 & 0 \\ 0 & -1 \end{pmatrix} $$

3.2 Hadamard Gate

The Hadamard gate (H gate) is an extremely important gate that transforms a determined state ($|0\rangle$ or $|1\rangle$) into a superposition state.

$$ H = \frac{1}{\sqrt{2}} \begin{pmatrix} 1 & 1 \\ 1 & -1 \end{pmatrix} $$

Applying the H gate to $|0\rangle$ results in $|+\rangle$, which is an equal superposition state.

$$ H|0\rangle = \frac{1}{\sqrt{2}}|0\rangle + \frac{1}{\sqrt{2}}|1\rangle = |+\rangle $$

3.3 Phase Gates

Phase gates are a generalization of the Z gate, rotating the phase of the $|1\rangle$ state by a specified angle $\theta$.

$$ P(\theta) = \begin{pmatrix} 1 & 0 \\ 0 & e^{i\theta} \end{pmatrix} $$

Typical examples include the S gate ($\theta = \pi/2$) and the T gate ($\theta = \pi/4$).

3.4 CNOT Gate (Controlled-NOT Gate)

The CNOT gate (CX gate) is a gate that performs an operation between two qubits and is essential for generating quantum entanglement. It consists of a “Control bit” and a “Target bit”.

Only when the control bit is $|1\rangle$, an X gate (NOT operation) is applied to the target bit; if the control bit is $|0\rangle$, nothing happens.

$$ CNOT = \begin{pmatrix} 1 & 0 & 0 & 0 \\ 0 & 1 & 0 & 0 \\ 0 & 0 & 0 & 1 \\ 0 & 0 & 1 & 0 \end{pmatrix} $$

4. Basics of Qiskit and Environment Setup

From here on, we will actually write quantum programs using Python and Qiskit.

4.1 What is Qiskit?

Qiskit is an open-source software development kit (SDK) for quantum computing developed by IBM Quantum. Using Python, you can intuitively build quantum circuits and run them on a local simulator or on actual IBM quantum computers via the cloud.

4.2 Installation Method

To use Qiskit, a Python environment is required. You can install Qiskit and related packages (simulator and drawing libraries) with the following command:

1

pip install qiskit qiskit-aer qiskit-ibm-runtime matplotlib pylatexenc

4.3 Basic Flow of Programming

Quantum programming using Qiskit mainly progresses through the following steps:

graph TD A["1. Build (Construct the circuit)"] --> B["2. Compile (Transpile/Optimize)"] B --> C["3. Execute (Run on backend)"] C --> D["4. Analyze (Results analysis and visualization)"]

Build: Create a QuantumCircuit object and add gates to it.
Compile: Optimize the circuit for the backend (actual hardware or simulator) to be executed on.
Execute: Send the job to the backend and retrieve the results.
Analyze: Plot histograms of the measurement results, etc.

5. Practice: Building a Circuit to Create a Bell State (Quantum Entanglement)

Let’s actually create the “Quantum Entanglement (Bell State)” we learned in theory using Qiskit. The target state is $|\Phi^+\rangle = \frac{|00\rangle + |11\rangle}{\sqrt{2}}$.

5.1 Circuit Design

To create a Bell state, we follow these steps:

Prepare two qubits (both initially in the $|0\rangle$ state).
Apply a Hadamard gate (H) to the first qubit to create a superposition state.
Apply a CNOT gate with the first qubit as the “Control bit” and the second qubit as the “Target bit”.
Perform a Measurement to read the result.

5.2 Python/Qiskit Code Implementation

Now, let’s look at the actual code.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


import numpy as np
from qiskit import QuantumCircuit, transpile
from qiskit_aer import Aer
from qiskit.visualization import plot_histogram
import matplotlib.pyplot as plt

# 1. Circuit Initialization
# Create a quantum circuit with 2 qubits and 2 classical bits
qc = QuantumCircuit(2, 2)

# 2. Applying the H Gate
# Apply a Hadamard gate to qubit 0 (q0)
qc.h(0)

# 3. Applying the CNOT Gate
# Apply CNOT using q0 as the control bit and q1 as the target bit
qc.cx(0, 1)

# 4. Measurement
# Measure qubits 0 and 1, and write the results to classical bits 0 and 1, respectively
qc.measure([0, 1], [0, 1])

# Draw the circuit diagram (using matplotlib)
# qc.draw('mpl')
print(qc.draw())

When you execute this code, the following quantum circuit diagram will be displayed as ASCII art on the console.

1
2
3
4
5
6
7


 ┌───┐ ┌─┐
q_0: ┤ H ├──■──┤M├───
 └───┘┌─┴─┐└╥┘┌─┐
q_1: ─────┤ X ├─╫─┤M├
 └───┘ ║ └╥┘
c: 2/═══════════╩══╩═
 0 1

H represents the Hadamard gate, the combination of ■ and X is the CNOT gate, and M represents measurement.

5.3 Execution on Simulator and Interpretation of Results

Next, we will run this circuit on IBM’s high-performance simulator Aer and check the results.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


# Get the Aer simulator backend
simulator = Aer.get_backend('qasm_simulator')

# Transpile (optimize) the circuit for the simulator
compiled_circuit = transpile(qc, simulator)

# Execute the circuit (here, running 1000 shots)
job = simulator.run(compiled_circuit, shots=1000)

# Retrieve the result
result = job.result()

# Get the observation counts for the states
counts = result.get_counts(compiled_circuit)
print("\nMeasurement results:", counts)

# Plotting the histogram
# plot_histogram(counts)
# plt.show()

Interpretation of Results

The console output should look something like this: Measurement results: {'00': 495, '11': 505} (*Note: Because probabilities are random, the numbers will fluctuate slightly with each execution.)

In an ideal simulation environment, the measurement results will show 00 and 11 observed roughly 50% of the time each, with 01 and 10 never being observed. This completely matches the theoretical prediction of the Bell state $|\Phi^+\rangle = \frac{|00\rangle + |11\rangle}{\sqrt{2}}$ that we created. It accurately simulates “quantum entanglement” where if the first qubit is 0, the second is always 0, and if the first is 1, the second is always 1.

Furthermore, when executed on an actual quantum computer (IBM Quantum Hardware), 01 and 10 might be observed slightly due to the influence of noise (quantum decoherence and gate errors). How to reduce this noise (quantum error correction) is one of the biggest challenges in current quantum computer development.

6. Scaling Up to More Advanced Algorithms

Creating a Bell state can be considered the “Hello World” of quantum programming. By expanding upon this, we can construct powerful algorithms that surpass classical computers.

6.1 Deutsch-Jozsa Algorithm

This is a problem to determine whether a given function $f(x)$ is a “constant function” (always outputs 0 or always outputs 1 regardless of input) or a “balanced function” (outputs 0 for half of the inputs and 1 for the other half). While a classical computer requires at worst $2^{n-1} + 1$ evaluations of the function, the Deutsch-Jozsa algorithm can determine it with just 1 evaluation by utilizing quantum parallelism. This demonstrates the basic pattern of quantum algorithms: inputting a superposition state, using interference to cancel out unnecessary states, and amplifying the desired answer.

6.2 Grover’s Algorithm

In the search problem of finding specific data from $N$ unsorted database elements, a classical algorithm requires an average of $N/2$ computations, whereas Grover’s algorithm can find the target data in $\sqrt{N}$ computations. This algorithm uses a black box called an “Oracle” to flip the phase of the target solution, and further applies “Amplitude Amplification” to dramatically increase the probability of observing the target solution.

graph TD A["Initialization (Superposition of all states)"] --> B["Oracle (Flip phase of the correct answer)"] B --> C["Diffusion Operator (Amplitude amplification by inversion about the mean)"] C --> D{"Reached sufficient probability?"} D -- "No" --> B D -- "Yes" --> E["Measurement"]

7. Conclusion and Future Learning

In this article, we started with fundamental concepts of quantum computing such as superposition and quantum entanglement, and explained in detail the manipulation of quantum logic gates using Qiskit, up to actually constructing and simulating a Bell state and interpreting the results.

Because Qiskit allows you to write in a familiar language like Python, it is a powerful tool that helps you focus on algorithm construction by overcoming mathematical and physical barriers. Although quantum computers are currently in the era of Noisy Intermediate-Scale Quantum (NISQ) devices, applied research is rapidly advancing worldwide in numerous fields such as Quantum Machine Learning, Quantum Chemistry simulations, and cryptography.

By all means, take this opportunity to create various quantum circuits using Qiskit and try running them on actual IBM Quantum processors. You should be able to experience the computing paradigm of the future firsthand.

References

Qiskit Official Documentation
Qiskit Textbook - An official textbook recommended for those who want to learn deeper mathematical backgrounds and algorithms
IBM Quantum Learning

Welcome to the quantum world!

What is Quantum Supremacy? Latest Trends from Google and IBM

Fri, 11 Sep 2026 18:00:00 +0900

1. Introduction: The Dawn of Quantum Computing and “Quantum Supremacy”

Quantum computing has the potential to solve complex problems that cannot be solved within a realistic timeframe by classical computers (the PCs and supercomputers we use daily) by applying quantum mechanics, the fundamental principle of physics, to information processing. For a long time, this field was primarily focused on theoretical research, but in recent years, rapid hardware advancements have intensified the race toward practical application.

One of the most attention-grabbing keywords in this context is “Quantum Supremacy.” This refers to the moment when a quantum computer demonstrates overwhelming computational power over classical computers in a specific computational task. In this article, starting from the strict definition of quantum supremacy, we will provide a detailed technical and mathematical deep dive into the 2019 experiment by Google’s “Sycamore” processor—which was announced as the first in the world to reach this milestone—as well as IBM’s rebuttal and unique approach, and the latest roadmap towards “Quantum Error Correction (QEC)” and “Fault-Tolerant Quantum Computing (FTQC),” which represent the biggest barriers to true practical application.

2. Theoretical Background: Fundamentals of Quantum Computing and Complexity Classes

To understand quantum supremacy, it is first necessary to understand the mathematical foundations of quantum computing and its position in computational complexity theory.

Qubits and Superposition

While the smallest unit of information in a classical computer is a bit (0 or 1), a quantum computer uses a qubit (Quantum bit). The state $|\psi\rangle$ of a single qubit is represented by a complex linear combination of the basis states $|0\rangle$ and $|1\rangle$.

$$ |\psi\rangle = \alpha|0\rangle + \beta|1\rangle $$

Here, $\alpha, \beta \in \mathbb{C}$, and they satisfy the normalization condition $|\alpha|^2 + |\beta|^2 = 1$. This property is called “Superposition.”

Entanglement and Tensor Product

When there are multiple qubits, the state of the entire system is represented by the tensor product of the state spaces of the individual qubits. A system of $n$ qubits becomes a vector on a $2^n$-dimensional Hilbert space $\mathcal{H}^{\otimes n}$.

$$ |\Psi\rangle = \sum_{x \in \{0, 1\}^n} c_x |x\rangle $$

Here, $\sum |c_x|^2 = 1$. A state where qubits are not independent, and the state of one depends on the other, is called “Quantum Entanglement.” This gives quantum computers the potential to simultaneously process an exponentially vast state space.

Computational Complexity Theory Definition of Quantum Supremacy

In computational complexity theory, the class of problems that classical computers can solve efficiently (in polynomial time) is called BPP (Bounded-error Probabilistic Polynomial time). On the other hand, the class of problems that quantum computers can solve efficiently is BQP (Bounded-error Quantum Polynomial time).

Demonstrating quantum supremacy means “executing a specific task on actual quantum hardware that is included in BQP but not in BPP (or is extremely likely not to be), and surpassing simulation by classical supercomputers in terms of time and resources.” It can be considered a historical attempt to falsify the extended Church-Turing thesis (“Any physically realizable computational model can be simulated by a probabilistic Turing machine in polynomial time”) through physical experiment.

3. 2019: Google’s Demonstration of Quantum Supremacy

In October 2019, the Google Quantum AI team announced in the scientific journal Nature that they had achieved quantum supremacy using a 53-qubit superconducting processor called “Sycamore.”

Architecture of the Sycamore Processor

The Sycamore processor consists of 54 transmon superconducting qubits arranged in a 2D grid (53 were used in the experiment as one was malfunctioning). Tunable couplers are placed between adjacent qubits, realizing fast and highly accurate two-qubit gates (a hybrid of iSWAP and controlled-Z gates).

graph TD A["Quantum Algorithm Input"] --> B["Sycamore Processor (53 Qubits)"] B --> C["Apply Random Quantum Gates"] C --> D["Measure Quantum States (Bitstrings)"] D --> E["Cross-Entropy Benchmarking (XEB)"] E --> F["Verify Quantum Supremacy"]

Random Circuit Sampling (RCS)

The task Google chose was “Random Circuit Sampling.” This involves applying randomly chosen single-qubit gates and two-qubit gates over multiple cycles (depth $m$), and sampling from the probability distribution of bitstrings obtained by measuring the final state.

The probability of a bitstring $x$ output from an ideal (noise-free) random quantum circuit is not a uniform distribution, but exhibits an interference fringe-like pattern called a Porter-Thomas distribution. To sample from this distribution on a classical computer requires simulating the entire state vector, and the computational complexity increases exponentially with respect to the number of qubits $n$ and the circuit depth $m$.

Evaluating Fidelity: Linear Cross-Entropy Benchmarking (XEB)

To prove that the experimental results were not just noise, but the results of actual quantum computation, Google used Linear Cross-Entropy Benchmarking (XEB). The ideal probability $P(x_i)$ of the circuit for the bitstring $x_i$ obtained in the experiment is calculated using a classical computer, and the fidelity $\mathcal{F}_{\text{XEB}}$ is obtained by the following formula:

$$ \mathcal{F}_{\text{XEB}} = 2^n \langle P(x_i) \rangle_{i} - 1 $$

If $\mathcal{F}_{\text{XEB}}$ is 0, it means complete noise, and if it is 1, it means an ideal quantum processor without noise. The Sycamore processor achieved $\mathcal{F}_{\text{XEB}} \approx 0.002$ (0.2%) for a circuit with depth 20. At first glance, this seems low, but it is a statistically significant value above zero, representing an astonishing achievement of controlling a state space of $2^{53} \approx 9 \times 10^{15}$.

The overall error rate was approximately modeled as the product of individual gate errors, measurement errors, etc.

$$ \mathcal{F} \approx (1 - e_1)^{N_1}(1 - e_2)^{N_2} \cdots \approx \prod_{g \in 1Q} (1 - e_g) \prod_{g \in 2Q} (1 - e_g) \prod_{q} (1 - e_{RO}) $$

(* $e_g$ is the gate error, $e_{RO}$ is the measurement error)

Google claimed that it would take a classical supercomputer (Summit) about 10,000 years to simulate this circuit. In contrast, Sycamore completed the sampling in just 200 seconds.

