The Real Cryptography Behind a Fictional Quantum Machine

Most of the cryptography around that machine is not invented. Inventing cryptography would have been harder than looking it up, and considerably less interesting. Below are seven details a reader could reasonably assume were fiction, each traced to the standard, paper, or document it came from. Every source is named precisely enough to check.

Everything discussed here appears in the first eight chapters of thirty. There are no plot spoilers past the opening act.

1. The padding, and the number 65537

In chapter one, the API reports the submitted ciphertext as “RSA-4096 with OAEP padding.” A few paragraphs later the protagonist checks his key and notes that “the public exponent was 65537.”

Both are conventional choices. OAEP is Optimal Asymmetric Encryption Padding, specified as RSAES-OAEP in section 7.1 of RFC 8017, the IETF’s informational republication of PKCS #1 version 2.2 [1]. Bellare and Rogaway introduced it at EUROCRYPT 1994 to turn a trapdoor permutation such as RSA into randomized encryption with stronger security properties [2]. Four years later, Daniel Bleichenbacher demonstrated a chosen-ciphertext attack against protocols using the older PKCS #1 v1.5 encryption, which strengthened the practical case for moving [3]. Padding is not decoration. In that attack the v1.5 format and the protocol’s response to malformed ciphertext together supplied a validity oracle.

65537 is 2¹⁶ + 1, the Fermat number F4. NIST SP 800–56B Revision 2 specifies the public exponent as “an odd integer, such that 65,537 ≤ e < 2²⁵⁶”, making that value the bottom of the permitted range rather than one recommendation among several [4]. Very small exponents are avoided not because they are broken outright but because they are unforgiving of misuse: Håstad’s CRYPTO ’85 work on low-exponent RSA and Coppersmith’s 1997 paper on small solutions to polynomial equations both concern conditions such as raw, related, or insufficiently randomized messages [5][6].

A reader who assumed 65537 was a randomly chosen large-looking number would be reading one of the most common public exponents in deployed RSA.

2. Signal and Chrome shipped Kyber before the standard existed

Chapter three describes ML-KEM as “the algorithm family that Signal had built into PQXDH alongside its classical handshake” and “the algorithm that Google was already shipping inside Chrome’s hybrid key exchange.”

This reads as near-future extrapolation. It is not. Signal announced PQXDH on 19 September 2023, describing a shared secret computed “using both the elliptic curve key agreement protocol X25519 and the post-quantum key encapsulation mechanism CRYSTALS-Kyber” [7]. Google announced hybrid Kyber for Chrome on 10 August 2023, shipping in Chrome 116 [8]. Both predate the novel.

That sentence says family, not ML-KEM, and the distinction is not cosmetic. Signal deployed CRYSTALS-Kyber. FIPS 203 did not exist yet; it was published on 13 August 2024, and ML-KEM is the name NIST gave the algorithm “derived from CRYSTALS-KYBER” in that standard [9]. Chrome made the same transition later, moving from the X25519Kyber768 codepoint to X25519MLKEM768 in Chrome 131 [10]. Signal’s own follow-up work, the Sparse Post Quantum Ratchet announced on 2 October 2025, uses the ML-KEM naming directly [11]. In both cases the deployment came first and the standard caught up to it.

3. What the machine refuses, and what that does not protect

By the middle of chapter three the protagonist has drawn two columns on a whiteboard. On the left, everything the API broke. On the right, “everything it refused: AES-256, AES-128, SLH-DSA, Classic McEliece.”

The column is consistent with known quantum cryptanalysis, though not compelled by it. Shor’s algorithm gives an efficient route against factoring and discrete logarithms [12][13]. It does not attack symmetric ciphers. The relevant quantum result for AES is Grover’s 1996 search algorithm, which is quadratic rather than exponential [14]. The common shorthand is that Grover halves the effective strength of a symmetric cipher, putting AES-256 at roughly 128 bits. NIST’s own position is more cautious. Its post-quantum cryptography FAQ notes that “it was proven by Zalka in 1997 that in order to obtain the full quadratic speedup, all the steps of Grover’s algorithm must be performed in series,” and concludes that “it is quite likely that Grover’s algorithm will provide little or no advantage in attacking AES, and AES 128 will remain secure for decades to come” [15]. That is why AES-128 sits on the right too. The napkin arithmetic would have put it on the left.

