Michael English

Ireland Quantum 100 · Technical Brief
Home · Essays · Quantum
Ireland Quantum 100 — Technical Brief

Q-day and the Irish public sector — what to migrate first

Q-Day is the day a cryptographically relevant quantum computer can break RSA-2048 or break elliptic-curve discrete log inside a useful window. Nobody knows the date. What we do know is that adversaries are already harvesting encrypted Irish state traffic and storing it — health records, tax filings, justice case files, defence cables — with the intention of decrypting it later. That means the migration clock for Irish public sector cryptography did not start on Q-Day. It started years ago. This article is a working engineer's view of what the Irish state should migrate first, in what order, and why the superconducting-qubit machines actually being built — including the one we're standing up in Tipperary — change the assumptions you used to be able to make.

The threat model is harvest-now-decrypt-later, not Q-Day itself

If you only model the day a fault-tolerant quantum computer comes online, you will under-invest. The real threat is the gap between today and that day, because anything sent over a public network using RSA, Diffie-Hellman, or ECDSA is recordable now and decryptable later. For Irish public-sector data with a long secrecy half-life — citizen health records under HSE, Revenue tax filings, court records, garda intelligence, Defence Forces communications, diplomatic traffic from Iveagh House — the practical question is: how long does this data need to remain confidential? If the answer is more than ten years, you are already late.

The shor's-algorithm timeline depends on physical qubit count, gate fidelity, and surface-code overhead. To break RSA-2048 you need on the order of millions of physical qubits at current error rates, distilled down via the surface code into a few thousand logical qubits running for hours. Today's largest superconducting transmon devices sit in the low thousands of physical qubits with two-qubit gate errors around the 10⁻³ range. The gap is real, but it is closing on a curve that compounds — fidelity improvements multiply with qubit count, and surface-code overhead drops sharply as physical error rates fall below threshold.

NIST PQ standards are the floor, not the ceiling

NIST finalised the first post-quantum standards in 2024: ML-KEM (FIPS 203, formerly Kyber) for key encapsulation, ML-DSA (FIPS 204, formerly Dilithium) for digital signatures, and SLH-DSA (FIPS 205, formerly SPHINCS+) for hash-based signatures. FALCON is following as FIPS 206. These are the algorithms Irish public sector should be migrating to. Not "considering". Migrating.

The thing every Irish CIO needs to internalise: NIST PQ migration is not a drop-in. ML-KEM public keys are roughly 1,184 bytes versus 256 bytes for X25519. ML-DSA signatures are around 2,420 bytes versus 64 bytes for Ed25519. That breaks assumptions baked into TLS record sizes, DNS UDP responses, smart-card storage, embedded firmware, and any protocol with hardcoded buffer limits. You cannot migrate by flipping a flag. You migrate by inventorying every cryptographic dependency and rebuilding the ones that fail under larger keys and signatures.

The ceiling is hybrid: combining a classical KEM (X25519) with a PQ KEM (ML-KEM) so that an attacker has to break both. Cloudflare, Google, and AWS are already running hybrid X25519+ML-KEM in production TLS. The Irish state should default to hybrid for any new system. Pure PQ deployments invite a second migration if a flaw is found in the lattice assumptions — and lattice cryptography is younger than RSA by four decades.

What Irish public sector should migrate first

Inventory before action. Most departments do not have a cryptographic bill of materials. You cannot migrate what you cannot see. Once you have the inventory, the priority order is roughly:

What does not need to move first: symmetric cryptography. AES-256 is fine. Grover's algorithm gives a quadratic speedup, which means AES-256 has roughly 128 bits of post-quantum security — still well above the comfort threshold. SHA-256 and SHA-3 are also fine. The panic is asymmetric, not symmetric.

Why sovereign quantum compute matters to the migration question

There is a second-order reason Ireland should care about hosting its own quantum hardware, not just buying cycles from US or Chinese clouds. Migration testing, red-teaming, and protocol benchmarking against actual quantum hardware — even small noisy devices — gives you ground-truth data that simulation cannot fully replicate. When an Irish department tests whether its PQ migration holds up, doing that against a sovereign machine on Irish soil avoids exporting sensitive cryptographic posture data to a foreign cloud.

The Ireland Quantum 100 build in Tipperary is a 100-physical-qubit superconducting transmon system on a heavy-hex topology, running in a dilution refrigerator at sub-15 millikelvin, with a roadmap toward surface-code error correction as fidelities improve. That machine is not going to run Shor's algorithm against RSA-2048 — nothing of that size will, for years. What it will do is give Irish researchers, civil service security teams, and climate scientists a domestic platform for variational quantum eigensolver chemistry, QAOA optimisation, and PQ protocol stress-testing without sending workloads abroad. You can read more about the build at our quantum programme.

The integration with cryptographic agility

The deepest lesson from the SHA-1 deprecation, the MD5 collapse, and the slow death of RSA-1024 is this: cryptographic agility is the only durable defence. If your system hardcodes an algorithm name, you will pay the migration cost again every fifteen years. Build for agility now: algorithm identifiers in protocol headers, cryptographic libraries behind clean interfaces, key rotation as a first-class operation.

For Irish public sector procurement, this means writing crypto-agility requirements into every new contract. No more "uses RSA-2048" in a tender — instead, "supports algorithm negotiation per NIST SP 800-227 and IETF hybrid PQ drafts, with documented migration path to ML-KEM, ML-DSA, and SLH-DSA". The cost of retrofitting agility into a system already in production is roughly an order of magnitude higher than building it in. We see this pattern repeatedly in the supply-chain audits we run for our offset-stack work — most enterprise crypto stacks are not agile, and the ones that are tend to be the ones that already survived one migration.

Where the gaps will hurt most

Three areas where the Irish state is likely to find migration genuinely painful:

For teams who want to go deeper on the engineering side of how quantum hardware actually changes the cryptanalytic threat — qubit counts, gate fidelities, surface-code overheads, and what realistic timelines look like — see our breakdown of superconducting transmon architecture.

Where to start this week

If you run cryptography for an Irish public-sector body, this week's job is the inventory. Not the migration. The inventory. Every TLS endpoint, every signing key, every VPN tunn

Ireland Quantum 100

Read the full overview, the 12-month plan, and the climate-applications brief.

Visit the hub