Why post-quantum

Two algorithms, two kinds of damage

Shor's algorithm (1994) solves factoring and discrete logarithms efficiently on a large, error-corrected quantum computer. RSA, ECDSA (secp256k1), Ed25519 and ECDH all rest on those problems. Against such a machine they do not weaken; they fail.

Grover's algorithm (1996) speeds up brute-force search quadratically. In the ideal case that halves the bit strength of a symmetric key or a hash. AES-256 and SHA-256 remain safe; AES-128 drops to a margin people prefer to avoid.

Why act before the machine exists

• Chains keep everything. After an account signs once, the chain lets anyone rebuild its key, permanently. It cannot be taken back.
• Copies wait. Encrypted traffic or files recorded today can be opened later if the key exchange falls. Long-lived secrets are exposed now.
• Migrations are slow. New transaction formats, wallet support and user habits take years. NIST's draft plan already names 2030 and 2035.

What is not known

Nobody knows when, or whether, a machine large enough will be built. Published resource estimates have fallen several times (see the quantum risk page for the sources), but today's devices are far below them. Kibora treats the threat as a planning problem, not an emergency.