https://eprint.iacr.org/2016/992.pdf https://eprint.iacr.org/2016/992.pdf "While our cost model ties us to a particular quantum architecture, we segment our an

https://eprint.iacr.org/2016/992.pdf https://eprint.iacr.org/2016/992.pdf "While our cost model ties us to a particular quantum architecture, we segment our analysis into several layers so that the impact of a different assumptions at any particular level can be readily evaluated." "Our estimates are by no means a lower bound, as they are based on a series of assumptions. First, we optimized our T-count by optimizing each component of the SHA oracle individually, which of course is not optimal. Dedicated optimization schemes may achieve better results. Second, we considered a surface code fault-tolerant implementation, as such a scheme looks the most promising at present. However it may be the case that other quantum error correcting schemes perform better. Finally, we considered an optimistic per-gate error rate of about 10^5, which is the limit of current quantum hardware. This number will probably be improved in the future. Improving any of the issues listed above will certainly result in a better estimate and a lower number of operations, however the decrease in the number of bits of security will likely be limited." Which remains huge for these hashes. In short: "Diffie-Hellman key exchange, RSA encryption, and RSA signatures will all need to be replaced before quantum computers are available. The situation is less dire for hash functions and symmetric ciphers."