AI
How Shor’s Algorithm Finds RSA Keys
Shor’s algorithm recovers the private factors p and q from a public modulus n by finding the period of the function f(x) = a^x mod n. For a toy example with n=15 and a=13, the function repeats every 4 steps, producing candidates 5 and 3 via the greatest common divisor. The critical step — order finding — is a signal processing problem that quantum computers solve exponentially faster using a quantum Fourier transform. The same approach breaks elliptic curve cryptography as well; a 2024 Microsoft paper showed ECC is actually easier to attack than RSA on quantum hardware.
Recent Hardware Acceleration
In February 2025, startup Iceberg Quantum published a paper that reduces the physical qubit requirement for breaking RSA-2048 from ~1 million to ~100,000 by swapping the error-correction architecture from 2D surface code to low-density parity check codes. Craig Gidney at Google Quantum AI described the advance as accelerating the migration timeline by at least two years. IonQ’s public roadmap projects 1,600 logical qubits in 2028, 8,000 in 2029, and 80,000 in 2030 — far beyond the ~1,400 logical qubits needed for RSA-2048. Harvest-now-decrypt-later attacks make early migration essential.
NIST Standards and the Migration Timeline
NIST’s 2016 competition produced four algorithms standardized by 2024: ML-KEM (FIPS 203, formerly Kyber) for key encapsulation, ML-DSA (FIPS 204, formerly Dilithium) and SLH-DSA (FIPS 205) for signatures. Falcon is still pending due to floating-point complications. The official deprecation timeline calls for stopping RSA-2048 and 112-bit-strength algorithms by 2030, and full transition away from RSA and ECC by 2035. Filip argues this timeline is too slow, especially for key encapsulation. Key sizes grow significantly — ML-KEM adds 1–1.5 KB of handshake data; ML-DSA signatures are ~3 KB compared to RS256.
Getting Started with Post-Quantum .NET
The biggest milestone was OpenSSL 3.5 (April 2025), shipping ML-KEM, ML-DSA, and SLH-DSA. Debian Trixie and Alpine 3.22 include it. On Windows, Microsoft added support in November 2025 via CNG; .NET 10 exposes these algorithms through system.security.cryptography. For maximum portability, Bouncy Castle provides fully managed implementations that run in WASM or on older .NET versions. Filip’s liboqs.net wraps the Open Quantum Safe C library, offering 9 key-encapsulation families and 7 signature families across x64 and arm64. A demo showed pure post-quantum TLS: an ASP.NET Core app on Trixie used ML-KEM 768 for key exchange and an ML-DSA certificate for authentication, verified from an OpenSSL 3.5 client.
Beyond TLS: End-to-End Encryption and Token Signing
Filip built a Blazor WASM chat app that performs ML-KEM key encapsulation in the browser using Bouncy Castle. Each client generates a key pair on join; the public key is broadcast via SignalR. One participant triggers a negotiation: the ciphertext goes over the wire, the recipient decapsulates with their private key, and both sides share a 32-byte secret for AES-256. For token-based authentication, he created Stratis Web Dilithium Duende Identity Server and Stratis Web Dilithium ASP.NET Core packages. A live demo configured Duende Identity Server to sign JWT tokens with ML-DSA-65, producing a 3.3 KB signature. The downstream API, after adding the NuGet package, validated the token successfully.
Notable Quotes
if you are planning to look into this thing only, you know, when it becomes a a real pressing threat, then it might be too late. Filip W. · ▶ Watch (27:01)
with ML-KEM, the amount of data that needs to be transferred between the client and the server would be a kilobyte, a kilobyte and a half larger than what we are doing today Filip W. · ▶ Watch (36:38)
This is not by no means this is not a reference implementation on how you should do an end-to-end encrypted chat. Filip W. · ▶ Watch (53:48)
So, according to my timer, we are at 59 minutes 42 seconds, which means there will be no questions. Filip W. · ▶ Watch (58:33)
Key Takeaways
- Iceberg Quantum cut the qubit requirement for breaking RSA-2048 by 10x, accelerating migration timelines by at least two years.
- .NET 10 exposes ML-KEM and ML-DSA through system.security.cryptography, backed by CNG on Windows and OpenSSL 3.5 on Linux.
- Bouncy Castle and liboqs.net enable post-quantum cryptography in WASM and cross-platform .NET applications.
About the Speaker(s)
Filip is a dual Microsoft MVP, author of the academic textbook “Introduction to Quantum Computing with Q# and QDK” and an open source contributor. He specializes in cloud technologies and quantum computing. Filip is based in Zürich where he works in the medical industry as a Cloud Architect.