What the UK-Singapore Financial Dialogue Joint Statement of 20 October 2026 Says About Post-Quantum Cryptography, QKD and Bank Supervisors
What HM Treasury and MAS published after the 20 October 2026 dialogue
On 20 October 2026 the United Kingdom and Singapore held their 11th Financial Dialogue in Singapore, with officials from HM Treasury and the Monetary Authority of Singapore joined by the Bank of England and the Financial Conduct Authority. The joint statement HM Treasury published the same day runs to roughly a thousand words across digital finance, capital markets, sustainable finance and the two countries' 2027 roles at the G20 and in ASEAN. Quantum technology takes one sentence. It says the exchange covered each side's approach to quantum security and to supervisory expectations for financial institutions moving to quantum-safe technology, including the NCSC's post-quantum cryptography migration guidance and lessons from MAS's quantum key distribution sandbox.
Why the two references in that sentence point in different directions
Some trade coverage described the meeting as an agreement on joint oversight and unified standards. The statement contains no such commitment. Its interest lies in the pairing. The NCSC sets 2028, 2031 and 2035 as its migration milestones and says it will not support quantum key distribution for government or military use. MAS has tested QKD with four banks and reported both its potential and its limits. This post reads the sentence closely and asks what a bank supervised in both London and Singapore can take from it.
The SEC's Fiscal Year 2027 Examination Priorities List Quantum Computing Under Regulation SCI: What the 23 October 2026 Sentence Means for Exchanges and Clearing Agencies
What the SEC published on 23 October 2026
On 23 October 2026 the US Securities and Exchange Commission released the Division of Examinations' priorities for fiscal year 2027. In the section on Regulation Systems Compliance and Integrity, the rule that governs the core technology of exchanges, clearing agencies, FINRA and a few other market utilities, the Division says its examinations "will focus on emerging trends, including SI, tokenization of securities, extended trading hours, and quantum computing." Neither the fiscal 2025 nor the fiscal 2026 priorities mentioned quantum computing at all.
What the Regulation SCI sentence requires of exchanges and clearing agencies
Several outlets reported that the SEC is now targeting quantum computing. The document is narrower. It names no algorithm, sets no migration date and asks for no inventory, and its own disclaimer says it is a staff statement with no legal force. The weight comes from the rule it sits under. Regulation SCI already requires each covered entity to keep written policies that give its systems adequate security, and to review and test those systems for vulnerabilities to internal and external threats. An examiner who asks how a clearing agency is preparing for post-quantum cryptography can now point to a published priority when asking. This post compares what was reported with what the text says, and asks what an SCI entity can expect to be asked in the coming fiscal year.
Mozilla and Chrome Distrust eMudhra's emSign ECC Root CA – G3: How a 30 April 2025 Key Ceremony Produced Eight Recoverable P-384 Keys and Ended in eMudhra's 22 October 2026 Exit From Global TLS
What happened between 17 and 22 October 2026
On 17 October 2026 an independent researcher sent Apple, Google, Microsoft, Mozilla and eMudhra proof that he controlled the private keys of eight eMudhra intermediate certificate authorities. Mozilla recovered the same keys on its own that evening and blocked the intermediates in Firefox within three hours of receiving the report. eMudhra revoked all eight the next morning. On 20 October Mozilla announced the emergency removal of trust in emSign ECC Root CA – G3, and Chrome said it would follow the same path. On 22 October eMudhra's board decided to leave the global SSL/TLS certificate business.
Why a key ceremony from April 2025 caused it
The keys came out of a key generation ceremony on 30 April 2025. Mozilla found that each of the eight P-384 private keys was an integer below 256, so anyone could find them by trying 256 values. eMudhra says the keys were made on FIPS 140-2 Level 3 hardware security modules and that a wrap/unwrap step in the ceremony produced a second, weak set of keys, which were the ones published. This post reconstructs the case from the root-program record and asks what it means for the post-quantum migration, which brings new key-generation and operational procedures into the Web PKI, with algorithms and certificate hierarchies differing by root program.
