Post-Quantum Cryptography: Key-Size vs. Security Lab (2D)

Scheme

Public-key algorithm

Key size / parameter set

Attacker

Logical qubits available 0

Animation speed 1.0×

Live Readout

Classical security

— bits

Quantum security

— bits

Qubits to break

—

Status

—

Public-key size

—

How it works

RSA security is estimated with the general number field sieve asymptotic formula L = exp((64/9)^(1/3) · (ln N)^(1/3) · (ln ln N)^(2/3)), converted to bits. ECC uses the standard square-root (Pollard's rho) estimate of n/2 bits for an n-bit curve. Both fall to Shor's algorithm the instant the attacker has enough logical qubits — about 2n+3 for RSA and ~6n for ECC — at which point factoring/discrete-log becomes polynomial time and classical bit-security stops mattering.

ML-KEM (lattice/LWE) is estimated with the core-SVP hardness model used in the real Kyber design papers: 0.292 × dimension bits classically, 0.265 × dimension bits against the best known quantum (Grover-accelerated) sieving — no qubit count breaks it outright, so the vault never shatters at any qubit budget on this slider.

Left vault — the selected classical scheme (RSA/ECC). Cracks and shatters once qubits ≥ threshold.
Right vault — ML-KEM lattice. Its bars shrink slightly under a quantum attacker but the vault stays sealed.
Bars — live classical vs. quantum bit-security, redrawn from the formulas above on every control change.

Classical vault (RSA/ECC) Lattice vault (ML-KEM) Quantum attacker Broken