Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Forgive me if this should be in the crypto sub, but sometimes the answers there are very mathematical and I would rather have an answer which is a bit lighter on the math but still strong on the tech if at all possible.

However, I was watching the Cryptographer's panel from RSA 2013 and at about 33 minutes in they mentioned that ECC is more vulnerable than RSA in a post-quantum world.

share|improve this question
I'd guess because the numbers used in ECC are smaller (256-521 bit) vs. (1024-4096 bit), they require a smaller quantum computer to break. –  CodesInChaos Mar 22 '13 at 17:13

1 Answer 1

up vote 7 down vote accepted

The current challenge in building a quantum computer is to aggregate enough "qubits", entangled together at a quantum level for long enough. To break a 1024-bit RSA modulus, you need a quantum computer with 1024 qubits. To break a 160-bit elliptic curve, which has a "similar strength" (with regards to classical computers), you need something like 320 qubits. It is not that elliptic curves are intrinsically weaker; on the contrary, they still seem somewhat stronger than RSA for the same "size". Rather, the strength ratio for a given size is not the same when considering classical computers versus quantum computers.

share|improve this answer
Are you saying it's just the number of qubits that makes the difference? If we succeed at building a quantum computer with 320 qubits, it seems unlikely that we would not be able to build a 1024 qubit quantum computer (at least a very short time later). the decoherence problems that currently would prevent us from building a 320 qubit quantum computer, if solved, would also enable us to build a 1024 qubit quantum computer (as well as much larger ones). –  Eliah Kagan Mar 23 '13 at 12:18
Indeed, I don't think that the difference in robustness of ECC vs RSA against QC is really worth worrying. If a QC big enough to break ECC can be built at all, we can assume that RSA will not resist much further. –  Thomas Pornin Mar 23 '13 at 12:36
While it's true that a 320 qubit computer would only lag a 1024 would only lag 320 qubit computer by a few years, that IS what the question asked. Note that 320 qubits quantum computers are (arguably) already being produced. –  Indolering Sep 5 '13 at 17:40
No 320 bit general purpose computer have been produced. If you are speaking of DWave that is a unrelated field called Quantum Annealing which is utterly useless for breaking ECC or RSA. No large scale quantum computers capable of implementing Shor's algorithm are known to have been produced. For example the largest number factored with Shor's algorithm is "21" using a 5 qubit computer. –  Gerald Davis Mar 10 '14 at 17:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.