> How hard will it be to switch to post quantum encryption globally once it’s clear publicly that there’s at least a proof of concept for a quantum decryption s

> How hard will it be to switch to post quantum encryption globally once it’s clear publicly that there’s at least a proof of concept for a quantum decryption supercomputer? In theory switching could be "simple" but depends very strongly on what post-quantum algorithms we end up with. If we have a good replacement for Diffie-Hellman (the current candidate appears to CSIDH[1]) then you could replace effectively everything with it because the protocols could be left unchanged. The keys might be a bit larger but who cares. However, if there is no safe Diffie-Hellman replacement then we'll need to change our protocols to accommodate the new crypto. Symmetric-key crypto appears to be mostly safe (Grover's Algorithm can only provide a square-root improvement and so we can just double our key sizes to 256 or 512 bit) so we only need to fix the public-key part, and can work on replacing the rest later. [1]: https://csidh.isogeny.org/ https://csidh.isogeny.org/