A cryptographic breakthrough invalidates digital trust
- Likelihood, two years
- 1Remote
- to end-2028
- Likelihood, ten years
- 3Possible
- to end-2036
- Systemic impact
- 3Significant
- global
- National impact
- 4Severe
- typical highly exposed nation
- Onset pace
- Days
- Duration (acute phase)
- 1 year (revocation in 30 days, emergency migration over 12 months)
- Warning time
- None (the general risk was known; the date was not)
- Scope
- Global
- Recovery horizon
- Years
- Capability load
- Hard 2/3Soft 2/3Economic 1/3
- domains loaded High
- Concurrency
- Standalone
- triggers 4 · triggered by 3
- Confidence · movement
- low
- new
Rated at Standard Severe. Event reach: global event (The likelihood is that of an attack that is demonstrated or becomes evident. A capability that exists but is used covertly does not meet the definition until it is discovered.). Source of scores: model-panel-v0.5.
03Narrative
Dateline: March 2032
On 9 March 2031 three foreign ministries received copies of their own diplomatic cables from 2024, in plain text, through an intermediary. Within the week a software update carrying a valid signature from a large operating-system supplier was found on test machines at two central banks. The supplier's signing key had not been stolen. Forensic teams in four countries reached the same conclusion: the private key had been computed from the public one. A state held a quantum computer able to break 2048-bit RSA and 256-bit elliptic-curve keys at a rate of about one key a day, and had chosen to show it.
The rate mattered. The adversary could not read everything, but no defender could tell which keys it had already taken. Root certificates, code-signing keys and interbank message keys were treated as compromised. In the first 30 days governments and financial operators revoked credentials in order of consequence. Seven national identity schemes suspended remote signing. Several payment systems limited cross-border instructions to counterparties that had already moved to post-quantum algorithms or pre-shared symmetric keys, and correspondent banks reintroduced call-back confirmation and value limits. Electronic bills of lading were refused at a number of ports and paper documents returned.
Nothing physical failed. Power, telecommunications and data centres operated throughout. What stopped was the assurance that a message came from its sender, that a record had not been altered and that a signature would stand in court. Courts in several jurisdictions were asked whether contracts signed with revoked algorithms remained valid, and legislatures passed validating acts for documents signed before the disclosure date.
Nations that had completed cryptographic inventories and deployed hybrid key exchange on their main systems before 2030 finished the urgent work in about four months. Others found that they did not know where the vulnerable algorithms were. Smart cards, hardware security modules, industrial controllers, vehicles and medical devices held keys that could not be changed remotely, and replacement units were on allocation for most of the year. Specialist engineers were scarce and moved to the employers that paid most. Smaller states depended on a few foreign cloud and certificate suppliers for the timetable of their own recovery.
The larger loss was retrospective. Traffic intercepted and stored since the 2010s became readable at a pace the adversary chose. Agent identities, negotiating positions, health records and commercial secrets from two decades had to be assumed exposed. Selected disclosures continued through 2031 and were timed to coincide with negotiations and elections. Forged documents carrying valid signatures under the old algorithms circulated beside genuine ones, and official denials had limited effect.
By March 2032 most critical systems in advanced economies ran on post-quantum algorithms. Long-lived devices and many public registries in lower-income countries did not. The event was not an outage, and continuity plans written for outages did not apply. The capability it tested was knowing where trust was held in each system and being able to replace it in order of consequence.
The dateline is illustrative, not a forecast. The narrative is hypothetical; the historical anchors below are real events.
04Summary
An adversary demonstrates a practical quantum attack on widely used public-key cryptography (RSA and elliptic-curve algorithms) by decrypting intercepted material and forging selected digital signatures. Within 30 days, governments and financial operators must revoke vulnerable credentials and suspend some cross-border services. Sensitive data collected and stored in earlier years become readable. Emergency migration to post-quantum algorithms takes 12 months because embedded devices and supplier software cannot all be replaced at once. Physical networks keep operating, but confidence in authentication, confidential exchange and the legal validity of digital transactions falls sharply. Symmetric encryption with long keys is assumed to hold.
