Is RSA-2048 Quantum Safe?

RSA-2048 is NOT quantum safe.

How RSA-2048 Works

RSA (Rivest-Shamir-Adleman) is an asymmetric encryption algorithm invented in 1977 that revolutionized public-key cryptography. It relies on a mathematical trapdoor function based on the product of two large prime numbers. In RSA-2048, the modulus (n) is 2048 bits long — the product of two secret 1024-bit prime numbers (p and q). The public key contains n and an encryption exponent e (typically 65537), while the private key contains the decryption exponent d, which is calculated using p and q. Encryption is performed by raising the message to the power e modulo n, while decryption requires raising the ciphertext to the power d modulo n.

RSA security depends on the practical difficulty of factoring the public modulus. No public classical attack has factored a correctly generated RSA-2048 key, but RSA remains unsuitable as a post-quantum primitive because Shor's algorithm changes the computational model. RSA has historically supported TLS, email encryption, software signing, and public-key infrastructure.

Quantum Vulnerability Explained

Shor's algorithm solves integer factorization in polynomial time on an idealized quantum computation model, so increasing an RSA modulus does not create post-quantum security. Published fault-tolerant resource estimates vary materially with circuit design, error correction, hardware assumptions, and the definition of a logical qubit; this page does not claim a break date or a fixed time-to-key-recovery.

HNDL is a threat model in which an adversary records protected data now for possible future decryption. Exposure depends on capture feasibility, the protocol and key-establishment path, the data's remaining confidentiality lifetime, and future cryptanalytic capability; it should be assessed rather than asserted from the presence of RSA alone.

Migration Path

Organizations should inventory each RSA use and migrate it through an approved application profile before its risk-based control date. NIST finalized three relevant post-quantum standards:

• ML-KEM (FIPS 203): A key-encapsulation mechanism for key establishment. Select its parameter set through the applicable protocol, policy, and interoperability profile rather than treating the suffix as a direct bit-security claim.
• ML-DSA (FIPS 204): A digital-signature standard with parameter sets selected by the applicable assurance and interoperability profile.
• Hybrid transition: Use only a defined protocol profile with a specified combiner, negotiation behavior, and downgrade handling. X25519MLKEM768 combines X25519 and ML-KEM for key establishment; it is not an RSA-plus-ML-KEM construction.

Implementation availability is product-, version-, region-, and protocol-specific. Verify current primary documentation and measure the exact deployed path before assigning coverage.

Industries at Risk

Financial services institutions face acute risk because they rely on RSA for securing online banking, payment processing (TLS), and regulatory compliance (SOX, PCI-DSS). A quantum computer capable of breaking RSA could decrypt historical transaction logs, forge digital signatures on financial instruments, and compromise customer account data captured via HNDL attacks.

Healthcare entities should derive confidentiality periods and safeguards from their actual records, applicable law, contracts, and documented risk analysis. The HIPAA Security Rule is technology-neutral and does not impose a universal 50-year retention period or a specific PQC algorithm.

Government and defense agencies handling classified information face nation-state adversaries who are aggressively pursuing quantum computing capabilities. NSA CNSA 2.0 planning expects CNSA 2.0 support in new products and services starting in 2027 unless a program stipulation or waiver applies, replacement pressure for non-supporting equipment by December 31, 2030 where required, and a December 31, 2031 mandate for affected systems unless an exception applies. NIST IR 8547 (initial public draft) describes 2035 as a broader disallowance planning anchor. Diplomatic cables, intelligence communications, and weapons systems encrypted with RSA are priority targets for HNDL attacks.

Timeline to Obsolescence

• Current control: Treat HNDL as a scenario to assess where traffic can be captured and the data remains sensitive beyond the migration horizon.
• 2029: Treat as a readiness/control date for completing funded migration plans before external CRQC timing becomes operational risk.
• 2030: CNSA 2.0 calls for phasing out non-supporting equipment and services in its NSS scope unless otherwise noted. NIST IR 8547 is an initial public draft, not a universal commercial deadline.
• 2031: CNSA 2.0 mandated for affected systems unless a program-specific exception applies.
• 2033: Treat as an external scenario planning marker, not a present-day break claim.
• 2035: NIST IR 8547's initial public draft proposes a federal disallowance planning horizon for affected RSA uses; final and application-specific guidance may change.

Set migration priority from observed cryptographic use, capture exposure, data lifetime, replacement readiness, applicable policy, and residual unknowns.