Claude Mythos 5 Helped Design a Quantum Circuit for Bitcoin's secp256k1 Curve: What arXiv 2610.22367's '17-Fold Fewer Gates' Is Measured Against
What Harvard and Anthropic posted on 15 October 2026
Andi Gu, Alek Kemeny, Susanne Yelin and Mikhail Lukin posted arXiv 2610.22367, "Discovering state-of-the-art quantum circuits with large language models," on 15 October 2026. The paper uses Claude Mythos 5 to propose circuit designs and an independent evaluator to test and score them across eight tasks. Anthropic presented the work on 16 October. The result that drew attention is a reversible point adder over the prime field of secp256k1, the curve behind Bitcoin and Ethereum signatures. The authors' public repository lists it at 4,006,673 Toffoli gates and 935 logical qubits, and press coverage reported about 17-fold fewer Toffoli gates for 12% more qubits.
What the 17-fold figure is measured against
The comparator is the authors' own reconstruction of a 2026 point adder by Luo and colleagues, at 69,529,757 Toffoli gates and 838 qubits. The same repository cites a second published design, by Schrottenloher, at about 1.9 million Toffoli gates and 1,446 qubits. Against that design the new circuit uses more gates and about a third fewer qubits. The repository's implemented circuits were evaluated by a grader that runs 100,000 tests and passes a circuit with up to 20 failures, a budget the authors set so that deliberately approximate arithmetic is allowed; the Schrottenloher figures are cited there, not reproduced. This post sets each claim beside the paper and repository, explains what a cheaper adder means for elliptic-curve cryptography, and shows where the figure is commonly overstated.
Germany's Post-Quantum Guideline From BMI, BMDS and BSI, Published 12 October 2026: Crypto Inventories by End-2026, High-Risk Systems by 2030, and the Legal Weight of BSI Act Section 30
What BMI, BMDS and BSI published on 12 October 2026
Germany's Federal Ministry of the Interior (BMI), its Federal Ministry for Digital Transformation and Government Modernisation (BMDS) and the Federal Office for Information Security (BSI) have jointly published a ten-page guideline on the national implementation of the EU roadmap for the transition to post-quantum cryptography. It addresses federal, state and municipal administrations, companies and operators of critical infrastructure. High-risk use cases should move to quantum-safe cryptography by the end of 2030, and medium-risk use cases by the end of 2035. By the end of 2026 every organization should have completed an initial cryptographic inventory, named a responsible office and started the first migration steps.
Why the German timetable is guidance with a legal edge
The guideline calls its deadlines urgent recommendations and asks Germany's IT Planning Council and the critical-infrastructure partnership UP KRITIS to make them binding by the end of 2026. It also points to section 30 of the BSI Act, which requires important and particularly important entities under the NIS2 regime to take security measures that meet the state of the art, including concepts for the use of cryptography. The guideline places post-quantum cryptography under that heading, recommends hybrid schemes, and asks that procurement treat crypto-agility as a default requirement. This post follows the dates from 1994 to 2035 and marks where each one carries legal force.
Pentagon PIV and CAC Smart Cards Must Use Post-Quantum Algorithms by 2030, Says DoD PQC Director Britta Hale: Why Every Card Reader and Server Has to Be Ready by the End of 2029
What DoD's post-quantum director said about PIV and CAC cards
Britta Hale, director of post-quantum cryptography at the Defense Department, told an AFCEA DC audience that Personal Identity Verification (PIV) cards and Common Access Cards (CACs) have to carry the new algorithms by 2030. Federal News Network reported her remarks on 9 October 2026. Her reasoning runs backwards from that date: if a card arrives with post-quantum signatures and the reader, server or certificate authority behind it cannot process them, the holder is locked out. In practice, she said, every system and product in the department has to be ready by the end of 2029.
Why the identity card sets the pace for federal PQC migration
A smart card is a small computer with limited memory, issued in the millions and replaced on a multi-year cycle. ML-DSA, the NIST post-quantum signature standard and the leading candidate for the card, produces signatures roughly 38 to 72 times larger than a raw elliptic-curve signature. NIST is revising SP 800-73 and SP 800-78, the two documents that define the card interface and its algorithms, and GSA's FICAM program is piloting a post-quantum PKI for the Federal PKI. This post sets the DoD date against the governmentwide 2030, 2031 and 2035 milestones and against what the card standards still have to change.