05Historical anchors
| Event | Date | What happened | Calibrates |
|---|---|---|---|
| DigiNotar compromise | June to September 2011 | An intruder issued more than 500 fraudulent certificates from the Dutch certificate authority DigiNotar, including one for google.com that was used to intercept traffic from about 300,000 addresses, almost all in Iran. Browsers removed trust, the Dutch government took over the company's operations because its own services relied on DigiNotar certificates, and the company was declared bankrupt in September 2011. | The speed at which trust is withdrawn once forgery is shown and the exposure of government services to a single certificate supplier. One authority failed in 2011; the scenario fails the algorithms that every authority uses. |
| Heartbleed | April 2014 | A flaw in the OpenSSL library, disclosed on 7 April 2014, allowed private keys to be read from server memory. Netcraft estimated that about 17 per cent of secure web servers, around half a million, were vulnerable. Operators had to patch, revoke and reissue certificates, and many did so slowly or not at all. The Canada Revenue Agency suspended online services for several days after 900 social insurance numbers were taken. | Mass revocation and reissue under time pressure, and the tail of systems that are never fixed. Heartbleed needed a software patch; the scenario needs new algorithms and, where keys are fixed in devices, new hardware. |
| Estonian identity card certificate suspension | September to November 2017 | A flaw in the key-generation library of a widely used chip made RSA keys on Estonian identity cards open to factoring in principle. On 3 November 2017 Estonia suspended the certificates of about 760,000 cards and required holders to update them remotely or in person. No theft of identity was reported. Service points were congested for weeks. | The national impact rating. A state with high digital capability took about two months to manage a flaw in one chip and one credential. The scenario affects every credential type at once and gives no period of private notice. |
| NIST post-quantum cryptography standards | 13 August 2024 | The US National Institute of Standards and Technology published its first three post-quantum standards (FIPS 203, 204 and 205), eight years after it called for proposals in 2016. Its draft transition guidance of November 2024 proposes that RSA and elliptic-curve algorithms at the 112-bit security level be deprecated after 2030 and that these algorithm families be disallowed after 2035. | The planned migration period, which runs to 2035. An event before then meets an incomplete transition, and the scenario compresses the remaining years of planned work into 12 months. |
| Venona project | 1943–1980 | United States signals intelligence began in 1943 to work on Soviet diplomatic and intelligence cables that had been intercepted and stored. Reuse of one-time pad material allowed about 3,000 messages sent in the 1940s to be read in whole or in part. The work continued until 1980 and identified agents long after the messages were sent. | The retrospective loss. Stored intercepts keep their intelligence value for decades, so the damage from a cryptographic failure is measured over the archive and not only from the date of the event. |
| Lloyd's cyber scenario | October 2023 | Lloyd's modelled a major cyber attack on a financial services payment system and put the global loss at US$3.5 trillion over five years. | The systemic impact rating. The Lloyd's case is a disruption to payments alone; the scenario adds government identity, trade documentation and software supply, without physical outage. |
06Parameters
Shown at their preset values. Parameters are not adjustable in this release and nothing on this page is computed from them. Custom settings run (Phase B) but are labelled 'non-standard run' and excluded from comparisons.
Common variables at Standard Severe · read-only
- 1. Severity
- major
- severe (Standard Severe)
- extreme
- 2. Duration (acute phase)
- 30 days
- 90 days
- 1 year (Standard Severe)
- 3 years
- 5 years
Standard Severe: 1 year (revocation in 30 days, emergency migration over 12 months)
- 3. Onset pace
- days (Standard Severe)
- weeks
- months
- years
- 4. Warning time
- none (Standard Severe)
- days
- months
Standard Severe: none (the general risk was known; the date was not)
- 5. Scope
- national
- regional
- global (Standard Severe)
- 6. Origin
- natural
- accidental
- adversarial (great power / neighbour / non-state) (Standard Severe)
- negotiated
Standard Severe: adversarial (great power)
- 7. External support
- full
- partial (Standard Severe)
- none
- 8. Concurrency
- standalone (Standard Severe)
- plus one named scenario
- plus two
- 9. Policy response assumed
- none (pure exposure)
- current plans executed (Standard Severe)
- best practice
- 10. Recovery horizon
- months
- years (Standard Severe)
- structural
Scenario-specific parameters · read-only
| Parameter | Default | Range or options | Note |
|---|---|---|---|
| Vulnerable share of public-key credentials in use | 60 per cent | 30 to 90 | Credentials that still rely on RSA or elliptic-curve algorithms with no post-quantum or hybrid alternative deployed. The share falls each year as migration proceeds. |
| Time to break one key | 1 day | 1 hour to 30 days | Decides whether compromise is selective or wholesale. At one day the adversary targets root, code-signing and interbank keys; at one hour bulk decryption of stored traffic becomes practical. |
| Revocation window | 30 days | 7 to 90 | Time within which governments and financial operators revoke vulnerable credentials on critical systems. |
| Emergency migration period | 12 months | 6 to 36 | Time to move critical systems to post-quantum algorithms. Long-lived devices outside critical systems take longer and are not counted. |
| Devices that cannot be updated in the field | 25 per cent | 10 to 50 | Smart cards, hardware security modules, industrial controllers, vehicles and medical devices that need physical replacement. |
| Depth of readable archive | 15 years | 5 to 25 | Period over which an adversary is assumed to have collected and kept encrypted traffic for later decryption. |
| Cross-border service restriction | 90 days | 30 to 180 | Period in which some cross-border payment, signing and trade document services are suspended or run under manual confirmation and value limits. |
07Transmission channels
- 1
A state shows that it can derive private keys from public keys for RSA and elliptic-curve algorithms, by releasing decrypted intercepts and forging selected signatures.
