RSA, ECC & Hashes: What Breaks?
How Shor’s and Grover’s algorithms break the cryptography protecting cryptocurrency—explained for investors.
You don’t need to understand the mathematics to understand the threat. But knowing which cryptographic schemes break and how badly helps you evaluate your portfolio’s quantum risk.
This guide breaks down the three categories of cryptographic vulnerability—signature schemes, public-key encryption, and hash functions—in plain English.
ECDSA: The Primary Target
Used by: Bitcoin, Ethereum (EOAs), Litecoin, Dogecoin, and most major cryptocurrencies
Quantum vulnerability: Critical (Broken by Shor’s algorithm)
Time to break: Hours on a cryptographically relevant quantum computer
How ECDSA Works (Simplified)
ECDSA (Elliptic Curve Digital Signature Algorithm) is based on elliptic curve mathematics. You generate a private key (a random 256-bit number), perform elliptic curve point multiplication to create a public key, share the public key with the world, and use your private key to sign transactions without revealing it.
The security relies on the elliptic curve discrete logarithm problem: given the public key, it’s computationally infeasible to derive the private key. On a classical computer, this would take billions of years.
Why Quantum Breaks It
Shor’s algorithm can solve the discrete logarithm problem in polynomial time. For a 256-bit ECDSA key, a classical computer needs roughly 2^128 operations (basically impossible), while a quantum computer needs approximately 256^3 operations (millions, not quintillions).
This reduces an impossible problem to a practical one. With a cryptographically relevant quantum computer (1,500+ logical qubits), breaking a single ECDSA signature takes hours, not eons.
What This Means for Your Wallet
If your Bitcoin or Ethereum address has ever made a transaction, your public key is on the blockchain. An attacker with a quantum computer can download your public key, run Shor’s algorithm to derive your private key, create a transaction sending your funds to their address, sign it with your private key, and broadcast the transaction.
From the blockchain’s perspective, this is a legitimate transaction. You “authorized” it because your private key signed it. There’s no way to prove it wasn’t you.
Ed25519 & Other EdDSA Variants
Used by: Solana, Cardano, Stellar, Polkadot, Algorand
Quantum vulnerability: Critical (Broken by Shor’s algorithm)
Time to break: Hours (similar to ECDSA)
Ed25519 is a variant of EdDSA (Edwards-curve Digital Signature Algorithm), which is mathematically different from ECDSA but still based on elliptic curves. It’s faster and has some security advantages over ECDSA against classical attacks, but it’s equally vulnerable to quantum computers.
Shor’s algorithm works on any discrete logarithm problem, including Edwards curves. The threat is identical to ECDSA: once Q-Day arrives, private keys can be derived from public keys in hours.
Bottom line: Don’t be fooled by newer signature schemes. Ed25519 is more modern than ECDSA, but it’s just as vulnerable to quantum attacks.
Hash Functions: Weakened, Not Broken
Used by: All blockchains (mining, Merkle trees, address derivation)
Quantum vulnerability: Moderate (Weakened by Grover’s algorithm)
Impact: Security reduced by half, but manageable
Grover’s Algorithm: The Quadratic Speedup
Unlike Shor’s exponential speedup for signatures, Grover’s algorithm provides only quadratic speedup for hash attacks. This means SHA-256 (256-bit security) effectively becomes 128-bit security against quantum, Keccak-256 also becomes 128-bit effective security, and SHA-512 maintains 256-bit effective security.
128-bit security is still strong—it would take a quantum computer billions of years to brute-force a SHA-256 hash. This is vastly less urgent than the signature problem.
What This Means for Blockchains
Hash function weakening affects three areas: Proof-of-Work mining (quantum miners get a quadratic advantage but classical ASICs remain competitive), address derivation (P2PKH addresses with unexposed public keys remain relatively safe), and blockchain integrity (Merkle tree weakening is real but manageable).
Bottom line on hash functions: The threat is real but manageable. Blockchains can upgrade to larger hash outputs (SHA-384, SHA-512) if needed. The signature vulnerability is orders of magnitude more urgent.
What Doesn’t Break: Post-Quantum Cryptography
Not all cryptography is vulnerable to quantum computers. Several families of algorithms resist both Shor’s and Grover’s attacks:
Hash-Based Signatures
Examples: XMSS, SPHINCS+, LMS
Security basis: Hash functions (SHA-256, etc.)
Quantum resistance: Strong (only Grover’s weakening, which is manageable)
These schemes don’t rely on discrete logarithms or factoring—they’re built entirely on hash function security. Since hash functions are only weakened (not broken) by quantum computers, hash-based signatures remain secure.
Lattice-Based Cryptography
Examples: Dilithium, Kyber, Falcon
Security basis: Lattice problems (SVP, LWE)
Quantum resistance: Strong (no known quantum algorithms for lattice problems)
NIST selected lattice-based schemes as primary standards for post-quantum cryptography (FIPS 203, 204). These are likely candidates for blockchain migration because they’re efficient enough for practical use, well-studied (6+ years of NIST scrutiny), and flexible (work for both signatures and encryption).
The main drawback: larger signature sizes (2-3KB versus 64 bytes for ECDSA), which means blockchain bloat. But that’s a manageable trade-off compared to total vulnerability.
Investor Takeaway
The hierarchy of quantum threat:
1. Signature schemes (ECDSA, Ed25519, RSA, BLS): Critical vulnerability—these break completely and quickly
2. Hash functions (SHA-256, Keccak-256): Moderate vulnerability—weakened but not broken, manageable with larger outputs
3. Post-quantum schemes (SPHINCS+, Dilithium, Kyber): No known quantum vulnerability
When evaluating your cryptocurrency holdings, assume all ECDSA/Ed25519/RSA schemes are critically vulnerable, check if the project has published a migration plan to lattice-based or hash-based signatures, don’t be fooled by newer signature schemes (Ed25519 is just as vulnerable as ECDSA), and remember that hash function concerns are real but secondary to signature vulnerability.
Next Steps
Explore Solutions
Learn about post-quantum cryptography—the NIST-standard algorithms that can resist quantum attacks.
Check Your Portfolio
See which of your holdings are vulnerable and which are preparing for quantum threats.
Ready to Assess Your Risk?
See which cryptocurrencies are preparing for quantum threats and which are vulnerable.