The other two names are there on different arguments. SLH-DSA, standardized as FIPS 205 on 13 August 2024 [16], is a hash-based signature scheme: no factoring underneath it, no discrete logarithm, no lattice, no number-theoretic assumption at all beyond what its hash functions must satisfy. If the algebra the rest of deployed cryptography rests on turns out to be wrong, it still stands. The cost is signature size. Classic McEliece is a key encapsulation mechanism on binary Goppa codes, resting on two assumptions: that decoding is hard, and that those codes look random. The novel calls it “the code-based encryption scheme with the enormous public keys that nobody deployed because they were too large for practical use,” and the size aside is accurate to the byte: 261,120 bytes for mceliece348864, 1,357,824 for mceliece8192128. NIST did not select it, and describes quantum information-set-decoding as a generic Grover-based speedup that does not break its parameters [17].

Here is what the whiteboard does not say, and the novel is careful enough to show it two chapters later: being in the right-hand column protects the algorithm, not the message. In chapter five the protagonist opens an archive of human rights correspondence “encrypted with PGP using 4096-bit RSA keys and AES-256 as the symmetric cipher,” and “the API broke the RSA envelope on each message in under two seconds, recovering the symmetric key inside.” OpenPGP works exactly that way: the sending implementation “generates a random session key for this message”, and “the session key is encrypted using each recipient’s public key” [18]. Recover that session key out of the RSA packet and AES-256 is still unbroken, but those ciphertexts no longer keep their plaintext confidential. Primitive security and message security are not the same property, and only one of them was on the whiteboard.

4. The padlock

Later in chapter three the protagonist stops testing and points the thing at himself. He loads his own bank’s login page, “the padlock icon sitting in the address bar like it meant something,” captures the handshake, and watches his browser and the server “negotiating a session key through ECDHE, exchanging ephemeral public values over the wire.” He submits those values. The API returns the session key. Four words follow, and they are the reason the scene exists: “The padlock was a lie.”

The word carrying the weight is ephemeral. RFC 8446 states that in TLS 1.3 “all public-key based key exchange mechanisms now provide forward secrecy” [19], and the guarantee is narrower than it is usually repeated. Later compromise of the long-term authentication key does not reveal the session keys of handshakes already completed, provided the ephemeral private values and the secrets derived from them were erased. Stealing the server’s certificate key next year does not open this year’s sessions.

What gets erased is the private half. The public ECDHE shares stay in the captured transcript, and they are elliptic-curve public values like any other. Anyone who can compute discrete logarithms recovers an ephemeral private value from that transcript, reconstructs the shared secret, and derives the traffic keys. Forward secrecy assumes the hard problem stays hard; a machine that solves it removes the assumption rather than defeating the mechanism.

By this point the machine has demonstrated both capabilities Shor supplies: factoring and discrete logarithms. What happens next is what proves it is more than Shor.

5. The inference about lattices is real reasoning

The passage I am most willing to defend is a piece of deduction rather than a fact:

Kyber wasn’t built on factoring or discrete logs. It was built on lattice problems, a completely different mathematical foundation. If something could break both RSA and Kyber, it wasn’t just running Shor’s algorithm.

This is how the character works out that he is looking at something stranger than a quantum computer, and the reasoning holds. Shor’s algorithm solves integer factorization and the discrete logarithm problem [13]. Lattice problems are a separate hardness assumption. Oded Regev’s 2005 paper introduced Learning With Errors and gave a reduction from worst-case lattice problems to average-case LWE [20]; Langlois and Stehlé extended that to module lattices, the structure underlying ML-KEM and ML-DSA [21]. FIPS 203 states the connection directly: “the security of ML-KEM is related to the computational difficulty of the Module Learning with Errors problem” [9].

The reduction is weaker than it is usually described, in two ways worth naming. It is itself quantum, and it is asymptotic, so it does not certify the concrete parameter sets ML-KEM actually ships. It provides a qualitative foundation; confidence in the shipped parameters rests on cryptanalysis and attack-cost estimates built on top of it.

6. Traffic collected years before anyone could read it

Chapters five and seven turn on an archive of intercepted traffic that becomes readable only once the machine exists. The novel puts it plainly: “the archive existed because agencies collected everything and decrypted later.” The scale in that sentence is the novel’s; what follows is the part that is documented.

