No. RSA-2048 is not quantum safe. A sufficiently capable fault-tolerant quantum computer running Shor's algorithm could recover its private key; resource and elapsed-time estimates depend on the architecture and assumptions.
Key Takeaway: RSA-2048 is NOT quantum safe. Classify each RSA use as key establishment or signature, then select an approved application profile using ML-KEM, ML-DSA, or SLH-DSA as appropriate. Use only specified hybrid constructions with tested negotiation, downgrade, and rollback behavior.
RSA-2048 is NOT quantum safe.
RSA (Rivest-Shamir-Adleman) is an asymmetric encryption algorithm invented in 1977 that revolutionized public-key cryptography. It relies on a mathematical trapdoor function based on the product of two large prime numbers. In RSA-2048, the modulus (n) is 2048 bits long — the product of two secret 1024-bit prime numbers (p and q). The public key contains n and an encryption exponent e (typically 65537), while the private key contains the decryption exponent d, which is calculated using p and q. Encryption is performed by raising the message to the power e modulo n, while decryption requires raising the ciphertext to the power d modulo n.
RSA security depends on the practical difficulty of factoring the public modulus. No public classical attack has factored a correctly generated RSA-2048 key, but RSA remains unsuitable as a post-quantum primitive because Shor's algorithm changes the computational model. RSA has historically supported TLS, email encryption, software signing, and public-key infrastructure.
Shor's algorithm solves integer factorization in polynomial time on an idealized quantum computation model, so increasing an RSA modulus does not create post-quantum security. Published fault-tolerant resource estimates vary materially with circuit design, error correction, hardware assumptions, and the definition of a logical qubit; this page does not claim a break date or a fixed time-to-key-recovery.
HNDL is a threat model in which an adversary records protected data now for possible future decryption. Exposure depends on capture feasibility, the protocol and key-establishment path, the data's remaining confidentiality lifetime, and future cryptanalytic capability; it should be assessed rather than asserted from the presence of RSA alone.
Organizations should inventory each RSA use and migrate it through an approved application profile before its risk-based control date. NIST finalized three relevant post-quantum standards:
Implementation availability is product-, version-, region-, and protocol-specific. Verify current primary documentation and measure the exact deployed path before assigning coverage.
Financial services institutions face acute risk because they rely on RSA for securing online banking, payment processing (TLS), and regulatory compliance (SOX, PCI-DSS). A quantum computer capable of breaking RSA could decrypt historical transaction logs, forge digital signatures on financial instruments, and compromise customer account data captured via HNDL attacks.
Healthcare entities should derive confidentiality periods and safeguards from their actual records, applicable law, contracts, and documented risk analysis. The HIPAA Security Rule is technology-neutral and does not impose a universal 50-year retention period or a specific PQC algorithm.
Government and defense agencies handling classified information face nation-state adversaries who are aggressively pursuing quantum computing capabilities. NSA CNSA 2.0 planning expects CNSA 2.0 support in new products and services starting in 2027 unless a program stipulation or waiver applies, replacement pressure for non-supporting equipment by December 31, 2030 where required, and a December 31, 2031 mandate for affected systems unless an exception applies. NIST IR 8547 (initial public draft) describes 2035 as a broader disallowance planning anchor. Diplomatic cables, intelligence communications, and weapons systems encrypted with RSA are priority targets for HNDL attacks.
Set migration priority from observed cryptographic use, capture exposure, data lifetime, replacement readiness, applicable policy, and residual unknowns.
| Full Name | RSA with 2048-bit keys |
| Category | encryption |
| Key Size | 2048 bits |
| Quantum Vulnerability | Shor's algorithm — polynomial-time integer factorization on quantum hardware. |
| NIST Status | NIST IR 8547 is an initial public draft describing proposed federal transition horizons for affected RSA uses; it is not a current universal commercial prohibition. |
| Deprecation Timeline | No universal commercial date. NIST IR 8547 remains an initial public draft; CNSA 2.0 dates apply to NSS and related scoped contexts. |
| Replaced By | ML-KEM (FIPS 203) for key exchange, ML-DSA (FIPS 204) for signatures |
Algorithm-level classification. Standards status and known cryptanalysis are separated from implementation, module-validation, protocol-composition, key-management, and policy evidence.
Evidence-scope review: 2026-07-10
Classify each RSA use as key establishment or signature, then select an approved application profile using ML-KEM, ML-DSA, or SLH-DSA as appropriate. Use only specified hybrid constructions with tested negotiation, downgrade, and rollback behavior.
QScout discovers instances of RSA-2048 across your infrastructure within the approved engagement window — designed to minimize operational disruption. First-findings timing is set during operator scoping.