The Quantum Question Panel – Live from zkSummit14

The panel opened with Justin Drake identifying three distinct cryptographic layers Ethereum must replace under a quantum threat: BLS signatures at the consensus layer, KZG commitments at the data availability layer, and ECDSA at the execution layer. He added that pairing-based proof systems including Groth16 and Plonk would also break, meaning the ZK proof infrastructure itself is not quantum-safe.

The relevant threat is a cryptographically relevant quantum computer requiring fault-tolerant error correction, which Drake put at roughly one thousand logical qubits to break cryptography. Logical qubits do not yet practically exist, with only proof-of-concept demonstrations achieved. Real-time decoding was identified as the outstanding engineering bottleneck, requiring FPGAs or GPUs to perform ultra-low-latency classical processing many times per second, with Nvidia, Google, and other labs now dedicating teams to the problem. Jens Grott argued that qubit count is not the core constraint because circuits can be replicated, and that the real barrier is engineering problems in error correction where solving one noise floor typically reveals another. He recommended protocols target readiness for a potential break within four years, requiring preparation to begin within two years.

Drake made the case that neutral atom platforms are the most likely path to a cryptographically relevant machine. Neutral atoms require only around ten thousand physical qubits to run Shor's algorithm on a single processor, compared to superconducting platforms where a one-thousand-to-one logical-to-physical ratio demands one million physical qubits, far exceeding single-processor capacity. Superconducting qubits face yield problems that approach zero at scale and are currently limited to a few hundred qubits. Neutral atoms achieve three nines fidelity and allow physical reconfiguration for all-to-all connectivity. The tradeoff is speed: neutral atoms are roughly one thousand times slower in cycle time than superconducting qubits, and running Shor's algorithm would require approximately one hundred million Toffoli gates each taking about one millisecond, totaling around ten days of computation. Dan Bonet added that neutral atom systems are roughly one cubic meter, use mostly off-the-shelf optical equipment, and cost a couple of million dollars, compared to superconducting systems where wiring alone for one million qubits would cost billions. A major compilation breakthrough in the last couple of years made neutral atom logical-to-physical qubit conversion roughly one hundred times more efficient than prior methods, which Drake described as significantly changing the feasibility picture.

Justin revised his probability estimate of a cryptographically relevant quantum computer arriving by 2032 three times: roughly one percent before October 2025, approximately ten percent after receiving early access to a Google paper draft in February 2026, and then fifty percent following the concurrent publication of that Google paper alongside a neutral atoms paper. He defines effective Q day as the point at which probability reaches roughly ten percent, which he uses as his working planning deadline. The 2029 transition deadline is not a prediction that quantum computers will exist in 2029 but a completion target driven by a ten percent probability estimate for a cryptographically relevant machine by 2030. Missing the target by three years to 2032 may still be safe, but missing a 2035 target by three years would put security into dangerous territory. Error correction only began working in 2024, and factoring 21 with Shor's algorithm, which requires approximately 200 error-corrected gates, is now approaching feasibility within a year or two.

On migration risks, one panelist cautioned that a rush to post-quantum carries its own dangers, citing a case where a company moved MLDSA operations out of an HSM into a CPU in the clear because the HSM lacked MLDSA support, increasing classical attack exposure far more than any quantum risk it was trying to address. Intel announced its processor will only be post-quantum in 2030, meaning microcode updates will be signed by pre-quantum signatures until that date, so migrating a system does not fully protect it if the underlying processor still accepts pre-quantum signed microcode. Google has set a 2029 deadline partly to create pressure on hardware providers to deliver support in time.

X-Wing, a hybrid of ML-KEM and ECDH, is the recommended approach for upgrading protocols to post-quantum encryption and is already deployed on the web. Grover's algorithm offers only a quadratic speedup with a large constant making it practically irrelevant, and key size choices should be driven by multi-target attacks rather than Grover considerations. Drake argued that XMSS Merkle signatures, being fifty years old and extremely simple, are a more conservative choice than lattice-based schemes for systems intended to last decades. Lattice assumptions are approximately thirty years old and may not be fully battle tested because there has been limited real-world incentive to break them, and the isogeny-based system SIKE was broken not by a new algorithm but because an existing capable algorithm had been overlooked. The panel also noted that Zcash Sprout is ironically closer to post-quantum than its successor Sapling because Sprout relies on hash preimages rather than elliptic curves, and that a post-quantum circuit design today would use symmetric primitives rather than elliptic curves inside circuits, with Poseidon 1.1 described as fine to use despite recent cryptanalysis of Poseidon 2.