The left vault is locked with RSA/ECC — security that rests on integer factoring or the discrete-log problem being classically hard. Shor's algorithm solves the hidden period of modular exponentiation using quantum phase estimation, turning that into a polynomial-time problem — but only once a fault-tolerant quantum computer has roughly 2×key-bits logical qubits. Below that threshold the tumbler rings barely move; above it, the period-finding core locks on almost immediately and the vault springs open.
The right vault is locked with a lattice-based scheme (the family behind NIST's ML-KEM/Kyber and ML-DSA/Dilithium standards). Its hardness comes from the Shortest/Closest Vector Problem in a high-dimensional lattice — no known quantum algorithm solves this in polynomial time. Grover's algorithm gives at best a quadratic speedup (roughly halving the effective security bits), so the search probe keeps wandering the lattice no matter how many qubits you dial in.
classical RSA: time ~ exp(bits) → astronomical
Shor (enough qubits): time ~ poly(bits) → hours
lattice, any attacker: time ~ exp(dimension/2) → still astronomical
- RSA/ECC key size — larger keys need exponentially more classical work but only polynomially more qubits, which is exactly why quantum computers are catastrophic for this family.
- Logical qubits — Shor's algorithm needs on the order of
2×bits error-corrected qubits to factor a key of that size; short of that threshold it can't run at all.
- Quantum computer toggle — switches the attack on the RSA vault between classical factoring (frozen) and Shor's period-finding (fast, if enough qubits).
- Lattice dimension — the parameter that sets lattice-based security; note it stays hard for the probe whether or not the quantum computer is on.
This is the real reason NIST standardized lattice-based algorithms in 2024: not because they're newer, but because "harvest now, decrypt later" attackers who record today's RSA/ECC traffic will be able to unlock it the moment a large enough quantum computer exists — while lattice-protected traffic recorded today stays sealed.