4. IBM’s Rebuttal: From “Supremacy” to “Utility”

Google’s announcement shocked the world, but IBM, which developed the world’s largest supercomputer “Summit” and is itself a leader in quantum computer development, immediately published a paper rebutting this claim.

Improving Classical Simulation via Tensor Network Contraction

The core of IBM’s rebuttal was that “the optimization of algorithms and resources on the classical computer side was insufficient.” Google assumed a state vector simulator that directly calculates the time evolution of the Schrödinger equation and came up with the 10,000-year estimate. However, IBM pointed out that the simulation time could be dramatically reduced by using a method called a “Tensor Network.”

In a tensor network, the gate operations of a quantum circuit are represented as operations on multi-dimensional arrays (tensors), and the order of network “contraction” is optimized. Furthermore, they claimed that by fully utilizing Summit’s massive 250 PB of storage (hierarchical disk and memory), a higher-precision simulation would be possible in just “2.5 days” while maintaining the entire state vector.

Quantum Advantage and Quantum Utility

Triggered by this debate, the trend in the entire industry shifted from merely adhering to “executing artificial tasks impossible for classical computers (Supremacy)” to a phase of “demonstrating a practical advantage over classical approaches in useful real-world problems (Quantum Advantage),” and further to “quantum computers functioning as new tools for scientific discovery (Quantum Utility).”

IBM itself avoided the word “Supremacy” and advocated “Quantum Volume” and “CLOPS (Circuit Layer Operations Per Second)” as comprehensive performance metrics for quantum processors, promoting development that emphasizes a balance between hardware scale and quality.

timeline title "The Evolution of Quantum Milestones" 2019 : "Google Sycamore (53Q)" : "Quantum Supremacy announcement" 2019 : "IBM Rebuttal" : "Summit supercomputer simulation in 2.5 days" 2021 : "IBM Eagle (127Q)" : "Breaking the 100-qubit barrier" 2022 : "IBM Osprey (433Q)" : "Advancing processor scale" 2023 : "Google Surface Code" : "Scaling error correction (d=3 to d=5)" 2023 : "IBM Quantum Utility" : "Complex spin model simulation on 127Q" 2024 : "Beyond" : "Logical Qubits and Error Mitigation era"

5. The Next Frontier: Error Mitigation and Quantum Error Correction (QEC)

Current quantum computers are called “NISQ (Noisy Intermediate-Scale Quantum),” and they are susceptible to noise (errors due to interactions with the external environment or imperfect control). When performing long computations, the results get buried in noise. There are broadly two approaches to overcoming this problem: “Error Mitigation” and “Quantum Error Correction.”

Error Mitigation

Error mitigation is a method to remove the effects of noise from the expected values of calculation results through classical post-processing without changing the quantum hardware. In 2023, IBM achieved a precision that surpassed state-of-the-art approximate tensor network methods in a time evolution simulation of a complex Ising model by combining its 127-qubit “Eagle” processor with error mitigation techniques such as “Zero-Noise Extrapolation (ZNE),” thereby demonstrating “Quantum Utility.”

Quantum Error Correction (QEC) and Logical Qubits

However, to ultimately run any arbitrary complex algorithm (e.g., Shor’s factoring algorithm or complex quantum chemistry calculations), error mitigation alone is insufficient, and “Quantum Error Correction (QEC),” which dynamically detects and corrects errors, is essential.

The mainstream approach for QEC is the “Surface Code.” This is a method where multiple physical qubits (data qubits) are arranged in a 2D grid, and measurement qubits (ancilla qubits) are placed between them to continuously perform parity checks called “Stabilizers.”

graph LR Q1["Data Qubit (Data)"] --- M1["Measure X Stabilizer (Ancilla)"] Q2["Data Qubit (Data)"] --- M1 Q3["Data Qubit (Data)"] --- M2["Measure Z Stabilizer (Ancilla)"] Q4["Data Qubit (Data)"] --- M2 M1 --> EC["Error Syndrome Decoding (Classical)"] M2 --> EC EC --> LQ["Logical Qubit State Update"]

The Threshold Theorem and Distance $d$

A “Threshold Theorem” exists in quantum error correction. When the error rate $p$ of physical qubits is below a certain threshold $p_{th}$ (around 1% for the surface code), increasing the code distance $d$ (allocating more physical qubits to a single logical qubit) can exponentially reduce the logical error rate $p_L$.

The approximate formula for the logical error rate is expressed as follows:

$$ p_L \approx \Lambda \left( \frac{p}{p_{th}} \right)^{\frac{d+1}{2}} $$

Here, $\Lambda$ is a constant. If $p < p_{th}$, increasing $d$ makes $p_L$ smaller. However, if $p > p_{th}$, increasing physical qubits conversely accumulates noise, worsening the logical error rate.

Google’s 2023 Milestone: Demonstrating Error Reduction by Scaling Distance

In February 2023, Google published a monumental paper in Nature. They became the first in the world to demonstrate that when expanding the distance of the surface code from $d=3$ (using 17 physical qubits) to $d=5$ (using 49 physical qubits) using their 3rd generation Sycamore processor, the logical error rate slightly decreased from 3.028% to 2.914%.

This means they have stepped into the region where $p < p_{th}$, showing that the most important Proof of Concept towards FTQC—where performance improves as more physical qubits are added—has been completed.

6. Roadmap and Prospects for FTQC (Fault-Tolerant Quantum Computing)

While adopting different architectures and approaches, Google and IBM are engaged in fierce development competition towards the ultimate goal of FTQC (Fault-Tolerant Quantum Computing).

IBM’s Approach: Modularization and Heavy-Hex Lattices

IBM is focusing on scaling up processors in parallel with drastically reducing error rates. While challenging the limits of single chips with “Eagle (127Q),” “Osprey (433Q),” and “Condor (1121Q),” they announced a modular architecture called “Quantum System Two.” In addition, for the qubit coupling topology, they have adopted a “Heavy-Hex lattice” that reduces unnecessary crosstalk and increases stability. IBM’s strategy is a hybrid approach that gradually introduces QEC while pursuing utility through advanced error mitigation in the short term.

Google’s Approach: Improving Logical Qubit Quality

Google’s strategy places greater emphasis on extremely lowering the error rate of a single logical qubit (e.g., down to $10^{-6}$) rather than rapidly increasing the number of physical qubits. Upon achieving this, they aim for a large-scale system that runs thousands to tens of thousands of physical qubits in parallel by establishing technologies for transferring quantum states between modules (Quantum Interconnects).

Implementing protocols to fault-tolerantly execute non-Clifford gates, such as Magic State Distillation, will also be a major technical hurdle in the future. To run a practical Shor’s algorithm and crack a 2048-bit RSA cipher, it is said that thousands of logical qubits with an error rate of $10^{-8}$ or less are required, equating to millions to tens of millions of physical qubits, meaning the journey is still long.

7. Conclusion

“Quantum Supremacy” was an important milestone in the history of quantum computers that physically proved the theoretical potential of computing machines. Google’s 2019 demonstration and IBM’s constructive rebuttal pushed the entire industry from mere theoretical proof into an era of genuine engineering towards the pursuit of actual Utility and, ultimately, Fault-Tolerant Quantum Computing (FTQC).

Currently, we are witnessing a transitional phase from noisy NISQ devices to logical qubit devices equipped with error correction. In the next five to ten years, new discoveries in materials science, revolutions in the drug discovery process, and breakthroughs in optimization problems will likely become a reality alongside the evolution of this quantum hardware.

We must keep a close eye on the movements of Google, IBM, and researchers worldwide who are shaping the future of computer science.

How Will Blockchain and Cryptocurrencies Change in the Post-Quantum Era?

Fri, 11 Sep 2026 17:00:00 +0900

1. Introduction: The Footsteps of the Post-Quantum Era and the Crisis of Blockchain

Since the birth of Bitcoin by Satoshi Nakamoto in 2009, blockchain technology has grown to become the foundation of financial systems and applications worldwide as a “decentralized and tamper-proof ledger.” This robust security is supported by modern cryptographic technologies: Public Key Cryptography and Cryptographic Hash Functions.

These cryptographic technologies guarantee security based on the mathematical “computational difficulty” that classical computers (the PCs and supercomputers we currently use) cannot decipher even if they took time equivalent to the lifespan of the universe.

However, this premise is about to be fundamentally overturned by the rapid development and practical application of Quantum Computers, the frontier of physics and information science. Quantum computers, which utilize quantum mechanics specifics such as “Superposition” and “Entanglement,” demonstrate computational power that overwhelms conventional classical computers in specific mathematical problems, a phenomenon known as “Quantum Supremacy.”

In this article, we will thoroughly and deeply delve into what specific threats blockchain technology faces from quantum computers, the latest trends in Post-Quantum Cryptography (PQC) that serve as a solution, and the transition scenarios for crypto asset networks from a technical and mathematical perspective.

2. Basics of Quantum Computers and Two Major Threats to Blockchain

Current blockchain systems are primarily composed of the following two cryptographic elements, each of which is exposed to different threats from quantum algorithms.

graph TD A["Astonishing computational power of quantum computers"] --> B["Shor's Algorithm"] A --> C["Grover's Algorithm"] B --> D["Collapse of Public Key Cryptography (ECDSA/RSA/DSA)"] C --> E["Impact on Cryptographic Hash Functions (SHA-256)"] D --> F["Identification of others' private keys and transaction forgery"] E --> G["PoW mining dominance and attacks on certain addresses"] F --> H["Fatal and direct threat to blockchain"] G --> I["Threat manageable by algorithm adjustments (e.g., key length extension)"] style H fill:#ff9999,stroke:#cc0000,stroke-width:2px; style I fill:#ffff99,stroke:#cccc00,stroke-width:2px;

2.1. Basics of Elliptic Curve Cryptography (ECDSA) and Computational Difficulty

Many blockchains, including Bitcoin and Ethereum, employ the Elliptic Curve Digital Signature Algorithm (ECDSA) as their digital signature algorithm. Specifically, Bitcoin uses an elliptic curve with the parameter secp256k1.

The security of elliptic curve cryptography relies on the computational difficulty of the Elliptic Curve Discrete Logarithm Problem (ECDLP). An elliptic curve is defined by the following equation in the Weierstrass normal form:

$$ y^2 \equiv x^3 + ax + b \pmod{p} $$

In Bitcoin’s secp256k1, $a = 0, b = 7$, and $p$ is a very large prime number. Let $G$ be the base point (reference point) on this curve, and $k$ be the private key, which is a randomly chosen massive 256-bit integer. The public key $K$ is then obtained by adding the base point $k$ times (scalar multiplication).

$$ K = k \times G = \underbrace{G + G + \dots + G}_{k \text{ times}} $$

Calculating the private key $k$ (finding the discrete logarithm) from the exposed public key $K$ and base point $G$ using classical computers requires an exponential computational time of $\mathcal{O}(\sqrt{p})$, even when using the best classical algorithms like Pollard’s rho algorithm. For a 256-bit key, it takes about $2^{128}$ operations, a level that cannot be solved even if current supercomputers are run for billions of years.

2.2. Collapse by Shor’s Algorithm

However, Shor’s Algorithm, published by Peter Shor in 1994, completely destroyed this premise. Shor’s algorithm was originally proposed to solve the prime factorization problem (the foundation of RSA cryptography) in polynomial time, but it can also be applied to the discrete logarithm problem and the elliptic curve discrete logarithm problem.

The core of Shor’s algorithm lies in rapidly finding the “Period” of a function using the Quantum Fourier Transform (QFT).

$$ \text{Classical computational complexity} = \mathcal{O}(2^{n/2}) \quad (\text{where } n \text{ is the bit length}) $$ $$ \text{Quantum algorithm computational complexity} = \mathcal{O}(n^3) $$

In this way, Shor’s algorithm dramatically reduces exponential time to Polynomial Time. If a quantum computer with sufficient logical qubits is completed, it will be possible to determine the private key $k$ from the public key $K$ exposed on the network in minutes or seconds. This allows attackers to easily obtain the private keys of others’ wallets and take full control of their funds.

2.2.1 Step-by-Step Explanation of ECDLP Decryption by Shor’s Algorithm

Let’s look at the internal process of how a quantum computer solves the Elliptic Curve Discrete Logarithm Problem (ECDLP) step by step.

Problem setting: In $K = k \times G$, $G$ and $K$ are known, and we want to find the unknown integer $k$ (private key). Let the order of the elliptic curve be $N$.

Step 1: Creation of a superposition state First, prepare two quantum registers and apply a Hadamard Gate to each to create a superposition state of all possible integer combinations.

$$ |\psi_1\rangle = \frac{1}{N} \sum_{x=0}^{N-1} \sum_{y=0}^{N-1} |x\rangle |y\rangle |0\rangle $$

Step 2: Application of the quantum oracle (evaluation of the function) Next, using a quantum circuit (oracle) that performs point addition on the elliptic curve, compute the function $f(x, y) = x \times G + y \times K$ in the third register.

$$ |\psi_2\rangle = \frac{1}{N} \sum_{x=0}^{N-1} \sum_{y=0}^{N-1} |x\rangle |y\rangle |x \times G + y \times K\rangle $$

The important point here is that since $K = k \times G$, we can rewrite it as $f(x, y) = (x + y \cdot k) \times G$.

Step 3: Measurement of the third register When the third register is measured, it collapses to a point $R$ on the elliptic curve. As a result, the first and second registers collapse to a superposition state of pairs $(x, y)$ that satisfy $x + y \cdot k \equiv c \pmod{N}$ (where $c$ is a constant).

$$ |\psi_3\rangle = \frac{1}{\sqrt{N}} \sum_{y=0}^{N-1} |c - y \cdot k \pmod{N}\rangle |y\rangle $$

Step 4: Application of the Quantum Fourier Transform (QFT) This state has a periodicity related to the period $k$. By applying the Inverse QFT here, phase interference is induced, converting the period information into amplitudes.

Step 5: Measurement and classical post-processing When the first and second registers are measured, a value containing information about $k$ is obtained with high probability. By applying classical number theory algorithms such as Continued Fractions to the measured value, the unknown private key $k$ can be completely determined.

The number of quantum gates required for this entire process is $\mathcal{O}(\log^3 N)$, uncovering the private key at ultra-high speeds completely incomparable to the $\mathcal{O}(\sqrt{N})$ search by classical computers.

2.3. Grover’s Algorithm and its Impact on Hash Functions

Another threat is Grover’s Algorithm, proposed by Lov Grover in 1996. This significantly impacts hash functions (e.g., SHA-256).

In blockchain, hash functions are used to ensure data integrity, generate addresses, and serve as the foundation for PoW (Proof of Work) mining in Bitcoin. Reversing a hash function (preimage computation) can be seen as an “unstructured database search problem” to find the input value $x$ such that $H(x) = y$ for a specific output value $y$.