GAO's 2024-2025 Post-Quantum Audit of 24 Federal Agencies, Released 6 October 2026, Finds None Met All Inventory, Funding and Testing Practices Ahead of OMB's 22 October Migration Plans
What GAO-27-108740 found at 24 federal agencies in 2024 and 2025
On 6 October 2026 the U.S. Government Accountability Office released the public version of its audit, conducted from February 2024 to September 2025, of how the 24 Chief Financial Officers Act agencies are preparing to move vulnerable systems to post-quantum cryptography. GAO measured three practices drawn from OMB's November 2022 memo M-23-02: a prioritized inventory of systems with vulnerable cryptography, the funding needed to migrate them, and testing in agency environments. None of the 24 agencies fully addressed all three. One agency had a complete inventory of priority systems, 19 used no automated discovery tools, and no agency had tested post-quantum algorithms in its own environment. Agencies may have moved since; the public report does not say.
Why the $7.1 billion figure needs a second look
OMB gave Congress an estimate of about $7.1 billion to migrate priority federal systems or replace legacy systems that cannot support the new algorithms. GAO reports that 21 agencies acknowledged their funding assessments were not fully accurate and that only one assessment rested on a complete inventory.
Why the timing matters in October 2026
The audit work ended in September 2025, and the public version does not discuss OMB's June 2026 memo M-26-15, whose agency migration plans fall due on 22 October 2026. Unless agencies have closed the gaps since 2025, those plans will rest on inventories GAO found incomplete.
Why Germany's BSI Advises Against Classic McEliece for New Systems, Four Months After ISO Standardized It
What BSI changed in its TR-02102 guidance in October 2026
Germany's Federal Office for Information Security (BSI) now advises against using Classic McEliece for new developments and when planning new cryptographic applications. The change appears on the agency's page for Technical Guideline TR-02102 and was reported by heise on 6 October 2026. BSI states that the 2026 results do not amount to a practical attack on the parameter sets it had recommended; heise adds that correctly built hybrid deployments keep the protection of their classical component. For new post-quantum cryptography projects, BSI points to FrodoKEM, ML-KEM and HQC.
Why two preprints from August and September 2026 moved a national guideline
In August, Ghoshal, Ishai, Jain and Sun posted a quasipolynomial-time method that tells Classic McEliece public keys apart from random ones, covering every parameter set reviewed in the NIST process. In September, Stephen A. Weis of Anthropic cut the cost of the attack's core linear-algebra step to between 2^89 and 2^98 bit operations and described two key-recovery methods. Neither paper breaks a deployed key.
Why a standard and a guideline can now point in different directions
ISO published Classic McEliece in June 2026 in amendment 2 to ISO/IEC 18033-2, the same amendment that standardizes FrodoKEM. A national guideline chooses among standardized options, so a procurement clause that only asks for an ISO-standardized algorithm no longer settles which scheme a supplier may ship.
Dutch Quantum Strategy of 5 October 2026: Post-Quantum Deadlines From 2026 to 2035, No QKD, and Police Access to a Code-Breaking Quantum Computer
What the Dutch cabinet sent to parliament on 5 October 2026
Minister Heleen Herbert (Economic Affairs and Climate) and State Secretary Willemijn Aerdts (Digital Economy and Sovereignty) sent the Rijksbrede Quantumstrategie, a government-wide quantum strategy prepared with eight other ministries, to the Tweede Kamer. Its 2035 goals are technological leadership, avoiding dependence on quantum applications from outside the EU, and resilience against security threats. The strategy builds on the 614.9 million euros already granted to Quantum Delta NL and comes with no new budget: actions must fit existing departmental means, and ambitions will be adjusted if the money is not found.
The post-quantum timetable for central government
The security chapter sets a post-quantum cryptography schedule for every central government organization. By the end of 2026, quantum risk sits in risk management and each organization has its own cryptography policy. By the end of 2027, draft migration plans, pilots and budgets follow. By the end of 2028, procurement contracts can demand quantum-safe cryptography. High-risk uses must be migrated by the end of 2030 and medium-risk uses by the end of 2035. The strategy places a possible cryptographically relevant quantum computer between 2029 and 2035 and says the date is uncertain.
Two positions that set the Netherlands apart
Central government does not currently use quantum key distribution for information security, citing objections from several European security agencies. And a separate use case describes quantum decryption of criminal and terrorist communications as an opportunity for police, forensic institutes and intelligence services, which the strategy says should gain access to a quantum computer relatively quickly.