- 2
Certificate authorities, governments and financial operators treat root, code-signing and interbank keys as compromised and revoke vulnerable credentials within 30 days.
- 3
Services that cannot authenticate counterparties are suspended or restricted: remote signing, some cross-border payments, electronic trade documents and automatic software updates.
- 4
Stored intercepts become readable. Diplomatic, defence, health and commercial records from earlier years must be assumed exposed, and selective disclosure begins.
- 5
Emergency migration competes for scarce engineers, validated modules and replacement hardware. Embedded and operational devices that cannot be updated remotely set the pace.
- 6
Courts and legislatures must rule on documents signed with broken algorithms. Fraud and repudiation claims rise.
- 7
Forged and genuine disclosures circulate together. Confidence in digital records and official statements falls, and manual verification raises transaction costs for a year.
- 8
Dependence on a few foreign suppliers of cloud, certificate and cryptographic services decides the order in which nations recover.
08Capability loading
High: capability band shifts expected under current plans. Medium: band shifts under 'none' policy response only. Low: strain without band shift. Loads are judgement-based until the Atlas connects. Domains link to the Atlas.
| Domain | Load | Channel |
|---|---|---|
| Hard | ||
| Defence and security | High | Archived classified traffic becomes readable; command, identity and weapon-system authentication must be re-keyed while the adversary observes. |
| Strategic infrastructure | Medium | Networks keep running; device authentication, signed firmware, remote control links and payment infrastructure need replacement. |
| Critical technology | High | Cryptographic modules, certificate services and quantum capability decide who migrates independently and who waits for foreign suppliers. |
| Soft | ||
| Government effectiveness | High | Digital identity, signatures, registries and tax systems lose legal assurance; migration must be directed across agencies and operators. |
| Human capital | Low | Shortage of cryptographic engineers; health and education records exposed. |
| Influence and cohesion | High | Disclosed diplomatic traffic, forged official documents and lower public confidence in digital records and official statements. |
| Economic | ||
| Macro-financial | High | Payment, settlement and custody authentication; restricted cross-border services; fraud losses and the cost of emergency replacement. |
| Industry, trade and supply | Medium | Electronic trade documents, software supply chains and supplier credentials must be reissued; digital services trade slows. |
| Energy and resources | Low | Control-system authentication in grids and pipelines is weakened; operation continues under manual assurance. |
09Stakeholders
- Government Relevance 5/5
Exposure
Archived diplomatic, defence and intelligence traffic; national identity and signature schemes; tax, registry and court systems; the legal standing of documents signed with broken algorithms.
Actions
- Complete a cryptographic inventory of critical systems and set the order in which credentials would be revoked
- Deploy hybrid post-quantum key exchange on government networks and re-encrypt long-lived secrets ahead of national deadlines
- Prepare validating legislation and manual fallback procedures for identity, signing and cross-border payments
Watch
- Demonstrated logical qubit counts and published resource estimates
- Share of government systems reported as migrated against national deadlines
- Advisories on large-scale collection of encrypted traffic
- Technology Relevance 4/5
Exposure
Root and code-signing keys, certificate services, cloud key management, hardware security modules and embedded devices that cannot be updated in the field.
Actions
- Build systems so that algorithms can be replaced without redesign, and test the replacement
- Move software signing and update channels to post-quantum or hash-based signatures first
- Identify devices that need physical replacement and secure supply of validated modules
Watch
- Post-quantum share of encrypted web traffic
- Issuance of post-quantum certificates by publicly trusted authorities
- Validation queue for post-quantum cryptographic modules
- Investors Relevance 4/5
Exposure
Payment, settlement and custody operators; banks with large legacy estates; issuers whose value rests on confidential data; insurers with cyber and professional liability books.