For classical computers, finding the correct answer out of $N$ possibilities requires an average of $\frac{N}{2}$ trials and a worst-case of $N$ trials. That is, the computational complexity is $\mathcal{O}(N)$. However, Grover’s algorithm uses a quantum technique called “Amplitude Amplification.” By iteratively amplifying the probability amplitude of the correct state from among all possibilities in a superposition state, it reduces the search time to its square root.

$$ \text{Computational complexity of Grover's Algorithm} = \mathcal{O}(\sqrt{N}) $$

For SHA-256, since $N = 2^{256}$, a classical brute-force search requires about $2^{256}$ trials. But using Grover’s algorithm, it only takes $\sqrt{2^{256}} = 2^{128}$ trials. This means that a 256-bit hash function’s security strength is effectively halved to 128 bits against quantum computers.

2.3.1. Will SHA-256 Survive? (Quantum Supremacy in Hashing)

Even if the security is halved, “128-bit security” remains extremely robust. The $2^{128}$ operations is an astronomical number even from the current technological level, requiring a timescale of the lifespan of the universe. Therefore, it is widely believed that “SHA-256 maintains practical security against quantum computers.” If it becomes necessary to increase the security margin in the future, simply doubling the hash output length (e.g., migrating from SHA-256 to SHA-512) will preserve classical 256-bit security in the quantum world.

In conclusion, the quantum threat to hash functions is “minor and manageable,” whereas the threat to public key cryptography (ECDSA) is “fatal.”

3. Specific Impact Analysis on Current Crypto Assets (Bitcoin, Ethereum)

In a world where ECDSA decryption by quantum computers is possible, what specific vulnerabilities will crypto asset networks face? Here, we provide a detailed analysis using Bitcoin’s mechanism as an example, from the perspective of “the timing of public key exposure.”

3.1. Address Generation and the “Privacy” of Public Keys

Bitcoin addresses (P2PKH: Pay-to-Public-Key-Hash or P2WPKH: Pay-to-Witness-Public-Key-Hash) use a public key hashed multiple times rather than the public key itself.

$$ \text{Bitcoin Address} = \text{Base58Check}(\text{RIPEMD160}(\text{SHA256}(\text{Public Key}))) $$

As mentioned earlier, since hash functions are resistant to quantum attacks (Grover’s algorithm), reversing the original “public key” from the “address” (which is a hash value) is impossible even for a quantum computer. In other words, for “unused addresses (those that have never sent funds),” the public key is not exposed on the blockchain at all, and only the hash value is recorded. Therefore, as long as the public key is unknown, there is no target to execute Shor’s algorithm, and the private key cannot be identified. Wallets in this state can be said to be Quantum-safe.

3.2. Fatal Vulnerability During Transaction Transmission (Front-running Attack)

The problem arises when users send funds. When broadcasting (sending) a transaction to the network, the user must include their public key in the transaction data along with the digital signature and expose it to the entire network for verification.

sequenceDiagram participant User as "User (Alice)" participant Mempool as "Mempool (Unconfirmed Transaction Pool)" participant QuantumAttacker as "Quantum Attacker" participant Miner as "Miner (Block Generation)" User->>Mempool: Send transaction (including public key + signature) Mempool-->>QuantumAttacker: Intercept public key on the network note right of QuantumAttacker: Execute Shor's algorithm in minutes
(Calculate private key from public key) QuantumAttacker->>QuantumAttacker: Generate a new signature using Alice's private key QuantumAttacker->>Mempool: Broadcast fraudulent transfer with a higher miner fee Miner->>Miner: Prioritize fraudulent transaction with higher fee (Gas) into a block Miner-->>User: Recorded on blockchain (Alice loses funds)

Once the public key is sent to the Mempool (the waiting area for unconfirmed transactions), that data is shared with nodes worldwide. If an attacker possesses an ultra-fast quantum computer, they can steal funds through the following process:

Intercept a legitimate user’s (Alice’s) transaction from the Mempool and extract the public key.
Execute Shor’s algorithm and calculate the private key from the public key within minutes (before the block is confirmed).
Using the obtained private key, create a fake transaction sending Alice’s funds to the attacker’s address.
Set a much higher miner fee for this fake transaction than Alice’s original transaction and send it to the network.

Miners prioritize transactions with higher fees into blocks according to economic incentives. As a result, the attacker’s fraudulent transfer is confirmed first, and Alice’s legitimate transfer is discarded as a “Double Spend” due to insufficient balance. This series of events is called a Front-running Attack, and in a world where quantum computers are commercialized, it will cause a terrifying situation where funds are stolen by hackers the moment someone presses the send button.

3.3. The Crisis of Reused Addresses and Old Addresses (P2PK)

An even more serious problem is that addresses that have sent funds at least once in the past (such as when reused as change addresses) already have their public keys permanently recorded on the blockchain. These are in danger of having their private keys calculated and balances stolen at any time, without even waiting to send a transaction.

Additionally, in the P2PK (Pay-to-Public-Key) format, which was mainstream around 2009-2010 and includes Satoshi Nakamoto’s early mining rewards (over 1 million BTC), the public key itself was recorded directly on the blockchain as the address instead of a hash. These massive amounts of dormant Bitcoins would be the easiest targets for quantum computers, and if stolen all at once and dumped on the market, could cause a massive price crash.

4. Transition Scenarios to Post-Quantum Cryptography (PQC)

To avoid such a “Q-Day (the day quantum computers break cryptography)” catastrophe, the cryptography and blockchain communities are planning a transition to Post-Quantum Cryptography (PQC), which is difficult even for quantum algorithms to decrypt. The National Institute of Standards and Technology (NIST) has been progressing with the standardization process of PQC for many years, and after several rounds of rigorous evaluation, some promising cryptographic schemes have been selected as final standards.

We will explain in detail the major PQC algorithms that are drawing attention as digital signature alternatives for blockchains, along with their mathematical mechanisms.

4.1. Hash-Based Signatures

Hash-based signatures are a cryptographic scheme whose security relies solely on a very simple and robust foundation: the “collision resistance of hash functions.” Since the safety of hash functions against quantum computers has already been proven (as mentioned above, a 128-bit security margin is sufficient), this is a highly reliable approach. Representative examples include Lamport Signatures, WOTS (Winternitz One-Time Signature) which extended it, and the NIST standardization candidate SPHINCS+ (now called SLH-DSA under FIPS 205).

4.1.1. Mathematical Details of Lamport Signatures (One-Time Signature)

Let’s look at the mechanism of Lamport signatures in more mathematical detail. Let the hash function be $H: \{0, 1\}^* \to \{0, 1\}^{256}$.

[Key Generation] Alice (sender) generates 256 pairs of private keys using a True Random Number Generator (TRNG).

$$ \text{sk}_{i,0} \in \{0, 1\}^{256}, \quad \text{sk}_{i,1} \in \{0, 1\}^{256} \quad (1 \le i \le 256) $$

Thus, the private key $\text{sk}$ consists of a total of 512 256-bit strings (Size: $512 \times 32 = 16,384$ bytes).

Next, she computes the public key $\text{pk}$. Each private key component is individually hashed.

$$ \text{pk}_{i,0} = H(\text{sk}_{i,0}), \quad \text{pk}_{i,1} = H(\text{sk}_{i,1}) $$

The public key is also $16,384$ bytes. This is published to the blockchain network.

[Signature Generation] To sign a transaction data $M$, Alice first calculates its hash value.

$$ h = H(M) \in \{0, 1\}^{256} $$

Let the $i$-th bit of the hash value $h$ be $h_i \in \{0, 1\}$. Alice’s signature $\sigma$ is a set of private key components corresponding to each bit $h_i$.

$$ \sigma = (\text{sk}_{1, h_1}, \text{sk}_{2, h_2}, \dots, \text{sk}_{256, h_{256}}) $$

In other words, if the message hash bit is 0, $\text{sk}_{i,0}$ is revealed, and if 1, $\text{sk}_{i,1}$ is revealed. The signature size is $256 \times 32 = 8,192$ bytes.

[Signature Verification] The miner (verifier) verifies using the received transaction $M$, signature $\sigma = (s_1, s_2, \dots, s_{256})$, and the public key $\text{pk}$. They recalculate the hash of the transaction $h = H(M)$, and check whether hashing each $s_i$ matches the corresponding element $\text{pk}_{i, h_i}$ of the public key.

$$ H(s_i) \overset{?}{=} \text{pk}_{i, h_i} \quad (\text{for all } 1 \le i \le 256) $$

This process is mathematically extremely simple, and it is impossible to forge a signature unless a quantum computer can reverse $H$. However, once signed, half of the private key is exposed to the network, so if another message is signed with the same key pair, the exposed private keys combine to give the attacker room for forgery, creating a strong restriction that it can only be used “One-Time.” To make this practical, technologies like XMSS, which bundles many one-time keys into a single root public key using a Merkle tree, and the stateless SPHINCS+ have been developed, but they have the drawback of signature sizes reaching tens of kilobytes.

4.2. Lattice-Based Cryptography

Currently, the most anticipated mainstream of PQC, adopted as NIST’s main standard specification (FIPS 204: ML-DSA / formerly CRYSTALS-Dilithium, and Falcon, etc.), is Lattice-Based Cryptography.

The security of lattice cryptography depends on mathematically proven hard problems such as the “Shortest Vector Problem (SVP) in multi-dimensional lattices” or the “Learning With Errors (LWE) problem.” No algorithm has been found to solve lattice problems efficiently even using quantum computers.

Mathematical Model of LWE (Learning With Errors): The basic idea of the LWE problem is to dramatically increase the difficulty of a problem by intentionally adding “small noise (errors)” to a system of linear equations. Let the secret vector be $\mathbf{s} \in \mathbb{Z}_q^n$. There is a massive randomly chosen public matrix $\mathbf{A} \in \mathbb{Z}_q^{m \times n}$ and an intentionally added small noise vector $\mathbf{e} \in \mathbb{Z}_q^m$. The public key $\mathbf{b}$ is calculated as follows:

$$ \mathbf{b} = \mathbf{A}\mathbf{s} + \mathbf{e} \pmod{q} $$

Even if matrix $\mathbf{A}$ and vector $\mathbf{b}$ (public key) are public, reversing them to find the private key $\mathbf{s}$ becomes extremely difficult due to the presence of the noise $\mathbf{e}$. Without the noise, it could be solved by simple Gaussian elimination, but with the noise, the search space in all dimensions explodes, providing robust security against both classical and quantum computers. In actual algorithms used in blockchain and elsewhere (like Dilithium), Ring-LWE (or Module-LWE), which expands this over polynomial rings, is used to reduce key sizes and speed up computations.

Pros: Compared to hash-based signatures, public key and signature sizes are relatively small (a few kilobytes), and signature generation/verification computation speeds are extremely fast (equivalent to or better than ECDSA).
Cons: The mathematical structure is complex, and because the historical verification period is short, the risk of a new decryption algorithm being discovered in the future is not zero.

5. Technical Challenges in Migrating Blockchains to PQC

Just because PQC algorithms (like Dilithium and SPHINCS+) exist doesn’t mean they can be introduced to Bitcoin or Ethereum tomorrow. There are several heavy challenges unique to decentralized systems.

5.1. Signature Size Bloat and the Collapse of Scalability

The biggest barrier to introducing PQC is the significant bloat in data size. While the current ECDSA signature size is about 70 bytes, the lattice-based Dilithium (ML-DSA) has a signature size of about 2,420 to 4,595 bytes (depending on the security level), and a public key size exceeding 1,300 bytes. For the hash-based SPHINCS+, the signature alone reaches tens of thousands of bytes.

If Bitcoin introduces PQC with the current block size limit (about 4MB weight including SegWit), the number of transactions that can be stored in one block will drastically decrease. Network throughput (TPS: Transactions Per Second) would fall devastatingly, and transaction congestion would become normal. To solve this, a massive increase in block size is necessary, but this would increase the storage and network bandwidth requirements for full nodes, making it difficult for individuals to operate nodes, resulting in the dilemma of causing centralization of the network.

pie title "Comparison of Signature Data Sizes in Blockchain (Conceptual Diagram)" "ECDSA (approx. 70 Bytes)" : 2 "Dilithium ML-DSA (approx. 2,500 Bytes)" : 58 "SPHINCS+ (approx. 17,000 Bytes)" : 40

(Note: Transaction data bloat due to PQC introduction is a fatal bottleneck for scalability)

5.2. Impact on the Ethereum Virtual Machine (EVM) and Precompiled Contracts

In a Turing-complete smart contract platform like Ethereum, the introduction of PQC demands a fundamental upgrade to the EVM (Ethereum Virtual Machine). In the current EVM, a precompiled contract ecrecover (address: 0x01) is provided for ECDSA signature verification, optimized to perform signature verification at a very low gas cost (3000 Gas).

However, the verification process of new lattice-based cryptographic algorithms like Dilithium and Falcon involves complex polynomial and matrix operations. Implementing this using only existing EVM Opcodes could consume millions to tens of millions of gas for just one signature verification. This is a level that would deplete the current block gas limit (about 30 million Gas) with a single transaction.

To avoid this, it is necessary to incorporate a new Precompiled Contract for PQC verification (e.g., assigning DilithiumVerify to 0x10) into the EVM itself through a network hard fork. This requires a long-term process where core developers of each Ethereum client (Geth, Nethermind, Erigon, etc.) collaborate to optimally implement lattice cryptography verification logic at the language level (C++, Go, Rust, etc.) and conduct security audits.

5.3. Difficulties in Consensus Building Through Hard Forks

Changing the underlying signature algorithm inherently requires a Hard Fork that updates the entire network protocol. However, in communities like Bitcoin that emphasize “not changing rules, being decentralized,” the consensus-building process is politically very difficult. From the time a BIP (Bitcoin Improvement Proposal) for migrating to PQC is proposed until it is implemented, years of discussion and testing will be required.

6. When Will “Q-Day” Arrive? A Roadmap for Transition

When will “Q-Day (the day a quantum computer completely decrypts 256-bit elliptic curve cryptography)” arrive? Although opinions are divided even among researchers, many experts predict that large-scale quantum computers with at least thousands to tens of thousands of stable logical qubits (error-corrected qubits with noise tolerance) will emerge “from the mid-2030s to the 2040s.” However, depending on breakthroughs in hardware architecture or the discovery of more efficient quantum algorithms, the possibility of this arriving sooner (around 2030) cannot be ruled out.

The roadmap the crypto asset ecosystem must take before it’s too late is as follows:

Phase 1: Hybrid Signatures and Account Abstraction (Present to around 2028)

The current blockchain scene, particularly Ethereum developers (like Vitalik Buterin), is considering “Hybrid Signatures” that combine ECDSA and PQC (hash-based signatures or lattice cryptography). This approach attaches both the existing secure ECDSA signature and a PQC signature to a transaction, maintaining security even if one of them is broken. Additionally, by utilizing Account Abstraction (ERC-4337), efforts are underway to implement and support PQC signatures on an opt-in basis (only for users who want it) on smart contract wallets without waiting for a protocol-level hard fork.

