The beginning of the end for RSA? China's quantum breakthrough challenges global digital security
CybersecurityQuantum
Recently, researchers at Shanghai University, in collaboration with D-Wave Systems, demonstrated the ability of a real quantum computer to break RSA and SPN (Substitution-Permutation Network) encryption algorithms, even if on a small scale. The experiment, reported by Earth.com, represents a symbolic and technical milestone in the race for quantum supremacy.
Technical breakthrough
Using the D-Wave Advantage quantum system (more than 7,000 qubits), the team managed to factor a 22-bit RSA number, in addition to carrying out successful attacks on SPN ciphers such as Present and Rectangle.
The feat may look modest in scale compared with modern systems that use 2048-bit RSA, but it is unprecedented in form: it is the first practical application of quantum annealing to break cryptographic systems on real hardware.
The technique involved converting factoring into a binary optimization problem, solved through quantum tunneling, an unconventional approach compared with the famous Shor's algorithm.
Although the method still depends heavily on classical pre- and post-processing, the breakthrough confirms that the quantum threat to cryptography is no longer theoretical.
Impact on networks, firewalls and cybersecurity
"Q-Day", the moment when quantum computers will break modern security keys in useful time, has not arrived yet, but it is getting closer. With that, the integrity of VPNs, firewalls, digital certificate authentication and communication between APIs is at risk in the medium term.
How to start preparing
1. Crypto-asset audit. Map all the systems and services that use:
- RSA, ECC, DH or DSA;
- TLS, VPN, SSH and S/MIME protocols with algorithms that are not quantum-resistant;
- Long-lived digital certificates.
2. Adoption of post-quantum cryptography (PQC).
- Implement hybrid libraries (e.g. Kyber + RSA, HQC + ECC) to ensure a safe transition;
- Use NIST-compliant libraries in pilot tests (e.g. OpenQuantumSafe, BouncyCastle PQC).
3. Crypto-agility policies.
- Establish formal governance for algorithm rotation and system updates;
- Avoid "hard-coding" algorithms in software and firmware;
- Develop contingency plans for large-scale certificate and API updates.
4. Monitoring and training.
- Follow the NIST PQC and European PQCrypto projects, and initiatives such as Quantum-Safe Canada;
- Train security and architecture teams on the implications of quantum computing;
- Map partners and vendors that are already adapting to the post-quantum model.
Although the Shanghai University experiment is still far from breaking RSA-2048, the technical symbolism of the feat is significant: we are on a countdown to the reinvention of modern cybersecurity. The time to get organized is now, while we still have predictability.