Cloudflare Said on 29 September 2026 It Will Become a Public Certificate Authority: From Chrome's February Decision to the First Post-Quantum Merkle Tree Certificates in Early 2027
What Cloudflare announced on 29 September 2026
Cloudflare, which says it sits in front of more than 20 percent of global Internet request traffic, announced that it will become a public certificate authority. It has applied to the Chrome, Apple, Microsoft and Mozilla root programs and signed a definitive agreement to buy a broadly trusted root from GlobalSign, so its certificates reach older devices from the first day of issuance. Issuance will be ACME-only, and the company will serve only clients that support ACME Renewal Information under RFC 9773. It is not issuing certificates yet.
Why Merkle Tree Certificates set the post-quantum date
The same CA plans to issue its first production Merkle Tree Certificates in early 2027, subject to admission by Chrome and free of charge for standard issuance, aiming at Chrome's new Quantum-resistant Root Store. Chrome said in February 2026 that it would not add ordinary X.509 certificates carrying post-quantum signatures to its root store, so this new format is the route it has chosen. Post-quantum signatures are about forty times larger than classical ones, and the Merkle design lets one signed tree head vouch for many certificates at once. This post follows the sequence from Chrome's decision through the Chrome Beta experiment and the 21 September IETF draft to the dates that come next.
How IACR ePrint 2026/2131 Forged 1024-Bit RSA Signatures Through a Hardware Security Module Without Factoring the Key, and What It Means for Blind RSA in Privacy Pass
What the UC San Diego and Inria team did with a Thales Luna HSM
A preprint submitted to the IACR Cryptology ePrint Archive on 20 September 2026 reports the first large-scale run of a 2007 algorithm by Joux, Naccache and Thomé. Laura Shea, Miro Haller, Adam Suhl and Nadia Heninger of UC San Diego and Emmanuel Thomé of Inria Nancy sent about 232 raw signing requests to a hardware security module, then spent 1,380 CPU core-years over five months on a number field sieve computation. At the end they could produce valid 1024-bit RSA signatures of their choice, offline, without the private key and without factoring the modulus, which the authors put at 500,000 to 1,000,000 core-years.
Which RSA deployments the attack reaches, and which it leaves alone
The attack needs a raw, unpadded RSA signing or decryption interface on the target key. Interfaces that only sign with PKCS#1 v1.5 or PSS padding do not offer one, so TLS certificates, DKIM and most OAuth tokens sit outside it. Two uses offer one by design: HSM APIs with raw RSA switched on, and blind RSA signatures such as the publicly verifiable Privacy Pass tokens behind Apple Private Access Tokens. For 2048-bit keys in that setting the authors estimate 290 work and 243 queries, against the 112 bits usually assumed. This post reads the paper, the authors' code notes and the two RFCs it tests.
NIST Draft SP 800-82r4 of 21 September 2026: What the Operational Technology Security Guide Asks on Post-Quantum Cryptography for Water, Rail and Ship Controllers
What NIST released on 21 September 2026
NIST has published the initial public draft of Special Publication 800-82 Revision 4, the Guide to Operational Technology (OT) Security. The guide covers the programmable systems that act on the physical world: industrial control systems, building automation, water and wastewater plants, freight rail, maritime vessels and industrial IoT. The draft is restructured around the Cybersecurity Framework 2.0, and comments are open until 30 November 2026.
Where post-quantum cryptography enters the OT guide
The September 2023 revision never mentions quantum computing. The new draft adds a short section on post-quantum cryptography and lists the lack of it as an architecture vulnerability. Its reasoning is specific to industry: many OT devices have life cycles measured in decades and cannot easily be patched or replaced, so organizations should inventory the systems that rely on public-key cryptography now, ask vendors for their PQC roadmaps, and plan the highest-risk systems first.
Why the purchase order is where the migration happens
The draft asks organizations to treat cryptographic agility as a requirement when they procure new OT systems, so that algorithms can change without replacing hardware. This analysis reads the draft closely: what it says, what it leaves open, and why a controller bought in 2027 may well still be in service when NIST's proposed cut-off for quantum-vulnerable signatures and key exchange arrives.
Peace Corps Notice PC-38 of 25 September 2026 Links Google Analytics Client IDs to Its Medical Applicant System, Where Records Stay 50 Years: How Long Must the Encryption Hold?
What the Peace Corps published on 25 September 2026
The Peace Corps used the Federal Register on 25 September 2026 to announce a new Privacy Act system of records, the Customer Relationship Management system known as PC-38. Under a program it calls the Recruitment Analytics and Identity Resolution Initiative, the agency will sync the anonymized Client IDs that Google Analytics assigns to website and social-media visitors with named lead records, with applicant tracking, and with its Medical Applicant Exchange System. Comments are due, and the system takes effect, on 26 October 2026.