Phase 2: Utilizing Zero-Knowledge Proofs (ZK-Rollups) (2025 onwards)

The trump card expected to solve PQC’s biggest weakness, “signature data bloat,” is the utilization of ZK-Rollups (Zero-Knowledge Proofs), a Layer 2 technology. Instead of writing massive PQC signature data directly to Layer 1 (the main chain), numerous PQC transactions are verified and aggregated on Layer 2. Then, using ZK-SNARKs or ZK-STARKs, they are compressed into a single extraordinarily small “Proof” and recorded on Layer 1. Note that since some SNARKs configurations (like Groth16) are themselves vulnerable to quantum attacks, adopting ZK-STARKs, which rely solely on quantum-resistant hash functions, is key.

Phase 3: Protocol-Level Hard Forks (Around 2030)

Once NIST’s PQC standardization is fully established, and industry-standard libraries are available and well-tested, it is expected that a hard fork completely transitioning the default signature scheme to PQC will be implemented on major chains like Bitcoin and Ethereum. During this transition period, a massive announcement urging users to “move funds from old wallets to new PQC-compatible wallets” will take place.

Pioneering Project Examples

Some blockchain projects have anticipated this quantum threat and have been developed with quantum resistance from their initial stages.

QRL (Quantum Resistant Ledger): An early blockchain that natively implemented a hash-based PQC called XMSS (eXtended Merkle Signature Scheme) at the protocol level.
Algorand / Cellframe: A group of projects actively exploring the integration of lattice cryptography, possessing a flexible cryptographic layer modular architecture anticipating future PQC updates.

7. Conclusion: The Future of Crypto Assets and Protecting Our Wealth

The arrival of the “Post-Quantum Era” goes beyond mere science fiction fantasy; it is already looming before us as a concrete technical challenge to real-world cryptographic systems.

The two swords of quantum computers, Shor’s algorithm and Grover’s algorithm, threaten public key cryptography and hash functions, respectively, which are the foundations of current blockchains. In particular, the vulnerability of ECDSA is fatal, and to avoid the risk of fund theft through front-running attacks, transitioning to Post-Quantum Cryptography (PQC) is an absolutely unavoidable path.

However, the technology sector and blockchain community are not just twiddling their thumbs waiting for destruction. The selection and standardization of PQC algorithms like lattice cryptography and hash-based signatures are steadily progressing, and a path to overcoming PQC’s biggest hurdle, “data size bloat,” is beginning to emerge by utilizing Zero-Knowledge Proofs (ZK-STARKs) and Layer 2 scaling technologies.

There is no need for everyday crypto asset users and investors to panic right now and sell all their funds. However, it is important to have the following basic literacy and sense of self-defense:

Avoid address reuse: Thoroughly avoid keeping funds long-term in “used addresses (addresses that have sent funds even once, exposing their public key on the blockchain)” from a security perspective, not just a privacy one.
Pay attention to technology trends: Keep an antenna up for discussions on major networks’ PQC transitions and hard fork news (like Bitcoin’s BIPs and Ethereum’s EIPs), so that you can appropriately transition your wallet when necessary.

The history of blockchain is also a history of continuous upgrades and resilience against new technological threats. Just as it has overcome scalability issues and environmental problems (like the transition from PoW to PoS), the entire ecosystem will surely seek solutions and adapt to this unprecedented quantum threat. We look forward to a future where the new human wisdom of quantum computers and the trusted technology of decentralized ledgers do not collapse through collision, but rather sublimate into a higher-dimension, robustly fused system.

References & Related Links:

National Institute of Standards and Technology (NIST) - Post-Quantum Cryptography Standardization Project
Shor, P. W. (1994). Algorithms for quantum computation: discrete logarithms and factoring.
Grover, L. K. (1996). A fast quantum mechanical algorithm for database search.
Buterin, V. (2024). How to hard-fork to save most users’ funds in a quantum emergency.

Quantum Annealing vs Gate Model Explained Clearly

Fri, 11 Sep 2026 12:00:00 +0900

Quantum Annealing vs Gate Model Explained Clearly

Quantum computing is a next-generation computational technology that utilizes quantum mechanical principles (superposition and entanglement) to dramatically speed up solving specific problems that would take conventional classical computers (including traditional supercomputers) an enormous amount of time to compute.

Currently, as approaches to realizing quantum computers, there are broadly two mainstream paradigms: “Quantum Annealing” and the “Quantum Gate Model”. These two methods differ significantly in their foundational physical approaches, the computational tasks they excel at, and the hardware challenges in their implementation.

In this article, we will thoroughly compare and explain these two models from a very detailed and technical perspective, covering their physical principles, mathematical models (Ising model, QUBO, unitary transformation, etc.), current technical limitations, and specific use cases.

1. Basics of Quantum Computing: Fundamental Differences from Classical Computers

Classical computers process information as “Bits” that take either a “0” or “1” state. On the other hand, quantum computers use “Qubits”. Due to the quantum mechanical principle of “Superposition”, a qubit can probabilistically hold both 0 and 1 states simultaneously.

Furthermore, by utilizing a phenomenon called “Entanglement”, the states of multiple qubits become strongly correlated with each other, such that an operation on one qubit instantly affects the entire system. This enables parallel-processing-like computation (quantum parallelism).

However, quantum states are extremely vulnerable to external noise (such as heat and electromagnetic waves), and “Decoherence”—where the state breaks down and returns to a classical state—is a major challenge. The difference in approaches to this noise problem leads to the major differences in the design philosophies of annealing and the gate model.

2. Details of Quantum Annealing

Quantum annealing is a dedicated computational architecture specialized primarily in solving “combinatorial optimization problems”. Based on the theory proposed in 1998 by Hidetoshi Nishimori and Tadashi Kadowaki of the Tokyo Institute of Technology, it became widely known when Canada’s D-Wave Systems commercialized it for the first time in the world.

2.1. Physical Mechanism: Transverse-Field Ising Model and Quantum Fluctuation

Quantum annealing utilizes the property of physical systems in nature to settle into the “lowest energy state (ground state)” for computation.

In the classical approach, “Simulated Annealing”, thermal fluctuations are used to escape local optimal solutions (local minima). On the other hand, quantum annealing uses “Quantum Fluctuation” to slip through energy barriers via “Quantum Tunneling”, searching for the global optimal solution (global minimum) more efficiently.

The time evolution of a quantum annealing system is described by the following Hamiltonian (an operator representing the total energy of the system) $H(t)$.

$$ H(t) = A(t) H_0 + B(t) H_P $$

Here, $t$ is time, $A(t)$ is a gradually decreasing function, and $B(t)$ is a gradually increasing function.

$H_0$ (Initial Hamiltonian): Represents the transverse field and generates quantum fluctuation. $$ H_0 = - \sum_{i} \sigma_i^x $$ ($\sigma_i^x$ is the Pauli-X matrix, representing a bit flip.)
$H_P$ (Problem Hamiltonian): An Ising Model representing the optimization problem to be solved.

In the initial state ($t=0$), $A(0)$ is at its maximum, and the system is in the ground state of $H_0$ (a state where all states are equally superposed). From there, over time, the transverse field is slowly weakened while simultaneously strengthening the interaction of the problem Hamiltonian.

2.2. Adiabatic Quantum Computation

What is important in this process is the “Adiabatic Theorem”. According to the adiabatic theorem, if a system is changed “sufficiently slowly (adiabatically)”, the system will always remain in the ground state of the Hamiltonian at that instant.

In other words, when $A(t) \to 0$ and $B(t) \to 1$ ultimately, the system will have reached the ground state of $H_P$, which is the “exact solution of the optimization problem”.

graph TD A["Hamiltonian H_0 (Initial State)"] -->|"Adiabatic change (Sufficiently slow)"| B["Always maintain ground state"] A -->|"Non-adiabatic change (Too fast / Thermal noise)"| C["Transition to excited state (Error)"] B --> D["Hamiltonian H_P (Global optimal solution)"] C --> E["Trapped in local optimal solution"] D --> F["Readout of the solution"] E --> F

2.3. Mapping from QUBO to the Ising Model

To solve real-world problems with a quantum annealer, the problem needs to be formulated in the QUBO (Quadratic Unconstrained Binary Optimization) format.

The objective function of QUBO is defined as follows:

$$ \min_{x \in \{0,1\}^n} \sum_{i} Q_{ii} x_i + \sum_{i < j} Q_{ij} x_i x_j $$

Here, $x_i \in \{0, 1\}$ are binary variables, and $Q$ is a weight matrix.

Since the hardware (like D-Wave) deals with physical spins (up/down), it is necessary to convert the variables into an Ising model using $\sigma_i \in \{-1, +1\}$. The conversion formula is as follows:

$$ x_i = \frac{1 - \sigma_i}{2} \quad \text{or} \quad \sigma_i = 1 - 2x_i $$

Substituting this into the QUBO equation and rearranging yields the Hamiltonian $H_P$ of the Ising model:

$$ H_P = - \sum_{i

$J_{ij}$: Interaction between spins (coupling coefficient). The coupling strength between physical qubits.

$h_i$: Local magnetic field (bias) for each spin.

2.4. Quantum Annealing Hardware and Challenges (D-Wave Example)

D-Wave’s quantum processors are implemented using Superconducting Quantum Interference Devices (SQUIDs). The coupling between physical qubits depends on the hardware wiring, and it is not fully connected (a state where all bits are interconnected). It has evolved from the initial “Chimera graph” to the “Pegasus graph” and “Zephyr graph”, and while connectivity has improved, it remains limited.

Therefore, a process called “Minor Embedding” is required, which maps a problem with a complex graph structure onto the physical graph. As a result, one logical variable is represented by multiple physical qubits (a chain), which leads to the challenge of reducing the effective number of usable qubits and degrading computational accuracy.

3. Details of the Quantum Gate Model

The quantum gate model is a quantum mechanical extension of classical computer logic gates (AND, OR, NOT, etc.), and it is an architecture that enables “Universal Quantum Computation”. Many companies, such as IBM, Google, Rigetti, and IonQ, have adopted this method.

3.1. Unitary Transformation and State Vector

In the quantum gate model, the state of the entire system of qubits is represented as a “State Vector” $|\psi\rangle$. The state of one qubit is expressed as a linear combination of the basis states $|0\rangle$ and $|1\rangle$ as follows:

$$ |\psi\rangle = \alpha |0\rangle + \beta |1\rangle $$

Here, $\alpha$ and $\beta$ are complex probability amplitudes, satisfying $|\alpha|^2 + |\beta|^2 = 1$. Geometrically, this state is visualized as a point on the “Bloch Sphere”.

The steps of quantum computation are described as the application of a Unitary Operator $U$ to the state vector. A unitary matrix has the property $U^\dagger U = I$ (the product with its Hermitian conjugate is the identity matrix) and represents a reversible operation corresponding to the time evolution of the Schrödinger equation in quantum mechanics.

$$ |\psi_{t+1}\rangle = U_t |\psi_t\rangle $$

3.2. Basic Quantum Gates and Circuit Model

Quantum computing algorithms are designed as a sequence of quantum gates (quantum circuits).

Pauli Gates (X, Y, Z): 180-degree rotations around each axis on the Bloch sphere. The X gate corresponds to a classical NOT gate.
Hadamard Gate (H): Transforms $|0\rangle$ into $\frac{|0\rangle + |1\rangle}{\sqrt{2}}$, creating a superposition state. $$ H = \frac{1}{\sqrt{2}} \begin{pmatrix} 1 & 1 \\ 1 & -1 \end{pmatrix} $$
CNOT Gate (Controlled-NOT): A 2-qubit gate. It applies an X gate to the target bit only when the control bit is $|1\rangle$. This generates quantum entanglement.

Any quantum algorithm can be approximately expressed by a combination of a small number of 1-qubit gates and CNOT gates (universal gate set).

graph LR Q0["Qubit 0: |0>"] --> H1["Hadamard Gate (H)"] Q1["Qubit 1: |0>"] --> I1["Identity Operation (I)"] H1 --> C1["Control Bit (Control)"] I1 --> T1["Target Bit (Target)"] C1 -. "Entanglement" .- T1 C1 --> M0["Measurement"] T1 --> M1["Measurement"] M0 --> Result["Classical Result (0 or 1)"] M1 --> Result

3.3. Error Correction and the Road from NISQ to FTQC

The biggest challenge for the quantum gate model is “decoherence”, where quantum states are destroyed by noise. The deeper the computation steps (gate depth), the more errors accumulate.

To perform ideal computations, Quantum Error Correction is essential. For example, in methods like the “Surface Code”, multiple physical qubits are bundled together to form a single error-free “Logical Qubit”. However, creating one logical qubit requires thousands to tens of thousands of physical qubits, resulting in massive overhead.

The stage we are currently at is the era of NISQ (Noisy Intermediate-Scale Quantum) devices, which have tens to hundreds of qubits without error correction. Many breakthroughs are still needed to achieve FTQC (Fault-Tolerant Quantum Computing) with complete error correction.

4. Summary of Technical and Mathematical Comparison

We will compare the fundamental differences between the two architectures.

Comparison Item	Quantum Annealing	Quantum Gate Model
Computational Model	Adiabatic quantum computation (continuous time evolution of a Hamiltonian)	Unitary transformation (sequence of discrete gate operations)
Suitable Problems	Combinatorial optimization problems (QUBO, Ising model)	Universal (quantum chemistry simulation, prime factorization, search, etc.)
Expressive Power	Heuristic optimization (approximate solutions)	Equivalent to a universal quantum Turing machine (all computations possible in theory)
Implementation Examples	D-Wave Systems	IBM, Google, Quantinuum, IonQ, etc.
Noise Tolerance	Relatively strong (since it stays near the ground state, some thermal noise is acceptable)	Extremely weak (slight noise causes phase shifts and destroys calculation results)
Scalability	Scale of thousands to tens of thousands of qubits (depends on physical structure. Logical bit formation is difficult)	Scale of hundreds of qubits (millions needed for FTQC)

Quantum annealing is suited for solving optimization problems as a “special-purpose coprocessor”, complementing the limits of classical computers. On the other hand, the quantum gate model is a quantum version of a “general-purpose computer”, ultimately aiming for computational power that surpasses classical computers (quantum supremacy), but building the hardware is extremely difficult.

5. Current Limitations and Challenges

Limitations of Quantum Annealing

Connectivity: Due to the aforementioned minor embedding, the required number of physical qubits increases exponentially as the problem size grows.
Precision of Coefficients: The physical errors when setting analog parameters such as $J_{ij}$ and $h_i$ on the hardware directly affect the quality of the solution.
Temperature and Non-adiabatic Transitions: Since the system temperature is not absolute zero, there is a probability of deviating from the optimal solution due to thermal excitation.