Actions
- Ask portfolio companies for a cryptographic inventory and a dated migration plan
- Test liquidity and operations against 90 days of restricted cross-border settlement
- Review cyber policy wordings for accumulation from a single cryptographic cause
Watch
- Supervisory statements on quantum readiness in financial infrastructure
- Migration disclosures by systemically important payment and settlement operators
- Exclusions for cryptographic failure in cyber insurance renewals
- Public Relevance 3/5
Exposure
Digital identity, online banking and signing; health, tax and messaging records collected in earlier years; reliance on official statements that can no longer be verified digitally.
Actions
- Keep paper or offline copies of essential identity, property and financial records
- Use the in-person and assisted channels that authorities designate while credentials are reissued
- Treat leaked or signed documents as unverified until the issuing body confirms them
Watch
- Notices that identity cards, banking devices or applications must be replaced
- Temporary limits on remote signing and cross-border payments
- Official channels for verifying documents and public statements
10Regional exposure
| Region | Exposure | Rationale |
|---|---|---|
| North America | High | Largest concentration of cloud, certificate and payment services and extensive archived government traffic; migration capacity is strong and federal deadlines are set. |
| Europe | High | Heavy reliance on qualified electronic signatures and national identity schemes; migration timetables differ between member states. |
| China | High | A large state and financial estate on public-key systems, including national elliptic-curve algorithms; exposure depends on which power holds the capability. |
| Indo-Pacific | High | Advanced digital economies with dense trade documentation and semiconductor supply chains; alliance communications are intelligence targets. |
| South Asia | Medium | Very large digital identity and payment systems in India; lower digital dependence elsewhere in the region. |
| Gulf and Middle East | High | Financial centres, energy trading and state communications are high-value targets; reliance on foreign security suppliers is high. |
| Africa | Medium | Lower digital dependence, but mobile money and new identity systems use imported cryptography and local migration capacity is thin. |
| Latin America and Caribbean | Medium | Instant payment systems and digital tax administration are exposed; state archives are a lesser intelligence target. |
| Russia and Eurasia | High | State communications and archives are prime intelligence targets; sanctions limit access to replacement hardware and validated modules. |
11Early-warning indicators
| Indicator | Source | Threshold |
|---|---|---|
| Demonstrated error-corrected logical qubits and logical error rates | Peer-reviewed publications and published roadmaps of quantum hardware developers | 100 logical qubits sustaining deep circuits |
| Published resource estimates for breaking 2048-bit RSA and 256-bit elliptic-curve keys | arXiv; IACR Cryptology ePrint Archive | under 100,000 physical qubits |
| Share of encrypted web traffic using post-quantum key agreement | Cloudflare Radar | below 50 per cent of requests |
| National migration deadlines and reported progress for critical systems | NIST transition guidance (IR 8547); UK National Cyber Security Centre migration timelines; European Commission coordinated roadmap | published milestones missed |
| Post-quantum certificates in general issuance by publicly trusted authorities | CA/Browser Forum ballots; Certificate Transparency logs | none in general issuance |
| Validation queue for post-quantum cryptographic modules | NIST Cryptographic Module Validation Programme | queue longer than 12 months |
| Quantum readiness of payment and settlement infrastructure | Bank for International Settlements (Project Leap reports); G7 Cyber Expert Group statements | — |
| Official advisories on collection of encrypted traffic for later decryption | US Cybersecurity and Infrastructure Security Agency; UK National Cyber Security Centre | attributed large-scale collection reported |
12Compounds
- Triggers
- S02 Global funding seizure · Doubt about settlement and custody authentication could prompt withdrawals and a funding freeze.
- S04 Hybrid coercion · Forged credentials and readable archived traffic give a hostile state concealed access to operators.
- S05 Legitimacy rupture · Forged signatures and contested official records feed competing claims to lawful authority.
- S01 Trade bloc rupture · Supply of trusted cryptography divides along bloc lines, with incompatible standards and export controls.
- Triggered by
- S01 Trade bloc rupture · Technology rivalry accelerates state quantum programmes and reduces disclosure of progress.
- S03 Regional war spillover · A major power at war has the strongest reason to use or reveal a concealed capability.