Why a website visit can end up in a medical file kept for decades
The notice lists medical history, disability, fingerprints and Social Security numbers among the records, and it lets staff retrieve a file by Client ID. Records in the medical applicant system are destroyed 50 years after a volunteer's service ends. The notice does not say how long the Client ID link itself is kept, but it places a browser identifier and health data in one retrievable Privacy Act system of records whose longest schedule runs for most of a lifetime.
What the retention period means for encryption
The notice says records are encrypted using FIPS 140-3 authorized standards. NIST's draft transition guidance proposes deprecating quantum-vulnerable RSA and elliptic-curve schemes at the 112-bit security level after 2030 and disallowing all of them after 2035, decades before a medical applicant file closed in the late 2020s is due for destruction. This analysis asks how long the protection on such a file has to hold, and why a retention schedule should set post-quantum migration priorities.
EBA, EIOPA and ESMA's Autumn 2026 Risk Update, Published 23 September 2026, Warns That Quantum Attacks on Bank and Blockchain Cryptography Could Arrive Before Quantum Profits Do
What the European Supervisory Authorities published on 23 September 2026
The EBA, EIOPA and ESMA released their Autumn 2026 Joint Committee update on risks and vulnerabilities, document JC 2026 29, first presented to the Financial Stability Table of the EU's Economic and Financial Committee on 10 September. Most of it concerns external dependencies and private credit. One slide, under the heading on cyber risk and frontier AI, warns that an advanced quantum computer could undermine cryptography used to secure communications, transactions, databases and blockchains, and that such threats could materialise earlier than any viable commercial application.
Why the ordering of risk and benefit matters for EU finance
In this update the three authorities say the attack on cryptography may come before the commercial benefit. They tie the point to harvest now, decrypt later collection, to the Digital Operational Resilience Act's requirement for state-of-the-art cryptography, and to the EU roadmap that recommends Member States to begin the move to post-quantum cryptography by the end of 2026.
What the recommendations do not yet contain
The closing recommendation on AI and quantum computing lists three actions: rely on DORA and the AI Act, keep operational resilience strong, and adopt AI-powered security testing. None of the three is specific to quantum computing. This analysis reads the slide closely and sets it against DORA, which binds banks, insurers and fund managers, and against the EU roadmap, which recommends dates to Member States.
Stephen Weis Factored RSA-896 With Claude on 19 September 2026 in 30 GPU-Years of Idle Capacity: His Claim That 1,024-Bit RSA Is Vulnerable to Data-Center GPU Fleets, Read Against NIST SP 800-131A
What Stephen Weis's September 2026 note says about the 19 September factorization
RSA-896, a 270-digit challenge modulus, was factored with Claude on 19 September 2026, according to a note Weis posted in September 2026. Claude ported the open-source CADO-NFS number field sieve to GPUs and orchestrated it across a fleet of up to 2,048 GPUs as a low-priority job in idle time between regular workloads; the run took about ten days and roughly 30 GPU-years of compute. Weis states that the work did not meaningfully improve the runtime of the general number field sieve and does not affect deployed RSA-2048 keys, and that it demonstrates 1,024-bit RSA keys are vulnerable to many actors with data-center-scale GPU fleets.
Where the record stood: 829 bits in February 2020, 862 bits on 3 September 2026, 896 bits now
RSA-250 (829 bits) was factored in February 2020 with CADO-NFS on CPUs. Cognition's RSA-260 (862 bits) followed on 3 September 2026 at about 4,900 GPU-days, which its author priced at about $400,000. RSA-896 adds 34 bits sixteen days later, on a little over twice the GPU-years. Cognition's author estimates RSA-1024 at roughly $30 million per number at market GPU prices. No properly generated 1,024-bit RSA modulus has been publicly factored.
What the rules already say about 1,024-bit RSA, and where it still lives
For federal use, NIST SP 800-131A Rev. 2 has disallowed RSA moduli under 2,048 bits for signature generation and key transport since 2014, keeping them only for legacy verification. RFC 8301 still permits DKIM signers to use 1,024-bit RSA keys, because a 2,048-bit key does not fit some DNS TXT record tooling. The gap between those two documents is where Weis's sentence lands, and it is an inventory question before it is a cryptography question.