This is harvest now, decrypt later, and it is why post-quantum migration has a deadline not tied to when a quantum computer appears. The initial public draft of NIST IR 8547 states it directly: “Encrypted data remains at risk because of the ‘harvest now, decrypt later’ threat in which adversaries collect encrypted data now with the goal of decrypting it once quantum technology matures”, and says this “underscores the necessity of acting immediately, especially for data with long-term sensitivity, such as government secrets or medical records” [22]. CISA, the NSA, and NIST said the same in a joint factsheet in August 2023 [23].

One point of precision. The phrase “harvest now, decrypt later” never appears in the novel’s narrative prose. The concept is dramatized; the term itself shows up only in the author’s note.

7. The legal architecture is real

In chapter four, an NSA analyst requisitions collection from partner agencies and gets it: “GCHQ provided intercepts from two of the relay nodes, ASD contributed metadata from a Pacific routing hub…”

Those are real agencies, and the details of the arrangement that lets them pass material to each other were jointly declassified by the NSA and GCHQ in June 2010 [24]. Executive Order 12333, signed by President Reagan on 4 December 1981, assigns the NSA responsibility for “establishment and operation of an effective unified organization for signals intelligence activities” [25].

That picture is routinely simplified. EO 12333 is a broad framework for US intelligence activity, not a gap-filler bolted onto statute. Some collection abroad happens under it, outside FISA’s acquisition regime, while still bound by statute, executive-order limits, Attorney General approved procedures, and the Constitution. Separately, FISA section 702 authorized targeting non-US persons reasonably believed to be abroad, through US service providers, under annual programmatic review by the Foreign Intelligence Surveillance Court rather than an individualized warrant per target [26]. That authority lapsed on 12 June 2026. Collection continues under a certification the court approved in March 2026, which FISA’s transition provisions keep in force until it expires, reportedly around March 2027, and no new or renewed certification can issue while the lapse continues [27].

The book uses the practice’s real name, parallel construction, rather than reaching for a euphemism. It has a documented source. Reuters reported in August 2013 that agents working with the Drug Enforcement Administration’s Special Operations Division were trained to reconstruct investigative trails so the origin of a tip would not surface, instructing that “the utilization of SOD cannot be revealed or discussed in any investigative function” [28]. The Justice Department’s Inspector General examined the agency’s bulk-data programs in a report reissued in March 2025 with previously redacted material made public [29].

The programs in the novel are fictional. The gaps they exploit are the ones that already exist.

What I did invent

The machine. No fault-tolerant quantum computer capable of breaking RSA-4096 has been publicly demonstrated. Invented with it: the agency programs and their codenames, and the classified capability timeline. So is the OpenSSL version the protagonist checks in chapter one. That version number never existed and now never will: the 3.6 series was followed by 4.0, so there is no 3.7 branch to release it into [30].

How far away the hardware is

Further than the novel needs, and nobody can give you a single number.

Craig Gidney’s May 2025 paper concluded that “a 2048 bit RSA integer could be factored in less than a week by a quantum computer with less than a million noisy qubits” [31], revising the 20-million figure he and Martin Ekerå published in 2021 [32]. Estimates have fallen again since, and they disagree. Iceberg Quantum puts RSA-2048 at “fewer than one hundred thousand physical qubits” using quantum low-density parity check codes, about 94,000 for a month of running, while noting that a fast enough real-time decoder is “outside the scope of this paper” [33]. Q-CTRL, costing against an experimentally demonstrated coupling topology, arrives at 381,000 qubits for 9.2 days [34]. A neutral-atom paper is titled for “as few as 10,000 reconfigurable atomic qubits”, but that headline is an elliptic-curve result: its own figures put RSA-2048 at roughly 118 years on 11,000 qubits, reaching 97 days only near 102,000 [35]. All three are preprints with commercial affiliations.

Against those estimates, three recent gate-model systems cited here hold about a hundred physical qubits: Willow at 105, Nighthawk at 120, Helios at 98 [36][37][38]. Larger machines exist, but raw count alone is not a measure of fault-tolerant capacity. A Caltech group held 6,100 atoms coherently in September 2025 [39], and a Harvard and MIT led team reported “up to 96 d = 4 logical qubits active simultaneously” across 448 atoms [40]. Physical qubits, coherent atoms and error-corrected logical qubits are three different quantities, none converting cleanly into what a resource estimate counts. That is why the gap has no tidy expression, not because it is small.

