Break it
yourself.
Five exhibits. The keys are toy-sized so this tab can break them before you scroll; the algorithms, the arithmetic and the post-quantum library are the real ones. Nothing here touches your wallet.
Everything runs in your browser. Where a number comes from a paper it says so; where a reveal is staged it says so.
Crack a key.
Right now.
A private key x in a group of 2^22 elements, a public key g^x mod p. Your browser tries every x, derives the public key and compares. Same shape of problem as a wallet key, on a group small enough to finish before you scroll. The rate is measured, the extrapolation is arithmetic.
- this toy, expected half of 2^22
- —
- Ed25519, brute force, 2^252 keys
- —
- Ed25519, best classical (Pollard rho, 2^126 steps)
- —
- Ed25519, Shor on a fault-tolerant quantum computer
- hours to days · see 03
Every extra bit doubles the work: try 26-bit. Ed25519 has 226 more. A GPU farm is maybe a million times faster than this tab, which moves the exponent by six.
Nobody brute-forces Ed25519 and nobody needs to. The numbers above say why the slow way is hopeless; exhibit 02 is the fast way.
Shor,
step by step.
The algorithm that breaks RSA and every elliptic curve, on the smallest number it makes sense for. The arithmetic is exact and classical: a laptop simulates these twelve qubits in milliseconds. A real machine does the same to 256-bit curves; the hard part is building it.
We want the factors of N = 15. Pick a base a coprime with 15; the quantum part then finds the period of a^x mod 15, and the period gives the factors. Not every base works, which is part of the algorithm.
- x=01
- x=17
- x=24
- x=313
- x=41
- x=57
- x=64
- x=713
- x=81
- x=97
- x=104
- x=1113
- x=121
- x=137
- x=144
- x=1513
The spectrum appears at step 4.
- gcd(a, N)
- ·
- period r
- ·
- a^(r/2) mod N
- ·
- gcd(a^(r/2) ∓ 1, N)
- ·
- result
- ·
Ed25519 turns one public key into one period-finding problem. Shor does not guess the key, it reads it off the peaks.
The same attack,
on a post-quantum key.
Shor turns a curve key into a period-finding problem and solves it in polynomial time. A lattice key offers no period to find: the best known attacks, quantum included, still face an exponential wall. The arithmetic for that wall is below, with the speed assumption yours to change.
- problem
- discrete log, 256-bit curve
- quantum algorithm
- Shor, polynomial
- logical qubits
- ≈ 2,330 (Roetteler 2017)
- Toffoli gates
- 1.3e11 (2017) · 5e7 (Litinski 2023)
- at 1e6 logical gates / s
- 1.5 days · 50.0 s
- physical machine
- < 1M noisy qubits, < 1 week for RSA-2048 (Gidney 2025)
- 256-bit curves
- fewer resources than RSA-2048
- exists today
- no; error-corrected demos hold tens of logical qubits
Hours to days, once the machine exists.
- problem
- Module-LWE, lattice in 768 dimensions
- quantum algorithm
- none with an exponential speed-up
- best known
- lattice sieving; quantum gains at most quadratic
- security category
- 3, like AES-192: 2^192 operations
- core-SVP, Kyber-768 spec
- 2^182 classical · 2^165 quantum
- Grover on the floor
- 2^96 steps; k machines buy only a factor √k
Longer than the age of the universe, at any speed on the slider.
as hard as an AES-192 key search
- operations
- 2^192 = 6.28e57
- ops per second
- 1.0e12
- seconds
- 6.28e45
- years
- 1.99e38
- age of the universe
- 1.38e10 years
- that is
- 1.4e28 universes
No quantum computer runs logical gates anywhere near 1e9 per second; the slider goes past every machine on paper to make the point. Grover is the one quantum gain on this side: it halves the exponent at best, it parallelises badly (k machines buy only a factor √k, so the exponent does not move), and the category 3 target already accounts for it.
A fault-tolerant quantum computer gets your Ed25519 key in hours. It gets your ML-DSA-65 passport key never, as far as anyone knows; that gap is the whole product.
Lattice,
closest vector.
Every dot is a point of one lattice. Drop a target anywhere and ask for the nearest dot. With the short, nearly orthogonal basis, rounding the coordinates lands on it in one step. With the long, skewed basis that describes the very same dots, the same rounding lands far away.
- basis vectors
- b1 = (5, 1) · b2 = (-1, 4) · |b1| 5.1 · |b2| 4.1
- target t
- (13.5, -6.2)
- t in this basis
- 2.28 b1 − 2.12 b2
- rounded
- 2 b1 − 2 b2 = (12, -6)
- error
- 1.51 · the closest point
- private basis would give
- 1.51
- public basis would give
- 30.06
Both bases span the same lattice: the public one is the private one times a unimodular matrix. In two dimensions a reduction algorithm recovers the short basis instantly; in 768 the best reductions run out of universe, which is the hardness ML-KEM is built on.
ML-KEM hides a short basis in a lattice of 768 dimensions and publishes a long one. Decrypting is rounding with the short basis; attacking is rounding without it, and in hundreds of dimensions nobody, quantum or not, knows how.
Harvest now,
decrypt later.
Everything recorded today can be opened then. One sentence, sealed twice: once to a key on the curve your wallet uses, once to an ML-KEM-768 key from the real library. Both ciphertexts are copied to an archive the moment they cross the wire. Move the year.
The reveal is staged: this page can show the sentence because it encrypted it. Everything else is real, the keys, the sizes, the timings, and the fact that a 32-byte public key is all Shor needs.
A key exchange or message encrypted to a curve key today is readable by whoever stored it, on Q-Day. The inbox encrypts to your passport's ML-KEM key for exactly this reason.