Java 27 Turns On Hybrid Post-Quantum TLS by Default Through JEP 527, and Oracle Expects JDK 8 and JDK 11 to Receive It Only in the Second Half of 2027
What Oracle released on 15 September 2026
Java 27 ships JEP 527, Post-Quantum Hybrid Key Exchange for TLS 1.3. The JDK's TLS client now offers X25519MLKEM768, a combination of X25519 elliptic-curve Diffie-Hellman with ML-KEM-768, as its most preferred named group, ahead of x25519 and secp256r1. An application that uses the JDK's own SunJSSE implementation over TLS 1.3 with the default group list offers a hybrid post-quantum key exchange, and uses it when the server selects that group. Two further hybrids, SecP256r1MLKEM768 and SecP384r1MLKEM1024, are implemented and switched off by default.
Why the calendar matters more than the release
Java 27 is a non-LTS release with premier support to March 2027. The runtimes that carry production workloads are the long-term-support lines, and Oracle's roadmap post of 6 August 2026 gives each of them an expected date for Oracle JDK: JDK 25 with the October 2026 Critical Patch Update, JDK 21 and JDK 17 in the first half of 2027, and JDK 8 and JDK 11 in the second half of 2027. JDK 8, released in March 2014, remains under Oracle extended support until December 2030, so the two oldest supported lines are scheduled last. For JDK 8 and 11 estates carrying long-lived sensitive data, that is the latest Oracle backport date, and an operator can move earlier by upgrading the runtime or changing the TLS stack; on any line, protection arrives only when the update is installed and the hybrid group is confirmed to be negotiated.
What the post examines
The chronology from the KEM API of September 2023 to the H2 2027 backport, what JEP 527 deliberately leaves out, how the LTS backport calendar compares with the migration dates supervisors such as FINMA and NIST have set, and what a runtime default can move in the installed base that a supervisory deadline cannot.
Cloudflare's 1.1.1.1 Resolver Now Validates ML-DSA-44 DNSSEC Signatures, Announced 10 September 2026, and Refuses the Classical Fallback That RFC 6840 Would Allow
What Cloudflare announced on 10 September 2026
Cloudflare's public resolver 1.1.1.1 validates DNSSEC signatures made with ML-DSA-44, the lattice signature NIST standardized in FIPS 204 in August 2024 and the first post-quantum algorithm with an IANA DNSSEC number, 18. Sebastiaan Neuteboom and Bas Westerbaan's post gives the sizes: a 1,312-byte public key and a 2,420-byte signature, against 64 bytes for ECDSA P-256. The company plans full post-quantum security across its network by 2029.
Why the packet size and the downgrade rule matter
RFC 1035 restricted DNS over UDP to 512 bytes in November 1987; EDNS(0) raised the ceiling, DNS operators settled on 1,232 bytes, and RFC 9715 of January 2025 recommends 1,400. One ML-DSA-44 signature exceeds that budget before the answer carries anything else, so an authoritative server truncates the signed response and the validating resolver retries over another transport, usually TCP; a client that asks 1.1.1.1 for an address without requesting DNSSEC data sees none of this. The second problem is older than the algorithm. RFC 6840 tells validators they should accept any single valid path, which lets a zone publish classical and post-quantum keys together. Once a classical key can be forged, that same rule is a downgrade path. 1.1.1.1 now treats a post-quantum DS record in the parent zone as an authenticated signal and refuses to validate on a classical path alone, a local policy RFC 4035 permits and no standard yet requires.
What is settled and what is still open
NIST fixed the algorithm, IANA assigned the number, and the DNSSEC specification remains an individual Internet-Draft by Westerbaan of Cloudflare and Sophie Schmieg of Google, revision 04 of 11 August 2026, with no working-group adoption. An end-to-end post-quantum chain, from authoritative signing through registrar DS submission and registry publication to the root, remains incomplete. This post reads what the resolver change proves, what the packet arithmetic forces, and why the root key is the one that decides whether any of it counts.