Limitations of the Quantum Gate Model

Coherence Time: The time a quantum state can be maintained is only on the order of a few microseconds to milliseconds, severely limiting the number of gates (circuit depth) that can be executed during that time.
Gate Fidelity: The operational error rate of 2-qubit gates (like CNOT) is not yet low enough (generally around 99.x%). For FTQC to be realized, this needs to be raised to over 99.99%.
Quantum Volume: Scaling not just the sheer number of qubits, but the effective computational capability (quantum volume) factoring in connectivity and error rates is currently the biggest challenge.

6. Specific Use Cases and Algorithms

Let’s look at the specific application areas where each method excels.

6.1. Use Cases for Quantum Annealing

Logistics and Routing: Optimizing delivery routes for numerous vehicles (a variation of the traveling salesperson problem). Real-time route searching considering traffic congestion.
Financial Engineering: Portfolio optimization. Searching for combinations of stocks that maximize return while minimizing risk.
Machine Learning: Feature Selection. Extracting combinations of variables that contribute most to prediction from massive datasets.
Manufacturing: Job-shop scheduling problems in factories (which machine should process which parts in what order to be the fastest).

6.2. Use Cases for the Quantum Gate Model

Quantum Chemistry Simulation: Simulating molecular energy states and chemical reactions with high precision.
Prime Factorization (Shor’s Algorithm): An algorithm that factors huge composite numbers in polynomial time. When this is put into practical use, current public-key infrastructure like RSA encryption will be broken, making the transition to Post-Quantum Cryptography (PQC) an urgent issue.
Database Search (Grover’s Algorithm): When searching for target data from an unsorted database, classical computers require $O(N)$ steps, but Grover’s algorithm can search in $O(\sqrt{N})$ steps.

6.3. Hybrid Algorithms in the NISQ Era: VQE and QAOA

To overcome the limitations of shallow quantum circuits in NISQ devices, “Variational Quantum Algorithms” that combine the advantages of quantum and classical computers are attracting attention.

VQE (Variational Quantum Eigensolver): An algorithm to find the ground state energy of a molecule. It prepares a quantum state using a parameterized quantum circuit (Ansatz) and measures the energy expectation value $\langle \psi(\theta) | H | \psi(\theta) \rangle$. Using this expectation value as an objective function, a classical optimization algorithm (like gradient descent) is used to update the parameters $\theta$. By repeating this until convergence, the accurate energy state of the molecule is obtained.
QAOA (Quantum Approximate Optimization Algorithm): An algorithm that solves combinatorial optimization problems using the quantum gate model. It approximates the adiabatic time evolution of quantum annealing into discrete gate operations via “Trotterization”, and obtains an approximate solution by alternately applying Hamiltonians. QAOA is expected to be a prominent method for solving optimization problems on gate-model computers.

graph TD User["User Problem"] --> Formulation{"Nature of Problem"} Formulation -- "Combinatorial Optimization" --> QA_Path["Quantum Annealing / Ising Machine"] QA_Path --> QUBO["QUBO Formulation"] QUBO --> DWave["Execute on D-Wave"] Formulation -- "Chemical / General Computation" --> Gate_Path["Quantum Gate Model"] Gate_Path --> Circuit["Quantum Circuit Design (VQE / QAOA)"] Circuit --> IBMGoogle["Execute on IBM / Google Quantum Hardware"]

7. Conclusion

Both quantum annealing and the quantum gate model are similar in that they utilize the mysterious properties of quantum mechanics as computational resources, but their approaches and ultimate goals are vastly different.

Quantum Annealing is a “specialized heuristic engine” aimed at delivering practical results early for specific real-world problems like combinatorial optimization. Proof-of-Concept (PoC) experiments by various companies are already underway.
The Quantum Gate Model is a “general-purpose quantum computer” with the potential to fundamentally overturn the paradigm of computer science, from exact simulations of physics and chemistry to decryption. However, it requires long-term research and development to overcome the massive wall of error correction.

In the future, it is believed that a “Heterogeneous Computing” environment will be built, with classical supercomputers (HPC) at the core, calling upon annealing machines for optimization tasks and gate-model quantum computers for quantum chemistry calculations.

Although quantum computing is a technology still in development, it is making rapid progress in both hardware and algorithms day by day. Understanding the mathematics of the Ising model and the basics of quantum circuits will be a great weapon for the coming quantum-native era.

This article is a comprehensive guide covering everything from the foundational concepts of quantum computing to the latest hardware trends. Please continue to watch for future research developments.

Simulating Shor's Algorithm in Python

Fri, 11 Sep 2026 08:00:00 +0900

1. Introduction: The Cryptographic Crisis Brought by Quantum Computers

Much of the security in modern internet society relies on public-key cryptography (especially RSA encryption). When we transmit credit card information for online shopping or exchange highly confidential data, the content of that communication is strongly protected by RSA encryption.

The basis for the security of RSA encryption relies on the mathematical fact that “factoring huge integers is extremely difficult for classical computers (the PCs and supercomputers we use every day).” However, Shor’s Algorithm, published by Peter Shor in 1994, fundamentally overturned this premise. It was mathematically proven that if Shor’s algorithm were executed on a large-scale quantum computer, it could solve factorization problems—which would take classical computers longer than the age of the universe—in just minutes to hours.

In this article, we will thoroughly explain how Shor’s algorithm performs integer factorization so quickly in detail, from its mathematical mechanics to a concrete simulation implementation using Python and the quantum computing framework Qiskit.

2. Dramatic Shift in Computational Complexity: From Exponential to Polynomial Time

Why is prime factorization so difficult? Even if we use the “General Number Field Sieve (GNFS),” known as the best factorization algorithm for classical computers, its computational complexity is sub-exponential.

The time complexity to factorize a composite number of $N$ digits using classical methods is as follows:

$$ O\left(\exp\left( c (\log N)^{1/3} (\log \log N)^{2/3} \right)\right) $$

Because of this, simply increasing the key length (e.g., to 2048 bits or 4096 bits) ensures that deciphering it on a classical computer would take thousands or tens of thousands of years—an unrealistic amount of time.

However, using Shor’s Algorithm on a quantum computer dramatically reduces the computational complexity to polynomial time relative to the number of input bits $\log N$:

$$ O((\log N)^3) $$

This means that if we double the number of bits, the computation time on a classical computer increases astronomically, whereas on a quantum computer it only increases by at most about 8 times. This reduction in complexity class from exponential time to polynomial time (inclusion in the BQP class) is the true marvel of Shor’s algorithm.

graph TD A["Increase in input size (bits) N"] --> B{"Algorithm selection"} B -->|Classical: General Number Field Sieve| C["Sub-exponential increase O(exp(...))"] B -->|Quantum: Shor's algorithm| D["Polynomial time O((log N)^3)"] C --> E["Thousands to billions of years (Undecipherable)"] D --> F["Minutes to hours (Decipherable in realistic time)"]

3. Algorithm Overview and Mathematical Background

Shor’s algorithm does not actually perform everything on a quantum computer. It is composed of a collaboration between pre-processing and post-processing on a classical computer and the core part (the order-finding algorithm) on a quantum computer.

The overall flow of the algorithm is as follows:

graph TD A["Input: Composite number N to be factored"] --> B["Choose a random number a such that a < N"] B --> C{"gcd(a, N) > 1 ?"} C -- "Yes" --> D["Output trivial factor gcd(a, N) and terminate"] C -- "No" --> E["Find the period r of f(x) = a^x mod N using quantum algorithm"] E --> F{"Is r even AND a^(r/2) ≢ -1 mod N ?"} F -- "No" --> B F -- "Yes" --> G["Calculate factors p = gcd(a^(r/2) - 1, N), q = gcd(a^(r/2) + 1, N)"] G --> H["Output: p, q"]

Reduction of Factorization to the Order Finding Problem

Shor’s stroke of genius lies in converting the “factorization problem” into an “Order Finding Problem”.

Consider an integer $N$ (the number to be factored) and an integer $a$ coprime to $N$ ($1 < a < N$). We define the following modular exponentiation function:

$$ f(x) = a^x \bmod N $$

This function has a certain period $r$. That is, $f(x+r) = f(x)$ holds true for any $x$. In particular, when $x=0$, the smallest positive integer $r$ such that:

$$ a^r \equiv 1 \pmod N $$

is called the “order of $a$ modulo $N$”. If we can find this period $r$, we can derive the prime factors as follows.

Rearranging the equation gives:

$$ a^r - 1 \equiv 0 \pmod N $$

If $r$ is even, we can factor it using the difference of squares formula:

$$ (a^{r/2} - 1)(a^{r/2} + 1) \equiv 0 \pmod N $$

This means that $N$ shares a common divisor with either $(a^{r/2} - 1)$ or $(a^{r/2} + 1)$ (provided that the condition $a^{r/2} \not\equiv -1 \pmod N$ is met). Therefore, using the Euclidean algorithm to calculate:

$$ p = \gcd(a^{r/2} - 1, N) $$ $$ q = \gcd(a^{r/2} + 1, N) $$

allows us to find the non-trivial prime factors $p, q$ of $N$. This computation (calculating the greatest common divisor and generating random numbers) can be done extremely fast on classical computers. The problem is thus narrowed down to how to find the period $r$ quickly. On a classical computer, finding this period $r$ itself takes exponential time. This is where the quantum computer comes into play.

4. Quantum Algorithm Part: Mechanics of Order Finding

The subroutine for finding the period $r$ using a quantum computer consists of the following 4 steps:

graph LR subgraph "Quantum State Transitions" S1["|0⟩|0⟩ (Initialization)"] --> S2["H Gate: Superposition Σ|x⟩|0⟩"] S2 --> S3["Oracle U: Σ|x⟩|a^x mod N⟩"] S3 --> S4["QFT: Period extraction via interference"] S4 --> S5["Measurement: Obtain approximated value y"] end

Step 1: Initialization of Quantum Registers and Superposition

First, we prepare two quantum registers. The first register is for inputting states, and the second register is for storing the result of the function’s calculation. The initial state is all $|0\rangle$.

$$ |\psi_0\rangle = |0\rangle_1 |0\rangle_2 $$

We apply Hadamard gates to all qubits in the first register, creating an equal-probability superposition of all possible inputs $x$ (from $0$ to $Q-1$, where $Q=2^n$).

$$ |\psi_1\rangle = \frac{1}{\sqrt{Q}} \sum_{x=0}^{Q-1} |x\rangle_1 |0\rangle_2 $$

Through this, the quantum computer simultaneously holds the states for all $Q$ inputs in a single operation. This is the powerful source of quantum parallelism.

Step 2: Application of the Oracle Function (Modular Exponentiation)

Next, using a quantum arithmetic circuit $U_f$, we calculate the function $f(x) = a^x \bmod N$ and store the result in the second register.

$$ |\psi_2\rangle = \frac{1}{\sqrt{Q}} \sum_{x=0}^{Q-1} |x\rangle_1 |a^x \bmod N\rangle_2 $$

At this point, the first and second registers are in a state of quantum entanglement. If we were to (hypothetically) observe the second register and obtain a specific value $k = a^{x_0} \bmod N$, the state of the first register would collapse into a superposition of $x$ values that yield that $k$. Since the period of the function is $r$, the remaining states will be values separated by $r$: $x_0, x_0+r, x_0+2r, \dots$

$$ |\psi_3\rangle = \sqrt{\frac{r}{Q}} \sum_{j=0}^{M-1} |x_0 + j r\rangle_1 |k\rangle_2 $$

However, we do not want to know $x_0$; we want to know the period $r$ itself. It is impossible to observe $r$ directly from this state. Therefore, we use the Quantum Fourier Transform.

Step 3: Phase Interference via Quantum Fourier Transform (QFT)

We apply the Quantum Fourier Transform (QFT) to the first register. QFT is the quantum version of the classical discrete Fourier transform, and it transforms the amplitudes of the state vector. The action of QFT on the basis state $|x\rangle$ is defined as follows:

$$ QFT |x\rangle = \frac{1}{\sqrt{Q}} \sum_{y=0}^{Q-1} \omega^{xy} |y\rangle $$

Here, $\omega = e^{2\pi i / Q}$.

When QFT is applied, the state amplitudes interfere with each other. Skipping the mathematical details, when QFT is applied to a state with period $r$, the waves cause Constructive Interference only when $y$ is extremely close to an integer multiple of $Q/r$. For all other states, the probability amplitudes cancel out due to Destructive Interference, approaching zero.

Step 4: Measurement and Continued Fraction Expansion

Finally, we measure the first register. The value $y$ obtained from the measurement will satisfy the following condition with high probability:

$$ y \approx c \frac{Q}{r} \implies \frac{y}{Q} \approx \frac{c}{r} $$

(where $c$ is an unknown integer such that $0 \le c < r$)

By applying the classical algorithm of Continued Fraction Expansion to the obtained rational number $y/Q$, we can calculate the approximated fraction $c/r$ and extract the period $r$ from its denominator.

5. Simulation Implementation using Python and Qiskit

Since theory alone can be hard to grasp, let’s actually simulate Shor’s algorithm using Python and IBM’s quantum computing framework, Qiskit.

Here, we will implement the most classic and famous example scenario: “Factoring $N=15$ using $a=7$.”

Preparation of the Execution Environment

Please install Qiskit beforehand.

1

pip install qiskit qiskit-aer numpy

Overview of the Python Implementation Code

The code below is an example implementation of Shor’s algorithm specialized for $N=15, a=7$. Because building a general-purpose modular exponentiation circuit is currently too computationally expensive for simulators, we are hardcoding the gate operations for the specific case of $a=7$.

