Relevant paragraph:
PQC readiness “is mostly actuarial/risk management—even if the chance of building a CRQC by, say, 2030 is very low (say 5 percent), the downside risk is huge,” he explained. “Combine that with very long transition engineering times, and you should have started already.”
Also, relevant paragraph from the wiki page for integer factorization records:
The largest number reliably factored by Shor’s algorithm, rather than some other quantum method, is 21 which was factored in 2012.[26][27] The number 15 had previously been factored by several labs and subsequent attempts to factorise 35 failed.[27
And a relevant excerpt from this study looking at “factored” primes above 21
Large-scale fault-tolerant quantum computers capable of implementing Shor’s algorithm are not yet available, preventing relevant benchmarking experiments. Recently, several authors have attempted quantum factorizations via reductions to SAT or similar NP-hard problems. While this approach may shed light on algorithmic approaches for quantum solutions to NP-hard problems, in this paper we study and question its practicality. We find no evidence that this is a viable path toward factoring large numbers, even for scalable fault-tolerant quantum computers, as well as for various quantum annealing or other special purpose quantum hardware.
I’ll be concerned when we start seeing primes being factored when they’re not using compiled Shor algorithm primes. So far, most of the big “factorization records” cheat and use primes with only the LSBs differing, and aren’t remotely close to anything used in a real RSA prime. There was a good discussion of it on Security Now episode 1034 for those who are interested.