RSA-260 Was Factored on 3 September 2026 for About $400,000 of GPU Time, and NIST's RSA-2048 Dates Do Not Move
What happened between 13 August and 9 September 2026
On 3 September 2026 Eric Lu, an engineer at Cognition, posted a 130-digit prime factor of RSA-260 on X. The number, 260 decimal digits and 862 bits, had stood unfactored since RSA Security published its challenge list in 1991. Scientific American ran a story the next day in which the only method on offer was a remark about "good old paper and pencil". On 9 September Cognition published Lu's technical write-up: a GPU port of the open-source CADO-NFS number field sieve, prepared and run with Devin coding agents, consuming about 4,900 GPU-days on NVIDIA GB200, GB300 and B200 nodes, which Lu prices at about $400,000 at current market rates.
How the cost compares with 2020 and 2009
RSA-250 was factored in February 2020 by six academic cryptographers using about 2,700 CPU core-years of CADO-NFS. RSA-768 took thirteen people two years to December 2009. Lu writes that he reports essentially no algorithmic advance, that the work was a side project on a single-digit percentage of Cognition's cluster, and that the barrier to entry for cryptanalytic work is far lower than it used to be.
What it means for keys in use
By Lu's own scaling, RSA-1024 is 78 times more computation, an extrapolated $30 million at market GPU prices, and RSA-2048 is roughly a billion times harder again. NIST's draft transition plan, IR 8547 of November 2024, proposes that RSA-2048 be deprecated after 2030 and disallowed after 2035; the proposal rests on the quantum threat, and this result does not revise it. What moved is the extrapolated price of a classical attack on 1,024-bit keys, which NIST disallowed for new signatures after 2013.
ECDSA.Fail Cut Its secp256k1 Point-Addition Benchmark Score 86 Percent on 9 September 2026; a Day Later Scripps Found 32 US States Without a Confirmed Post-Quantum Plan
What arXiv:2609.09582 says
On 9 September 2026, 36 authors led by Jieyi Long published the results of Eigen Labs' ECDSA.Fail contest: an eight-week public leaderboard in which humans and AI agents submitted evaluator-verified improvements to the reversible secp256k1 point-addition circuit inside Shor's algorithm. Participants cut the benchmark score, peak logical qubit width times average Toffoli count, by 86.1 percent. At the 26 July 2026 cutoff the best circuit used 1,151 qubits and about 1.30 million Toffoli gates. A later low-width design reached 813 qubits. The paper states that these figures sit more than 50 percent below Google's published point-addition thresholds of March 2026, under different accounting conventions, and that they are not a full-Shor estimate.
What the Howard Center found in 50 states
On 10 September 2026 the Howard Center for Investigative Journalism at Arizona State University and Scripps News published a 50-state analysis of post-quantum cryptography planning. Four states have an active migration plan: New Jersey, New York, Maryland and Missouri. Fourteen are committed to or developing one. Thirty-two gave the reporters no confirmation of an active or developing plan; nine of those declined to say. Executive order 14412 of 22 June 2026 sets 31 December 2030 for key establishment and 31 December 2031 for digital signatures on federal high-value systems, and contains no direction to state or local government.
The question this post answers
Whether a circuit-design contest that cut a benchmark score by algorithm alone changes what a city or state technology office with a cybersecurity budget and no post-quantum line item should do next, and why the federal deadlines that exist do not answer that question for it.
FINMA Guidance 05/2026 Recommends a Post-Quantum Roadmap by Mid-2027, and Only 8 Percent of the 60 Swiss Institutions It Surveyed Had One
What the guidance is
FINMA published Guidance 05/2026 on 9 July 2026. It reports a survey of 60 authorised Swiss banks, insurance companies, managers of collective assets and financial market infrastructures, run between November 2025 and January 2026, and sets out five post-quantum cryptography recommendations. The headline recommendation is that supervised institutions draw up a migration roadmap by mid-2027 at the latest, on the basis of a strategy adopted by the board of directors.
What this read covers
A section-by-section read of the eight-page instrument: how the reported 72 percent decomposes, what the 8 percent with a roadmap actually forecast, the scope of the section 3.2 cryptographic inventory, and the crypto-agility clause section 3.5 recommends for new outsourcing arrangements in the software and data sectors. It also notes the sentence that excludes quantum key distribution from the recommendations altogether, which is worth having in writing when a proposal arrives.
Why the survey is more interesting than the date
The percentages are the part that repays attention. Around two-thirds of those surveyed expect quantum cyber risk to become directly relevant for them within seven years, while almost two-thirds do not expect to run quantum computing applications themselves for another eight years or more. Those are two aggregate distributions rather than a respondent-level comparison, but the order they describe is the whole document: the gap between what the sector says it understands and what it has done about it.