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123


import numpy as np
from qiskit import QuantumCircuit
from qiskit_aer import AerSimulator
from qiskit.visualization import plot_histogram
from fractions import Fraction
import math

# 1. Function to build the inverse Quantum Fourier Transform (QFT†)
def qft_dagger(n):
 """Generates an n-qubit inverse Quantum Fourier Transform circuit"""
 qc = QuantumCircuit(n)
 # SWAP gates to reverse the order
 for qubit in range(n//2):
 qc.swap(qubit, n-qubit-1)
 # Applying controlled-phase and H gates
 for j in range(n):
 for m in range(j):
 qc.cp(-np.pi/float(2**(j-m)), m, j)
 qc.h(j)
 qc.name = "QFT_dagger"
 return qc

# 2. Function to build the controlled modular exponentiation for 7^x mod 15
def c_amod15(a, power):
 """Generates a controlled U gate for specific a and power (N=15 only)"""
 U = QuantumCircuit(4)
 for _ in range(power):
 # Hardcoded logic for 7^x mod 15 when a=7
 if a in [2,13]:
 U.swap(2,3)
 U.swap(1,2)
 U.swap(0,1)
 if a in [7,8]:
 U.swap(0,1)
 U.swap(1,2)
 U.swap(2,3)
 if a in [4, 11]:
 U.swap(1,3)
 U.swap(0,2)
 if a in [7,11,13]:
 for q in range(4):
 U.x(q)
 U = U.to_gate()
 U.name = f"{a}^{power} mod 15"
 c_U = U.control()
 return c_U

# 3. Main quantum circuit configuration
def shor_circuit(a, n_count):
 # n_count: Number of qubits in the control register
 # The target register is 4 bits to represent 0 to 15
 qc = QuantumCircuit(n_count + 4, n_count)

 # Initialization of the 1st register (control register) (Generating superposition)
 for q in range(n_count):
 qc.h(q)

 # Initialization of the 2nd register (target register) to |1> (0001)
 qc.x(3 + n_count)

 # Application of the controlled modular exponentiation (oracle)
 for q in range(n_count):
 # Apply the operation for 2^q
 qc.append(c_amod15(a, 2**q),
 [q] + [i+n_count for i in range(4)])

 # Apply inverse quantum Fourier transform to the 1st register
 qc.append(qft_dagger(n_count), range(n_count))

 # Measure the 1st register
 qc.measure(range(n_count), range(n_count))
 return qc

# --- Execution Section ---
if __name__ == "__main__":
 N = 15
 a = 7
 n_count = 8 # Use 8 qubits for the control register (Q=256)

 print(f"Search settings: N={N}, a={a}, Control qubits={n_count}")

 # Generate the circuit
 qc = shor_circuit(a, n_count)

 # Execute on the simulator
 sim = AerSimulator()
 # transpilation is recommended in newer Qiskit versions
 from qiskit import transpile
 compiled_circuit = transpile(qc, sim)
 job = sim.run(compiled_circuit, shots=1024)
 result = job.result()
 counts = result.get_counts()

 print("\nMeasurement results (bitstring: observation count):")
 for bitstring, count in counts.items():
 print(f" {bitstring}: {count} times")

 # Classical post-processing: Identifying period r using continued fraction expansion
 print("\n--- Period calculation and factorization ---")
 phases = []
 for output in counts:
 # Convert bitstring to decimal
 decimal = int(output, 2)
 # Phase = measurement value / 2^n_count
 phase = decimal / (2**n_count)
 phases.append(phase)

 # Get approximated fraction using continued fraction expansion. Denominator limit is N=15
 frac = Fraction(phase).limit_denominator(15)
 r = frac.denominator

 print(f"Observation: {decimal:3d} | Phase: {phase:.4f} | Continued fraction: {frac} | Estimated period r = {r}")

 # Check if period r is even and yields valid results
 if r % 2 == 0:
 guess1 = math.gcd(a**(r//2) - 1, N)
 guess2 = math.gcd(a**(r//2) + 1, N)
 if guess1 not in [1, N] or guess2 not in [1, N]:
 print(f" => Success! The prime factors of {N} are {guess1} and {guess2}.")
 else:
 print(f" => Only trivial factors found. Try again.")
 else:
 print(f" => Failed because the period is odd.")

Code Explanation and Result Analysis

When executing the above code, specific peaks (observed values) are obtained with high probability as the measurement results of the control register. In the case of n_count=8 ($Q=256$), with an ideal quantum computer (or simulator), values like 0, 64, 128, and 192 will appear as observed values with overwhelming probability.

Dividing these by $Q=256$, the phase $y/Q$ becomes $0.0$, $0.25$, $0.5$, and $0.75$, respectively. Applying continued fraction expansion to these phases yields:

$0.25 \to 1/4$ (Estimated period $r=4$)
$0.50 \to 1/2$ (Estimated period $r=2$)
$0.75 \to 3/4$ (Estimated period $r=4$)

Using the period $r=4$ obtained here, we calculate the prime factors. Since $a=7, r=4$: $p = \gcd(7^2 - 1, 15) = \gcd(48, 15) = 3$ $q = \gcd(7^2 + 1, 15) = \gcd(50, 15) = 5$

Brilliantly, we have successfully factorized $15 = 3 \times 5$.

[!TIP] If a measurement value of $y=128$ (phase $0.5$) is obtained, the denominator becomes $2$, yielding a divisor of the true period rather than the true period $r=4$. In such cases, the true period can be reached by either executing the algorithm multiple times or by investigating multiples of the obtained $r$.

6. Challenges Toward Practical Application and the Limits of the NISQ Era

While it was easy to factorize $N=15$ on a simulator, factoring RSA-2048 (a 617-digit decimal number) used in real-world applications still faces numerous walls for actual quantum computers.

The era we are currently living in is called the NISQ (Noisy Intermediate-Scale Quantum) era. Qubits are extremely vulnerable to noise from the external environment, and their states break down midway through computations due to “decoherence.”

In order to accurately execute deep circuits (with many gates) like Shor’s algorithm, Quantum Error Correction to correct noise is essential. To create a single noise-free “logical qubit,” it is necessary to encode thousands of “physical qubits” using methods like the Surface Code.

To break 2048-bit RSA encryption, it is estimated that thousands of perfect logical qubits are required, and realizing this would necessitate a fault-tolerant quantum computer equipped with millions to tens of millions of physical qubits. Since even the most advanced current quantum processors only have around a few hundred to a few thousand physical qubits, the world’s cryptography will not be broken immediately.

[!WARNING] However, there exists a threat model known as “Store Now, Decrypt Later”. Attackers might store large amounts of currently encrypted confidential communication data, adopting a strategy to decrypt everything all at once 10 to 20 years later the moment a powerful quantum computer is completed.

7. Transitioning to Post-Quantum Cryptography (PQC)

In preparation for the arrival of “Q-Day” (the day quantum computers break cryptography), cryptographers around the world, spearheaded by the National Institute of Standards and Technology (NIST) in the US, are pushing forward with the standardization of Post-Quantum Cryptography (PQC).

PQC is based on new mathematical problems (such as lattice problems, multivariate polynomial problems, and hash-based functions) that are mathematically considered inefficient to solve even using Shor’s algorithm (or Grover’s algorithm). Algorithms like “CRYSTALS-Kyber” and “CRYSTALS-Dilithium” have already been selected as standard specifications, and their integration into Apple’s iMessage and various web browser communication protocols is gradually beginning.

For engineers managing IT infrastructure, building “crypto-agility” (the ability to quickly switch cryptographic methods) into systems to transition from existing RSA or elliptic curve cryptography to PQC will be a major mission going forward.

8. Conclusion

In this article, we provided a thorough explanation on a scale of 10,000 characters, starting from the theoretical mathematical background of Shor’s algorithm, covering the mechanics of period extraction using the Quantum Fourier Transform, and ending with a concrete simulation code using Python and Qiskit.

The fact that the laws of physics in the microscopic world of quantum mechanics can fundamentally overturn computational complexity theory and cryptography—which are the foundations of macroscopic information science—is one of the most exciting paradigm shifts in the history of science. We must keep a close eye on the ongoing offensive and defensive battle between the continuously evolving quantum computing technology and the new cryptographic techniques standing up against it.

By all means, please try executing the Python code introduced this time in your own environment, and experience the “magic of computation” created by the superposition and interference of quantum states.

References

Shor, P. W. (1994). “Algorithms for quantum computation: discrete logarithms and factoring”. Proceedings 35th Annual Symposium on Foundations of Computer Science.
Nielsen, M. A., & Chuang, I. L. (2010). “Quantum Computation and Quantum Information”. Cambridge University Press.
Qiskit Documentation: https://qiskit.org/documentation/

[Illustrated PQC] Comparison of Major Post-Quantum Cryptography Algorithms

Fri, 11 Sep 2026 07:00:00 +0900

1. Introduction: The “Cryptography Crisis” Brought by Quantum Computers

In modern internet society, public-key cryptography is indispensable infrastructure for protecting the confidentiality of communications and data integrity. The widely used RSA cryptography and Elliptic Curve Cryptography (ECC) rely on the mathematical barriers of “the difficulty of factoring large composite numbers” and “the difficulty of the discrete logarithm problem on elliptic curves,” respectively. It has been proven that classical computers (including the supercomputers we use today) would take longer than the age of the universe to solve these mathematical problems, which has been the basis of their security.

However, this solid premise is about to be completely overturned by the theory and practical advancement of quantum computers. The “Shor’s Algorithm”, published by cryptographer Peter Shor in 1994, theoretically proved that the integer factorization problem and the discrete logarithm problem can be solved in “polynomial time” by running it on a sufficiently capable Cryptographically Relevant Quantum Computer (CRQC). This means that all public-key cryptography currently in use will be rendered powerless.

graph TD A["Large-scale Quantum Computer (CRQC)"] -->|Execution| B["Shor's Algorithm"] B -->|Decryption in polynomial time| C["Integer Factorization Problem (RSA)"] B -->|Decryption in polynomial time| D["Discrete Logarithm Problem (ECC / ECDSA)"] C --> E["Eavesdropping, data tampering, and spoofing of encrypted communications"] D --> E F["Store Now, Decrypt Later (SNDL)"] --> E

It is extremely dangerous to think that “there is no problem because the full-scale completion of quantum computers is still decades away.” This is because an attack method called Store Now, Decrypt Later (SNDL) is already a real threat. This is an attack where malicious states or hacker organizations save a massive amount of currently encrypted communication data (such as TLS traffic) in storage and decrypt all of it the moment a powerful quantum computer becomes available in the future. State secrets, infrastructure information, and medical data that need long-term protection are already exposed to this threat.

Furthermore, for symmetric-key cryptography (such as AES) and hash functions (such as SHA-256), there is Grover’s Algorithm, discovered in 1996. This reduces the computational complexity of a brute-force attack to its square root. In other words, the security level of AES-128 is effectively halved to $2^{64}$, so it is recommended to use longer keys and hash lengths, such as AES-256 and SHA-384, in the quantum era.

To counter this unprecedented cryptography crisis, Post-Quantum Cryptography (PQC) was born, which is based on new mathematical problems that are difficult to decrypt even with a quantum computer. This article provides an extremely detailed explanation of the major PQC algorithms, from their mathematical background to their mechanisms and architectural comparisons, based on the results of the PQC standardization process led by the National Institute of Standards and Technology (NIST) in the United States.

2. Overview and History of the NIST PQC Standardization Project

Transitioning cryptographic technologies takes years to decades, including redesigning protocols, updating systems, and replacing hardware. Therefore, cryptographers around the world have been advancing PQC research since early on. The US NIST (National Institute of Standards and Technology) has played a central role in this. In 2016, NIST announced a public call for the PQC standardization process and accepted entirely new cryptographic algorithm proposals from the global cryptographic community.

The targets for standardization were the following two main categories:

Public-Key Cryptography / Key Encapsulation Mechanism (KEM): A mechanism for securely sharing (distributing) a shared key to encrypt the communication path, such as in TLS connections.
Digital Signatures: A mechanism to prove that data has not been tampered with and that there is no spoofing of the sender (authenticity) in software updates and electronic certificates.

After a fierce competition of evaluation, analysis, and cryptanalysis spanning about 6 years (Round 1 to Round 3), further evaluation for Round 4 was conducted for some algorithms. As a result, the following algorithms were officially published as Federal Information Processing Standards (FIPS) in 2024 and established as the future global standards:

FIPS 203 (ML-KEM): KEM based on CRYSTALS-Kyber
FIPS 204 (ML-DSA): Digital signature based on CRYSTALS-Dilithium
FIPS 205 (SLH-DSA): Stateless hash-based signature based on SPHINCS+
(Scheduled for future formulation) FN-DSA: Digital signature based on FALCON

These selected algorithms rely on different mathematical “hardness problems,” ensuring diversity (Crypto Agility) so that even if a fatal vulnerability is discovered in one algorithm in the future, the entire system will not collapse. In the standardization process, lattice-based cryptography became the main player mainly due to its performance, but hash-based cryptography and code-based cryptography were adopted as powerful backups.

3. Classification of Major Mathematical Approaches in PQC

PQC algorithms are broadly divided into the following five categories based on the mathematical problems that form the basis of their security. This article delves deeply into the top three in particular.

Lattice-based Cryptography: Based on the Shortest Vector Problem (SVP) and Closest Vector Problem (CVP) in multidimensional lattice spaces, and the derived LWE problem. It is the center of NIST standardization, and Kyber, Dilithium, and FALCON fall into this category. It has the best balance of processing speed, public key size, and ciphertext size, making it suitable for general-purpose use.
Hash-based Cryptography: Relies solely on the “collision resistance” and “one-wayness” of cryptographic hash functions (such as SHA-2 and SHAKE) for its security basis. It is only applicable to digital signatures (such as SPHINCS+), but its security proof is the strongest, and it features extremely high resistance to unknown mathematical attacks.
Code-based Cryptography: Based on the theory of error-correcting codes, it relies on the difficulty of the Syndrome Decoding Problem. Classic McEliece, proposed in the 1970s, is a representative example, having a very long history and proven security, but on the other hand, the public key size is extremely large, in the megabyte range.
Multivariate Polynomial Cryptography: Based on the difficulty of finding a solution to a system of multivariate quadratic equations over a finite field (MQ problem). It was mainly proposed as digital signatures (such as Rainbow), but during the final round of NIST, a powerful attack method that could crack it in a few days on a single PC was discovered, and many algorithms dropped out of the standardization.
Isogeny-based Cryptography: Based on the path-finding problem on an isogeny graph of elliptic curves. The key size is very small, and it was expected to be a legitimate successor to ECC, but “SIKE,” the final candidate, was completely broken in just a few hours on a normal PC in 2022 using classical mathematics (such as the Castryck-Decru attack), marking a dramatic end that symbolized the difficulty and terror of PQC design.

4. The Abyss of Lattice Cryptography: Mathematical Foundation of the LWE Problem and Module-LWE

Lattice-based cryptography is currently considered the most promising and has become the center of standardization. At the root of its security is the LWE (Learning with Errors) problem. Proposed by Oded Regev in 2005, this groundbreaking achievement earned him the Gödel Prize. One cannot talk about modern PQC without understanding the LWE problem.

4.1. What is the LWE (Learning with Errors) Problem?

First, consider a simple system of linear equations. Suppose there is a known random matrix $A$ and an unknown secret vector $\vec{s}$ under a certain modulus $q$ (modulo $q$), and their product $\vec{b}$ is given:

$$ \vec{b} = A\vec{s} \pmod q $$

In this case, it is easy to find the unknown $\vec{s}$ from the public information $A$ and $\vec{b}$. Using the classical algorithm “Gaussian elimination,” $\vec{s}$ can be easily calculated in polynomial time.

However, adding a “small intentional error (noise)” to this equation dramatically increases the difficulty of the problem. This is the LWE problem.

Prepare an unknown secret vector $\vec{s} \in \mathbb{Z}_q^n$ and a randomly chosen matrix $A \in \mathbb{Z}_q^{m \times n}$. Furthermore, prepare an error vector $\vec{e} \in \mathbb{Z}_q^m$ whose “elements have sufficiently small values,” chosen according to a normal or binomial distribution, and calculate $\vec{b}$ as follows:

$$ \vec{b} = A\vec{s} + \vec{e} \pmod q $$

The Search LWE problem is the problem of “finding the secret information $\vec{s}$ from the public information $(A, \vec{b})$.” Due to the existence of this error $\vec{e}$, if one attempts an algebraic solution such as Gaussian elimination, the error $\vec{e}$ amplifies like a snowball in the process of adding and subtracting equations, ultimately becoming indistinguishable from random values and breaking down.