The novel breaks RSA-4096, and that size has a published price too. Table 3 of the 2021 Gidney and Ekerå paper tabulates seven modulus sizes; the 4096-bit row comes to 55 million physical qubits at 22 hours per run [32]. A model-dependent estimate, not a demonstration. Classically, RSA-250 at 829 bits remains the record for factoring a general RSA Challenge semiprime, set in February 2020 [41]. The RSA-2048 challenge modulus is unfactored, and no public factorization of a well-generated 4096-bit modulus is known.

Whether a standard could still fall

The bigger invention is the break itself. In chapter three the lattice schemes fail, and nothing like that has happened.

The premise is not absurd, though. Two schemes that survived multiple NIST rounds were broken by public cryptanalysis rather than by a quantum computer. Against the SL 1 parameters of Rainbow’s second-round submission, Ward Beullens’ attack “returns the corresponding secret key after on average 53 hours (one weekend) of computation time on a standard laptop” [42]. Castryck and Decru broke SIDH, the basis of the fourth-round candidate SIKE; the current version of their paper reports breaking SIKEp434 “in about ten minutes on a single core” [43]. Neither needed exotic hardware. Both landed on schemes that had cleared years of review.

Claims against the lattice standards have been made and have not survived contact. Yilei Chen posted a preprint on 10 April 2024 claiming a polynomial-time quantum algorithm for lattice problems; on 18 April he added a note saying “Step 9 of the algorithm contains a bug, which I don’t know how to fix”, crediting Hongxun Wu and, independently, Thomas Vidick with finding it that day [44]. In May 2026 Ming-Xing Luo claimed a quantum attack on ML-KEM [45]. Analysis published days later identified an apparently fatal problem: what the attack recovers is identical for two instances sharing a public matrix but differing in their secrets, so it cannot be recovering the secret [46].

Neither is settled by me, and neither is peer reviewed. What can be said is narrower than “unbroken”: no accepted attack defeats ML-KEM or ML-DSA in their intended security models. That is a claim about the mathematics, not about deployments. Side-channel and fault attacks on implementations are a live research area, and an algorithm can be sound while the thing running it is not.

The book’s own author’s note says this in print, and it is worth repeating verbatim:

The novel takes a darker view of the lattice-based schemes among them, ML-KEM and ML-DSA, than reality currently warrants. In the real world, they remain our best defense against a future quantum adversary. Use them. Push your vendors to use them.

The second half of that is the operative part. Nobody reading this should be implementing ML-KEM by hand. Use standardized post-quantum cryptography through vetted libraries and protocols built for algorithm agility, and make your suppliers do the same.

If you find something in this essay that is wrong, I would like to know. The claims are sourced below so that they can be checked rather than taken on trust.

Sources:

IETF, “RFC 8017: PKCS #1: RSA Cryptography Specifications Version 2.2”, November 2016.
Mihir Bellare and Phillip Rogaway, “Optimal Asymmetric Encryption”, EUROCRYPT 1994, LNCS 950, pp. 92–111.
Daniel Bleichenbacher, “Chosen Ciphertext Attacks Against Protocols Based on the RSA Encryption Standard PKCS #1”, CRYPTO ’98, LNCS 1462, pp. 1–12, 1998.
NIST, “SP 800–56B Rev. 2: Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography”, March 2019.
Johan Håstad, “On Using RSA with Low Exponent in a Public Key Network”, CRYPTO ’85, LNCS 218, pp. 403–408, 1985.
Don Coppersmith, “Small Solutions to Polynomial Equations, and Low Exponent RSA Vulnerabilities”, Journal of Cryptology 10, pp. 233–260, 1997.
Signal, “Quantum Resistance and the Signal Protocol”, 19 September 2023.
Chromium Blog, “Protecting Chrome Traffic with Hybrid Kyber KEM”, 10 August 2023.
NIST, “FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard”, 13 August 2024.
Google Security Blog, “A new path for Kyber on the web”, 13 September 2024.
Signal, “Signal Protocol and Post-Quantum Ratchets”, 2 October 2025.
Peter W. Shor, “Algorithms for Quantum Computation: Discrete Logarithms and Factoring”, 35th Annual Symposium on Foundations of Computer Science, pp. 124–134, 1994.
Peter W. Shor, “Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer”, SIAM Journal on Computing 26(5), pp. 1484–1509, 1997.
Lov K. Grover, “A Fast Quantum Mechanical Algorithm for Database Search”, 28th Annual ACM Symposium on Theory of Computing, pp. 212–219, 1996.
NIST, “Post-Quantum Cryptography FAQs”, accessed 3 August 2026.
NIST, “FIPS 205: Stateless Hash-Based Digital Signature Standard”, 13 August 2024.
NIST, “NIST IR 8545: Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process”, March 2025.
IETF, “RFC 9580: OpenPGP”, July 2024.
IETF, “RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3”, August 2018.
Oded Regev, “On Lattices, Learning with Errors, Random Linear Codes, and Cryptography”, 37th ACM Symposium on Theory of Computing, pp. 84–93, 2005; Journal of the ACM 56(6), 2009.
Adeline Langlois and Damien Stehlé, “Worst-Case to Average-Case Reductions for Module Lattices”, Designs, Codes and Cryptography 75(3), pp. 565–599, 2015.
NIST, “NIST IR 8547 ipd (initial public draft): Transition to Post-Quantum Cryptography Standards”, 12 November 2024.
CISA, NSA, and NIST, “Quantum-Readiness: Migration to Post-Quantum Cryptography”, 21 August 2023.
NSA, “Declassified UKUSA Signals Intelligence Agreement Documents Available”, 24 June 2010.
“Executive Order 12333: United States Intelligence Activities”, 4 December 1981.
Privacy and Civil Liberties Oversight Board, “Report on the Surveillance Program Operated Pursuant to Section 702 of the Foreign Intelligence Surveillance Act”, Staff Report, 2 April 2026 (not voted on by a quorate Board).
Congressional Research Service, “The Impact of FISA Section 702’s Repeal”, Legal Sidebar LSB11444, 22 June 2026.
John Shiffman and Kristina Cooke, “Exclusive: U.S. directs agents to cover up program used to investigate Americans”, Reuters, 5 August 2013.
US Department of Justice Office of the Inspector General, “A Review of the Drug Enforcement Administration’s Use of Administrative Subpoenas to Collect or Exploit Bulk Data”, Report 19–01, reissued 11 March 2025.
OpenSSL Library, “Release and Advisory Timeline”, accessed 3 August 2026.
Craig Gidney, “How to factor 2048 bit RSA integers with less than a million noisy qubits”, arXiv:2505.15917, 21 May 2025.
Craig Gidney and Martin Ekerå, “How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits”, Quantum 5, 433, 2021.
Paul Webster et al., “The Pinnacle Architecture: Reducing the cost of breaking RSA-2048 to 100 000 physical qubits using quantum LDPC codes”, arXiv:2602.11457, 12 February 2026 (revised 5 May 2026).
Pranav Mundada et al., “Heterogeneous architectures enable a 138x reduction in physical qubit requirements for fault-tolerant quantum computing under detailed accounting”, arXiv:2604.06319, 7 April 2026.
Madelyn Cain et al., “Shor’s algorithm is possible with as few as 10,000 reconfigurable atomic qubits”, arXiv:2603.28627, 30 March 2026.
Google, “Meet Willow, our state-of-the-art quantum chip”, 9 December 2024.
IBM, “IBM Delivers New Quantum Processors, Software, and Algorithm Breakthroughs on Path to Advantage and Fault Tolerance”, 12 November 2025.
Quantinuum, “Quantinuum Announces Commercial Launch of New Helios Quantum Computer”, 5 November 2025.
Caltech, “Caltech Team Sets Record with 6,100-Qubit Array”, 24 September 2025.
Dolev Bluvstein et al., “A fault-tolerant neutral-atom architecture for universal quantum computation”, Nature 649, pp. 39–46, 2026 (published online 10 November 2025).
Fabrice Boudot, Pierrick Gaudry, Aurore Guillevic, Nadia Heninger, Emmanuel Thomé, and Paul Zimmermann, “Factorization of RSA-250”, 28 February 2020.
Ward Beullens, “Breaking Rainbow Takes a Weekend on a Laptop”, IACR ePrint 2022/214, 25 February 2022; CRYPTO 2022.
Wouter Castryck and Thomas Decru, “An efficient key recovery attack on SIDH”, IACR ePrint 2022/975, 30 July 2022; EUROCRYPT 2023.
Yilei Chen, “Quantum Algorithms for Lattice Problems”, IACR ePrint 2024/555, 10 April 2024.
Ming-Xing Luo, “Module Lattice Security (Part IV): Probabilistic Polynomial Quantum Attack on Module-LWE over 2-Power Cyclotomics”, arXiv:2605.17412, 17 May 2026.
Marin Ivezic and Jasmine Sandler, “Paper Claims ML-KEM Broken by Quantum Attack”, postquantum.com, 25 May 2026.