- S17 Automated discovery step · AI-directed research could shorten the path to fault-tolerant hardware or to better algorithms.
An undisclosed advance in quantum error correction inside a state programmeA classical mathematical advance against factoring or discrete logarithms, which would have the same effect without a quantum computer- Amplified by
- S18 Public service leap · Greater reliance on digital identity and payments raises the cost of a trust failure where the platform was not built on post-quantum algorithms.
- S04 Hybrid coercion · A hybrid campaign under way gives the adversary prepared access and a reason to time disclosures.
- Amplifying trends
- Quantum computingPost-quantum cryptography transitionEspionage & insider threatCloud & edge computingDigital public infrastructureFinancial market infrastructure resilienceTrade & logistics digitalisationTechnical & occupational skill shortages
- Key trends
- Post-quantum cryptography transitionCriticalTokenisation of financial assetsVery highTrade & logistics digitalisationVery highQuantum computingVery high
From GINC Trends: the trends rated Very high or Critical for this scenario, of 250. All S09 trend scores.
13Rating rationale
| Rating | Band or level | Why |
|---|---|---|
| Likelihood, two years | 1Remote | No publicly known quantum computer is near the scale required. Published resource estimates for breaking 2048-bit RSA fell from about 20 million physical qubits in 2019 to under one million in 2025, but machines disclosed by 2026 hold far fewer, with error correction shown only on small numbers of logical qubits. A two-year event would need a concealed programme several years ahead of every public one. That is not excluded, but there is no evidence for it. |
| Likelihood, ten years | 3Possible | Developers' published roadmaps target fault-tolerant machines by about 2030, resource estimates have fallen by more than an order of magnitude in six years and state programmes do not report progress. Against that, engineering at the required scale is unproven, and migration shrinks the vulnerable estate each year. The event needs both a working machine and adversarial use before migration is complete, which places it in the 1 to 5 per cent range. |
| Systemic impact | 3Significant | Physical networks keep running, so the loss comes from transaction friction, suspended cross-border services, emergency replacement and fraud, not destroyed capacity. Lloyd's puts a major attack on payment systems at US$3.5 trillion over five years. A 12-month migration across finance, government and trade documentation is broader than that case, which supports level 3. No lasting loss of productive capacity is assumed, which holds the rating below level 4. |
| National impact | 4Severe | Rated on security and essential services for a highly exposed nation. Archived diplomatic, defence and intelligence traffic must be assumed readable, which cannot be reversed. Digital identity, remote signing and some payment services are restricted for weeks to months; Estonia suspended certificates on about 760,000 identity cards in 2017 for a far narrower flaw. Economic damage alone would rate level 3. The security loss raises the rating to level 4. |
| Confidence | low | There is no precedent for the failure of an entire class of cryptography, state quantum programmes are not observable and the rating was held by one member of the panel. |
Source of scores: model-panel-v0.5. Confidence refers to the rating, not the scenario. Calibration sources are listed with the anchors above and on the scenario methodology page.
14Open questions
Contested assumptions for the panel to resolve.
- Whether a capability that is used covertly and never demonstrated should be a separate preset, since the damage is then found late and no emergency migration is triggered.
- Whether the time to break one key, which separates selective from wholesale compromise, should be a common slider for this scenario and not a specific parameter.
- How to rate nations with low digital dependence: they lose less on the day, but they hold long-lived imported systems and have little capacity to migrate.
- Whether a systemic rating built on output at risk understates a loss that falls mainly on confidentiality and security, which the accounting does not measure.
15Commentary
No signed commentary in this build.
16Version and citation
- Version
0.5.0· active ·cryptographic-trust-break- Change log
0.5.0· 9 October 2026 · Entered the Library in the second pass, proposed by the model panel.
Rating history
One row per edition. Each edition page is frozen at release; corrections are published as errata.
| Edition | Rank | L2y | L10y | Systemic | National | Confidence | Edition view |
|---|---|---|---|---|---|---|---|
| 2027 | 10 | 1Remote | 3Possible | 3Significant | 4Severe | low | Open |
Versions
| Version | Date | Change |
|---|---|---|
| 0.5.0 | 9 October 2026 | Entered the Library in the second pass, proposed by the model panel. |
Citation and downloads
Cite as
GINC (2027). Scenario S09 A cryptographic breakthrough invalidates digital trust, Scenario Library v0.5. scenarios.ginc.org/scenarios/cryptographic-trust-break
Content and data are published under CC BY 4.0.