The greatness of the LWE problem lies in the fact that there is a powerful theoretical proof (reduction) that unless there is a quantum algorithm that can solve GapSVP (Decision Shortest Vector Problem) and SIVP (Shortest Independent Vector Problem), which are “worst-case hardness” problems on lattices, the LWE problem cannot be solved in the average-case either. In other words, even for a randomly generated cryptographic key, it is guaranteed to have robust security backed by a theoretical upper bound.

4.2. Dramatic Efficiency Improvement by Ring-LWE and Module-LWE

The normal LWE problem (Standard LWE) has a very clear basis for security, but the size of the matrix $A$ becomes very large, and the key size reaches the megabyte class, making it impractical. Therefore, an approach was proposed to provide an algebraic structure by utilizing Polynomial Rings.

In the Ring-LWE problem, instead of simple vectors and matrices, elements (polynomials) of a certain polynomial ring $R_q$ are used. The following cyclotomic polynomial ring is generally used in the NIST standard:

$$ R_q = \mathbb{Z}_q[X]/(X^n + 1) $$

Here, $n$ is a power of 2 (e.g., 256), and $q$ is an appropriate prime number. Over this ring, using elements $a, s, e \in R_q$, $b = a \cdot s + e \pmod q$ is calculated. Because a single polynomial $a$ has $n$ coefficients, data can be significantly compressed, and by using the finite field version of the Fast Fourier Transform (FFT) called NTT (Number Theoretic Transform), ultra-fast polynomial multiplication becomes possible with a computational complexity of $O(n \log n)$.

However, Ring-LWE had concerns that “there might be an unknown vulnerability due to the special algebraic structure of the ring.” Furthermore, there was an engineering challenge that when changing the security level (such as AES-128, 192, 256 equivalent), the degree $n$ of the polynomial itself had to be changed, and the entire implementation, such as the NTT algorithm, had to be rewritten accordingly.

Therefore, the Module-LWE (M-LWE) problem was adopted by standardization algorithms such as Kyber and Dilithium. Module-LWE is a compromise situated exactly halfway between the structureless Standard LWE and the overly structured Ring-LWE, using a $k \times k$ matrix (module) whose components are elements of the polynomial ring $R_q$:

$$ \vec{b} = A\vec{s} + \vec{e} \pmod{R_q} \quad (A \in R_q^{k \times k}, \vec{s}, \vec{e} \in R_q^k) $$

The greatest advantage of Module-LWE is that the security level can be easily scaled simply by changing the matrix dimension $k$ while keeping the polynomial degree $n$ (in the NIST standard, $n=256$) fixed. For example, in Kyber, the dimension $k$ is adjusted as follows:

Kyber512 (Level 1): $k = 2$ (equivalent to AES-128)
Kyber768 (Level 3): $k = 3$ (equivalent to AES-192)
Kyber1024 (Level 5): $k = 4$ (equivalent to AES-256)

This made it possible to reuse 100% of the underlying NTT code and polynomial operation hardware circuits across all security levels, dramatically improving implementation security and efficiency.

5. CRYSTALS-Kyber (ML-KEM): Next-Generation Key Encapsulation Mechanism

CRYSTALS-Kyber, officially standardized as FIPS 203 (ML-KEM), is a Key Encapsulation Mechanism (KEM) based on the aforementioned Module-LWE problem. It will become the de facto global standard for securely sharing session keys in TLS 1.3, SSH, and the like in the future.

5.1. Architecture of KEM (Key Encapsulation Mechanism)

In the PQC era, instead of a direct approach like RSA where “the client creates a common key, encrypts it with the server’s public key, and sends it,” a KEM encapsulation framework becomes the standard.

sequenceDiagram participant Client as "Client (Alice)" participant Server as "Server (Bob)" Note over Client: "ML-KEM KeyGen()" Client->>Client: "Generate secret key (sk) and public key (pk)" Client->>Server: "Send public key (pk)" Note over Server: "ML-KEM Encaps()" Server->>Server: "Generate a random shared key (K)" Server->>Server: "Encapsulate K with pk to create ciphertext (c)" Server->>Client: "Send ciphertext (c)" Note over Client: "ML-KEM Decaps()" Client->>Client: "Decrypt ciphertext (c) using secret key (sk)" Client->>Client: "Decapsulate and extract the shared key (K)" Note over Client, Server: "Start encrypted communication (e.g. AES) using the shared key (K)"

5.2. Kyber’s Internal Algorithm Mechanism and the Fujisaki-Okamoto Transform

Kyber’s design is highly sophisticated. First, it constructs a public-key encryption scheme (Kyber.CPAPKE) that is secure only against CPA (Chosen Plaintext Attack), and then adopts a design that upgrades it into a complete KEM that is secure against CCA (Adaptive Chosen Ciphertext Attack) by applying a cryptographically extremely powerful method called the Fujisaki-Okamoto Transform.

The core encryption and decryption mechanisms of CPAPKE are as follows:

Key Generation:
- From a random seed value, generate a matrix $A \in R_q^{k \times k}$ in the NTT domain. The modulus $q$ used is $3329$.
- Sample a secret vector $\vec{s}$ and an error vector $\vec{e}$ with small coefficients from a Centered Binomial Distribution (CBD).
- Calculate $\vec{t} = A\vec{s} + \vec{e}$. The public key is $(A, \vec{t})$, and the secret key is $\vec{s}$. (In reality, $A$ is published as a seed value to save bandwidth).
Encryption:
- Encode the 32-byte message to be shared (shared key material) $m$ into a polynomial.
- Generate a new random vector $\vec{r}$ and small errors $\vec{e_1}, e_2$.
- $\vec{u} = A^T\vec{r} + \vec{e_1}$
- $v = \vec{t}^T\vec{r} + e_2 + \lfloor q/2 \rceil \cdot m$
- The ciphertext is $(\vec{u}, v)$.
Decryption:
- The receiver calculates $v - \vec{s}^T\vec{u}$.
- Expanding this formula mathematically yields the following: $v - \vec{s}^T\vec{u} = (\vec{t}^T\vec{r} + e_2 + \lfloor q/2 \rceil \cdot m) - \vec{s}^T(A^T\vec{r} + \vec{e_1})$
- Substituting $\vec{t} = A\vec{s} + \vec{e}$ here cancels out the main term $\vec{s}^TA^T\vec{r}$.
- What remains is $\lfloor q/2 \rceil \cdot m + (\vec{e}^T\vec{r} + e_2 - \vec{s}^T\vec{e_1})$.
- Since the terms in parentheses are “products and sums of small errors,” they remain sufficiently small values (noise) as a whole. Therefore, by making a threshold judgment on whether each coefficient is close to $0$ or close to $q/2$, the bits (0 or 1) of the original message $m$ can be completely restored without error.

Kyber’s greatest strengths are its overwhelming processing speed and moderate key size. For Kyber768, the public key size is 1,184 bytes and the ciphertext size is 1,088 bytes. While larger compared to RSA-3072 (key size around 384 bytes), it can fit within the MTU (Maximum Transmission Unit) of modern internet communications without packet fragmentation, having almost no adverse effect on network latency.

6. CRYSTALS-Dilithium (ML-DSA): General-Purpose Lattice-Based Digital Signature

In the standardization of digital signatures, algorithms with different design philosophies within the same lattice cryptography approach competed against each stands. Among them, CRYSTALS-Dilithium was selected as FIPS 204 (ML-DSA) for general-purpose digital signatures.

6.1. The Fiat-Shamir with Aborts Paradigm

Like Kyber, Dilithium is a digital signature scheme based on the Module-LWE (and Module-SIS problem). The design base uses an extremely important paradigm called “Fiat-Shamir with Aborts”.

The Fiat-Shamir transform itself is a standard method for converting an interactive zero-knowledge proof protocol into a non-interactive digital signature. The prover (signer) generates a commitment $y$, calculates $w = Ay$, passes it through a hash function to obtain a random challenge $c$, and calculates the response $z = y + cs$.

However, simply applying this to lattice cryptography caused a fatal problem (side-channel-like mathematical leakage) where the distribution of the response $z$ was distorted depending on the value of the secret key $s$, gradually leaking information about the secret key $s$ to an attacker observing many signatures.

The Dilithium design team (Lyubashevsky et al.) introduced a method called “Rejection Sampling”, where if the coefficients of the calculated signature $z$ do not fall within a pre-set safe threshold, the entire signature process is aborted and recalculated from the beginning using a new random number $y$.

As a result, the finally output signature $z$ has a completely uniform distribution independent of the secret key, succeeding in completely preventing mathematical information leakage.

6.2. Dilithium’s Advantages and Ease of Implementation

A major design advantage of Dilithium is that it does not use complex “sampling from a Gaussian distribution” or “floating-point arithmetic” at all in the signature generation process. Because it can be implemented using only sampling from a uniform distribution, simple integer modulo arithmetic, NTT, and a hash function (SHAKE), it is easy to implement securely and in constant-time in a wide range of environments, from embedded microcontrollers to cloud servers. This gives it robust resistance against physical side-channel attacks such as timing attacks.

7. FALCON (FN-DSA): Ultimately Compact Lattice Signature

NIST selected FALCON (Fast-Fourier Lattice-based Compact Signatures over NTRU), another lattice-based signature with different characteristics from Dilithium, as a standardization candidate (currently drafting as FN-DSA).

7.1. NTRU Lattices and Gaussian Sampling

FALCON’s greatest feature is that it uses not the LWE problem but the historical NTRU (N-th degree Truncated polynomial Ring Units) lattices that have existed since 1996. Furthermore, it adopts the “Hash-and-Sign” paradigm based on the GPV (Gentry-Peikert-Vaikuntanathan) framework.

In Hash-and-Sign, the hash value of a message is set as a target point in space, and finding the point on the lattice closest to that point (an approximate solution to the closest vector problem) serves as the signature. To do this, it is necessary to sample points according to a discrete Gaussian distribution using a “high-quality short basis” as the secret key.

FALCON dramatically accelerated this heavy computation using a method called “Fast Fourier Orthogonalization (FFO)”.

7.2. Pros and Cons of FALCON

The overwhelming advantage of FALCON is that its signature size and public key size are extremely small (compact). While the signature size of Dilithium3 is about 3,309 bytes, the signature size of FALCON-512 is only about 666 bytes. The public key is also very small at 897 bytes, making it a lifesaver in environments with extremely limited communication bandwidth, IoT devices, or specific network protocols.

However, there is a significant drawback. Because discrete Gaussian sampling, which involves complex floating-point arithmetic (64-bit IEEE 754), is essential during signature generation, constant-time implementation to prevent timing leakage is extremely difficult, and the code becomes huge. For this reason, FALCON is positioned as a powerful specialized algorithm for specific uses, in contrast to the general-purpose Dilithium.

graph LR A["Requirements for Digital Signatures"] --> B{"What is the top priority constraint?"} B -->|"Simplicity of implementation, versatility, ease of constant-time implementation"| C["Dilithium (ML-DSA)"] B -->|"Minimization of communication bandwidth, compactness of data size"| D["FALCON (FN-DSA)"] C --> E["General-purpose TLS certificates, digital signatures for software"] D --> F["Protocols with strict packet size limits, special environments"]

8. SPHINCS+ (SLH-DSA): Hash-Based Signature Boasting the Strongest Security

To prepare for the worst-case scenario (a rare event) where the security of lattice cryptography is broken by a brilliant mathematician’s breakthrough in the future, NIST formulated FIPS 205 (SLH-DSA), namely SPHINCS+, as a standard with a completely different approach from lattice cryptography.

SPHINCS+ is classified as a hash-based signature. The basis of its security relies solely on “the cryptographic hash functions used (such as SHA-2 and SHAKE256) having collision resistance and one-wayness.” Because it does not depend on mathematical problems with specific algebraic structures like LWE or integer factorization, it boasts extremely robust security (the most conservative security) where even if any powerful quantum algorithm appears in the future, one can simply counter it by increasing the output length of the hash function.

8.1. Stateless Architecture with WOTS+ and FORS

The history of hash-based signatures is old, dating back to Lamport signatures and Winternitz One-Time Signatures (WOTS) in the 1970s. These were disposable keys that could “securely sign only once.” To make them usable multiple times, algorithms like XMSS (eXtended Merkle Signature Scheme) and LMS were developed, combining a Merkle Tree to manage countless one-time keys with a single root hash.

However, XMSS and LMS had a fatal flaw of being “stateful”. It was necessary to strictly record the index state of “which one-time key was used” in non-volatile memory every time a signature was made, and if the state rolled back due to something like restoring a virtual machine snapshot and the same one-time key was used twice, the secret key would leak immediately, and the system would collapse.

SPHINCS+ is a “stateless” hash-based signature that solves this state management hassle. Its core technology is the following combination:

WOTS+ (Winternitz One-Time Signature Plus): A basic one-time signature.
FORS (Forest of Random Subsets): A Few-Time Signature technology. It remains secure even if the same key is reused a few times.
Hyper-Tree: A massive structure of multi-layered Merkle Trees.

When signing with SPHINCS+, instead of managing state, it uses a pseudorandom number to randomly select one of a vast number of FORS keys at the bottom of the Hyper-Tree to sign. Because the number of leaves in the tree is astronomically large, the probability of accidentally picking the same key twice (collision) is negligibly small, resulting in a stateless realization.

The sole and greatest weakness of SPHINCS+ is that its signature size is extremely large. Depending on the parameters, the signature size can reach 17 to 49 kilobytes, and the signature generation speed is also overwhelmingly slower than lattice cryptography. Therefore, rather than for daily web browsing, it is intended for uses where signatures are not made frequently and long-term absolute security is strongly required, such as software update signatures and root Certificate Authority (CA) certificates.

9. Code-Based Cryptography: The Good Old Giant, Classic McEliece

In the NIST standardization process, an important approach still being evaluated as a final candidate for Round 4 is Classic McEliece of code-based cryptography.

Proposed by Robert McEliece in 1978, this algorithm is one of the oldest in the history of public-key cryptography, alongside RSA. It utilizes algebraic geometry codes called “Goppa codes,” where a message is intentionally encrypted with an error (noise vector) added, and only the person holding the parity check matrix of the Goppa code as a secret key can remove the error using powerful error-correcting capabilities to decrypt the original message. This is based on the “Syndrome Decoding Problem”.

$$ \vec{c} = \vec{m} G + \vec{e} $$

(where $G$ is the scrambled generator matrix which is the public key, and $\vec{e}$ is the error vector of weight $t$)

The amazing thing about Classic McEliece is its overwhelming track record: despite more than 40 years passing since its proposal and being exposed to intense cryptanalysis research by cryptographers worldwide, no fundamental vulnerability has ever been discovered. It possesses the most “time-proven robust security” among PQC.

