Whenever I see that headline I go find the paper first. And most of the time, the paper never said it.
The one doing the exaggerating is usually not the authors. It's whoever wrote about them.
Then a preprint went up on July 20th that did something unusual: it spent an entire section listing what it had not done.
Quantum Cryptanalysis on IBM Quantum Hardware: Extending Even–Mansour Period Recovery from N=4 to N=10 — seven authors, VIDRAFT AI Research, Seoul. cs.CR, CC BY 4.0.
Let's read it. No equations.
Start with a lock
You can't reason about every lock in the world at once, so cryptographers build the simplest possible one and study that.
Even–Mansour is that lock. One public permutation, one secret value XORed in front, one behind. That's the whole cipher. There is nothing left to remove.
Because it's minimal, it's a good object for proving things about why ciphers are secure. It's the crash-test structure, not the production car.
That's what this paper attacked. Not your banking app.
What quantum computers are actually good at
The threat isn't speed. It's that they're good at a different shape of problem.
One of those shapes is finding a hidden period.
Picture a very long wallpaper pattern. To find where it starts repeating, a classical machine walks the whole thing — and the work grows exponentially in the width of the pattern.
Simon's algorithm folds the wallpaper onto itself and reads off where it overlaps. Exponential becomes polynomial. That's been known since 1994.
And breaking Even–Mansour reduces exactly to that hidden-period problem — a result from the early 2010s (Kuwakado & Morii).
So the theory has been finished for over a decade. The problem was always the machine.
The gap between theory and hardware
Today's quantum processors are not quiet rooms. Qubits drift while you compute. Push the circuit a little deeper and the signal drowns in noise.
The largest previously reported real-hardware key recovery on this structure was N=4. Another group reported hitting a practical wall at N=5 because of tooling limits.
Those numbers look small. They are small. That's the honest state of the field.
This paper pushes the line to N=10 on IBM's ibm_kingston (Heron generation).
Where the paper gets interesting
Most papers would write "N=10 achieved" in bold and stop.
This one split the result into what was clean and what needed help:
| n | Qubits | True key rank | Method |
|---|---|---|---|
| 5 | 15 | 1 of 31 | clean recovery |
| 6 | 18 | 6 of 63 | hybrid |
| 7 | 21 | 3 of 127 | hybrid |
| 8 | 24 | 9 of 255 | hybrid |
| 9 | 27 | 15 of 511 | hybrid |
| 10 | 30 | 63 of 1,023 | hybrid |
Read it like this.
Through N=5, the quantum machine points straight at the answer — rank 1 out of 31 candidates.
From N=6 up, the quantum part narrows and a classical step verifies. At N=10 it pushes the true key into rank 63 out of 1,023. Vastly better than guessing. Not the same as solving it.
Is that "broken"? The paper's own answer: partially. Which is why it's in two columns.
One more detail I liked: every instance was re-run with a deliberately wrong key, and both ranks are reported side by side. They checked their own result against a control.
Also clean at rank 1: a 3-round Feistel (DES-family) at block sizes 6 and 8, and a 16-bit Bernstein–Vazirani secret in a single query.
The six limits, in the authors' own words
Section 5 is titled Limitations and Disclosure. Paraphrasing only lightly:
- No quantum advantage. These attacks asymptotically follow the birthday bound. Classical collision-finding achieves comparable scaling.
- Not AES-256 or RSA-2048. Targets are Even–Mansour, 3-round Feistel, CBC-MAC, and a reduced SPN.
- Not DES. A 3-round Feistel is a DES-family structure, not 16-round DES. This is structure disassembly, not "DES broken."
- World-first unconfirmed. "Largest reported" is pre-peer-review and stated to the best of their knowledge.
- Error mitigation, not correction. No fault tolerance here.
- Q2 oracle model. The attacker is assumed able to query the keyed primitive in superposition — and the authors state plainly that this is not always realistic.
That last one matters most. The Q2 model assumes your adversary can reach inside the box and ask questions in a way real attackers generally cannot.
So is my encryption fine?
Yes.
Nothing you use was broken. Concretely:
- AES — unaffected
- RSA — unaffected
- The target was a research structure, not a deployed cipher
- The size is n=10. Real ciphers use 128 or 256 bits
For scale, the paper notes that classically simulating this gets you to a wall fast: n=16 would need roughly 4.5 PB of statevector memory, and n=32 is simply not simulable. Their genuine-simulation ceiling is 25 qubits.
Humanity's real-hardware marker on this particular structure currently sits at n=10.
Then why do the work?
To measure the distance. "Someday quantum will threaten crypto" has been repeated for twenty years. Deciding when someday is requires someone to keep measuring what actual hardware can do. Moving N=4 to N=10 is one tick on that ruler.
Because migration is slow. Post-quantum migration takes a decade or more. You cannot start it after the threat lands.
To deflate the hype. Counterintuitively, more papers like this mean fewer "quantum broke encryption" headlines. Published real numbers are hard to inflate.
What I took from it
After enough technical reading you start to notice that what a team refuses to claim tells you more than what it claims.
This one cut its own result everywhere it could be cut. It could have written "N=10." It wrote "clean through N=5." It could have written "world first." It wrote "pre-peer-review, to the best of our knowledge." It volunteered that it hadn't touched AES, unprompted.
Which is why I believe the rest of the numbers.
Honesty isn't only modesty. Sometimes it's the strategy.
FAQ
Can a quantum computer break encryption today?
No. No published experiment, including this one, has broken a deployed cipher such as AES or RSA. Targets are reduced research structures.
What is Even–Mansour?
The minimal block-cipher construction — a public permutation with a secret value XORed on each side. Used to prove security properties, not to ship.
What does Simon's algorithm do?
Finds a hidden period. Exponential classically, polynomial on a quantum machine in the Q2 model.
Is n=10 big?
No. Real ciphers use 128+ bits. But on real hardware the prior maximum was n=4, so it's a meaningful step for the experimental frontier.
What should I do about it?
As an individual, nothing. As an organization, review your post-quantum (PQC) migration roadmap — it typically takes 10+ years.
Paper: arXiv:2607.18340 · 20 Jul 2026 · CC BY 4.0
Korean version of this essay: https://brunch.co.kr/@seawolf/154
Who did the work: VIDRAFT — foundation models, quantum computing, physical AI · https://vidraft.net
Top comments (0)