Furthermore, it has the advantage of a very small ciphertext size (only about 100 to 200 bytes). However, it has a fatal flaw in that the public key size is in the megabyte (MB) range. Even at the lowest security level (AES-128 equivalent), the public key is about 250KB, and it exceeds 1MB at higher levels.

For this reason, it cannot be applied at all to uses where the public key is transmitted over a network during every communication, such as in TLS handshakes. However, in special use cases where public keys can be pre-deployed in systems, such as sharing pre-shared keys for VPNs, hardcoding public keys in firmware, or satellite communications, it continues to be considered a highly promising option due to its robust security.

10. Performance Comparison and Trade-offs of Each PQC Algorithm

The performance characteristics of the major algorithms explained so far at typical security levels (equivalent to NIST Level 2-3, AES-128-192 levels) are summarized in the table below.

Algorithm (Standard Name)	Category	Mathematical Basis	Public Key Size	Secret Key Size	Ciphertext/Signature Size	Processing Speed Trend	Main Features and Uses
Kyber768 (ML-KEM)	KEM	Module-LWE	1,184 Bytes	2,400 Bytes	1,088 Bytes	Very fast	Best balance of key size and speed. General-purpose KEM standard such as TLS 1.3.
Dilithium3 (ML-DSA)	Signature	Module-LWE	1,952 Bytes	4,032 Bytes	3,309 Bytes	Fast for both generation and verification	Simple implementation. General-purpose digital signature standard.
FALCON-512 (FN-DSA)	Signature	NTRU Lattice	897 Bytes	1,281 Bytes	666 Bytes	Signature generation is slower, verification is ultra-fast	Minimal signature size. However, requires floating-point operations. For embedded/IoT.
SPHINCS+ (SLH-DSA)	Signature	Hash Function	32 Bytes	64 Bytes	Approx. 17,000 Bytes	Generation is very slow	Mathematical failure risk is almost zero. High security uses like root certificates.
Classic McEliece	KEM	Goppa Code	Approx. 1.04 MB	13,568 Bytes	188 Bytes	Encapsulation is fast	40 years of security track record. Giant public key. For hardcodable environments.

Understanding the Trade-offs

In the world of PQC, there is no single magical algorithm that has “small size, fast speed, and perfect mathematical guarantees.”

The Internet Standard (Kyber / Dilithium): The best balance of performance, making it the most suitable for a drop-in replacement of current RSA/ECC.
Ultimate Conservatism (SPHINCS+): Chosen when one wants absolute insurance against future mathematical breakthroughs, even at the expense of data size or processing speed.
For Special Environments (FALCON / Classic McEliece): Specialized weapons chosen according to environmental constraints, such as when communication bandwidth is extremely narrow or when pre-distribution is possible.

11. Challenges Toward Practical Application and the Practical Solution of “Hybrid Cryptography”

With the completion of standardization by NIST and the official issuance of FIPS standards, the PQC migration of IT infrastructure worldwide has begun in earnest. Google’s Chrome browser, Apple’s iMessage (PQ3 protocol), and network providers like Cloudflare have already implemented PQC support in their protocols and started actual operations.

However, completely switching to new cryptographic algorithms all at once comes with a very high risk. If a brilliant mathematician were to discover a fatal attack method (a mathematical flaw solvable even by classical computers) against lattice cryptography like Kyber a few years from now, entire systems relying on it would instantly become completely defenseless.

A practical and recommended approach to mitigate this uncertainty risk is “Hybrid Cryptography”.

In hybrid cryptography, key exchange is performed using both a classical cryptographic algorithm with a long track record (e.g., Elliptic Curve Cryptography like X25519) and a new PQC algorithm (e.g., Kyber768) simultaneously. Shared key components are generated individually with each algorithm, and finally, a secure Key Derivation Function (KDF) is used to mix the two components to generate the final master secret.

graph TD A["Client"] -->|1. Send X25519 Public Key + Kyber Public Key| B["Server"] B -->|2. Return X25519 Shared Key + Kyber Encapsulated Ciphertext| A A --> C{"Derive Master Secret (KDF)"} B --> C C -->|Input: (X25519 Shared Key) || (Kyber Shared Key)| D["Secure Communication Key (AES-256 / ChaCha20)"] D -->|"Resistant to both quantum threats & classical vulnerabilities"| E["Secure Hybrid Encrypted Communication (TLS 1.3)"]

This achieves a robust two-tiered security: “even if a quantum computer becomes a reality and ECC is broken, Kyber protects the communication,” and conversely, “even if an unknown mathematical flaw is found in Kyber, ECC protects the communication.” A representative example is the X25519MLKEM768 (formerly X25519Kyber768) draft being standardized by the IETF, and communications between current web browsers and cutting-edge servers are already being carried out precisely using this hybrid method.

Furthermore, the concept of Crypto Agility, building a system architecture that “does not overly rely on a specific cryptographic algorithm and can quickly switch to another algorithm (e.g., from Kyber to McEliece, or Dilithium to SPHINCS+) in the event an algorithm fails,” will be an essential requirement in future system development.

12. Conclusion: A New Horizon for Cryptographic Technology

Ironically, quantum computers, the dream technology of humanity, have become the greatest threat to breaking the mathematical defenses of “integer factorization” and “discrete logarithm problems” that we have trusted for many years. However, cryptographers around the world did not succumb to this; they pioneered more complex and profound multi-dimensional mathematical fields such as lattice theory, hash function trees, and error-correcting codes, and built a new defense called Post-Quantum Cryptography (PQC).

The completion of standardizations by NIST for FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) is not the goal. It is just the first step in the grand journey of PQC migration that will continue for decades to come. For software engineers and system architects, how to optimally adapt the “increased key sizes” and “changed computational costs” brought by these new algorithms into network protocols and systems will be a major technical challenge moving forward.

The battle between quantum computers and cryptography is an exciting area where humanity’s mathematical exploration and the evolution of technology intersect most fiercely. Through this article, we hope you have deeply understood the beautiful mathematical theories behind PQC and the amazing mechanisms of each algorithm that will shape the future of cybersecurity.

References:

NIST Post-Quantum Cryptography Standardization Program
FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard
FIPS 204: Module-Lattice-Based Digital Signature Standard
FIPS 205: Stateless Hash-Based Digital Signature Standard

The Day Quantum Computers Become Practical: The Current State in 2026

Fri, 11 Sep 2026 06:00:00 +0900

1. Introduction: Where Quantum Computing Stands in 2026

As of 2026, quantum computing has made a decisive shift from a “theoretical dream” to an “engineering reality.” As the limitations of NISQ (Noisy Intermediate-Scale Quantum) devices—which were mainstream until a few years ago—became clear, research institutions and tech giants around the world shifted their focus toward realizing “FTQC (Fault-Tolerant Quantum Computing).”

In this article, we will delve deep into the current state of quantum computers, incorporating the latest breakthroughs of 2026. In particular, we will detail quantum error correction (surface codes), the difference between physical and logical qubits, advancements in topological quantum computing, and the frontlines of superconducting and ion-trap architectures.

2. Fundamentals of Quantum States and Fidelity

The qubit, the fundamental unit of a quantum computer, differs from a classical bit (0 or 1) in that it can exist in a superposition of 0 and 1. The state of a single qubit is represented as a vector on a Hilbert space as follows:

$$ |\psi\rangle = \alpha|0\rangle + \beta|1\rangle $$

Here, $\alpha$ and $\beta$ are complex probability amplitudes that satisfy the following normalization condition:

$$ |\alpha|^2 + |\beta|^2 = 1 $$

An extremely important metric for measuring the performance of quantum computation is Fidelity. The fidelity $F$ between an ideal quantum state $|\psi\rangle$ and an actual density matrix $\rho$ that has degraded into a mixed state due to noise is defined as follows:

$$ F(\rho, |\psi\rangle) = \langle \psi | \rho | \psi \rangle $$

As of 2026, the fidelity of 2-qubit gates (e.g., CNOT and CZ gates) has stably surpassed the 99.99% barrier (the so-called “four nines”) in superconducting architectures. This significantly exceeds the threshold for error correction using surface codes (about 99%), making it one of the biggest breakthroughs toward practical application.

3. The Limits of the NISQ Era and the Paradigm Shift to FTQC

The late 2010s to the early 2020s was the era of NISQ (Noisy Intermediate-Scale Quantum)—devices with tens to hundreds of qubits without error correction. However, NISQ had clear limitations.

As the circuit depth increases, errors accumulate exponentially, making it impossible to obtain meaningful computation results. The overall success probability $P_{success}$ at a circuit depth $D$ decays with respect to the single-gate fidelity $f$ and the number of gates $N$ as follows:

$$ P_{success} \approx f^N $$

If $f = 0.99$ and 1000 gates are applied, $0.99^{1000} \approx 4.3 \times 10^{-5}$, and the result is almost entirely buried in random noise. For this reason, in 2026, resources are heavily concentrated on generating Logical Qubits rather than directly scaling up NISQ algorithms (like VQE and QAOA).

4. Quantum Error Correction and Logical Qubits: The Forefront of Surface Codes

Quantum Error Correction (QEC) is a technology that encodes multiple “physical qubits” to create a single “logical qubit,” detecting and correcting errors. The most promising approach currently is the Surface Code.

4.1 Structure of the Surface Code

In a surface code, qubits are arranged in a 2-dimensional grid. Data qubits (which hold the actual information) and measurement qubits (for syndrome measurement) are arranged in a checkerboard pattern.

graph TD A["Data Qubit (D1)"] --- B["Measure Qubit (M1)"] B --- C["Data Qubit (D2)"] C --- D["Measure Qubit (M2)"] D --- E["Data Qubit (D3)"] B --- F["Data Qubit (D4)"] D --- G["Data Qubit (D5)"] style A fill:#e1f5fe,stroke:#039be5 style C fill:#e1f5fe,stroke:#039be5 style E fill:#e1f5fe,stroke:#039be5 style F fill:#e1f5fe,stroke:#039be5 style G fill:#e1f5fe,stroke:#039be5 style B fill:#fff3e0,stroke:#fb8c00 style D fill:#fff3e0,stroke:#fb8c00

Bit-flip (X errors) and phase-flip (Z errors) are constantly monitored using the stabilizer operators $S_x$ and $S_z$.

$$ S_x = \prod_{i \in \text{star}} X_i, \quad S_z = \prod_{j \in \text{plaquette}} Z_j $$

A significant advancement in 2026 is that the “Break-even point” has been completely surpassed. In other words, the noise removed by error correction has become greater than the noise introduced by the extra circuitry required for it, allowing the lifespan of a logical qubit to exceed that of a physical qubit by orders of magnitude.

4.2 The Quantum Error Correction Cycle

Error correction functions as a continuous feedback loop.

sequenceDiagram participant D as "Data Qubits" participant M as "Ancilla/Measure Qubits" participant C as "Classical Controller" loop "Syndrome Extraction Cycle (approx 1 microsec)" D->>M: "Entangle (CNOT/CZ)" M->>C: "Measure State (Syndrome)" C->>C: "Decode Syndrome (e.g. Minimum Weight Perfect Matching)" C-->>D: "Apply Pauli Correction (if necessary)" end

Currently, the technology to execute this classical decoding process (syndrome analysis) in nanoseconds using FPGAs or dedicated ASICs has been established, and real-time error correction has entered the practical stage.

5. Evolution of Hardware Architectures (2026 Edition)

Quantum hardware in 2026 is evolving primarily along three axes: “Superconducting,” “Ion-Trap,” and “Topological.”

5.1 Integration of Superconducting Qubits

The superconducting approach is a field led by companies like IBM and Google, with Transmon qubits using Josephson junctions being the mainstream. In 2026, megachips integrating thousands to ten thousand physical qubits on a single chip became a reality.

Notably, Quantum Interconnects (module-to-module quantum communication) have been established. Quantum teleportation between chips using microwave photons has been implemented at a commercial level, making it possible to bypass the size limitations of a single dilution refrigerator.

5.2 2D Scaling and Optical Interconnects for Ion Traps

The ion-trap architecture (led by Quantinuum, IonQ, etc.) uses the internal energy states of ions suspended in a vacuum as qubits. Compared to superconducting methods, they boast extremely long T1/T2 coherence times and have the advantage of all-to-all connectivity.

The 2026 breakthrough involved expanding the QCCD (Quantum Charge Coupled Device) architecture into two dimensions and generating high-speed entanglement between multiple traps using photonic interconnects. This drastically improved the slow gate speeds and scalability issues that were weaknesses of the ion-trap method.

5.3 Topological Quantum Computing: Controlling Anyons

Topological quantum computing, long considered theoretical, has finally entered the phase of experimental demonstration in 2026. This approach, promoted by Microsoft and others, uses non-Abelian anyons called “Majorana Zero Modes.”

Quantum gates are executed through an operation called “Braiding,” which involves swapping the positions of anyon particles.

$$ |\psi_{final}\rangle = B_{ij} |\psi_{initial}\rangle $$

Here, $B_{ij}$ is the braiding operator. Because the topological approach relies on the global topology of the “knots” rather than the local state of particles to store information, it is inherently robust against environmental noise (hardware-level fault tolerance). In 2026, the world’s first generation of high-fidelity topological logical qubits was confirmed, drawing attention as a powerful shortcut to FTQC.

6. Roadmap to Practical Application and Future Outlook

To truly demonstrate Quantum Advantage, where quantum computers overwhelm classical computers (supercomputers) in fields like “chemical computation,” “materials science,” and “financial modeling,” thousands of logical qubits are required.

gantt title "Quantum Computing Roadmap (Revised 2026)" dateFormat YYYY axisFormat %Y section "NISQ Era" "Noisy Qubits (<1000)" :done, 2018, 2024 section "Early FTQC" "Break-even Point Demonstration" :done, 2024, 2026 "Hundreds of Logical Qubits" :active, 2026, 2028 section "Full-Scale FTQC" "1000+ Logical Qubits (Commercial App)" : 2028, 2030 "Universal Fault-Tolerant Quantum Computer" : 2030, 2035

6.1 Current Challenges and the Future

The biggest challenges as of 2026 are the cooling capacity of the massive cryostats (dilution refrigerators) needed to maintain ultra-low temperatures, and the wiring (I/O bottleneck) connecting room-temperature control equipment to the cryogenic quantum chips. In response, the development of Cryo-CMOS controller chips that operate in cryogenic environments is advancing rapidly.

Conclusion

2026 will likely be recorded in the history of quantum computing as “the first year of logical qubit scaling.” With the demonstration of error correction algorithms, the modularization of hardware, and rapid progress in the topological approach, “the day they become practical” is no longer a tale of the distant future but a concrete milestone to look forward to within the next few years. For developers and companies in the quantum algorithm space, now is the time to seriously invest in quantum-native problem solving.

This article was written based on the latest quantum computing research papers and industry trends as of 2026.