Who Are the Godfathers of Quantum Cryptography? Wiesner, Bennett, Brassard, Shor and the Code Breakers

The godfathers of quantum cryptography are Stephen Wiesner, Charles Bennett and Gilles Brassard. Wiesner had the founding idea around 1970, and Bennett and Brassard turned it into BB84, the 1984 scheme whose variants now run in operational quantum key distribution networks. Artur Ekert added an entangled version in 1991, while Peter Shor and Lov Grover showed in 1994 and 1996 what a quantum computer would do to today’s encryption.

The godfathers of quantum cryptography at a glance

The field was built in stages, first by people who made quantum codes and then by people who showed what a quantum computer would do to ordinary ones. The table sets out who did what.

Stephen Wiesner, conjugate coding and the paper nobody wanted

Quantum cryptography began around 1970 with a Columbia University graduate student named Stephen Wiesner, who wrote a short paper called Conjugate Coding that, by Brassard’s account, the journal IEEE Transactions on Information Theory turned down. His idea was that information could be written into a single particle of light, a photon, using one of two incompatible sets of measurement settings, so that anyone who read it without knowing which setting had been used would disturb it and leave a trace. Wiesner used this to describe quantum money, banknotes that could not be forged because physics forbids making a perfect copy of an unknown quantum state, a rule later formalised as the no-cloning theorem.

The paper sat in a drawer for more than a decade before SIGACT News, the newsletter of the Association for Computing Machinery’s theory group, printed it in 1983. Wiesner had described the idea years earlier to Charles Bennett, a friend since they were undergraduates at Brandeis University, and Bennett, who later joined IBM as a physicist, kept mentioning it to anyone who would listen. Wiesner spent much of his later life in Israel and died in 2021, and his name rarely appears in popular accounts of the field, although the Association for Computing Machinery’s announcement of this year’s Turing Award said Bennett and Brassard had been inspired by the insights of their late collaborator.

In a tribute after Wiesner’s death, the computer scientist Scott Aaronson recalled that Wiesner had embraced Orthodox Judaism, moved to Israel and taken up work there as a construction labourer, believing that manual labour was good for the soul. Recognition still found him, and in April 2019 the Micius Quantum Prize named him a laureate alongside Bennett, Brassard and Artur Ekert for their work on quantum cryptography.

Charles Bennett, Gilles Brassard and the BB84 protocol

In 1979 Bennett swam up to a young Montreal computer scientist named Gilles Brassard in the sea off San Juan, where both were attending a theoretical computer science conference, and started telling him about Wiesner’s banknotes. The two began working together, and in 1984 they presented a scheme at a conference in Bangalore that let two people agree on a secret key, the string of random bits used to encrypt and decrypt a message.

Its secrecy rested on the laws of physics, whereas conventional encryption relies on a maths problem being too slow to solve. The protocol took its name from their initials and the year, BB84, and variants of it now run in operational quantum key distribution networks, the systems that use quantum signals to share encryption keys, over optical fibre and through satellites.

In BB84 the sender, conventionally called Alice, encodes each bit in the polarisation of a single photon, meaning the direction in which its electric field vibrates, choosing at random between an upright and sideways pair of directions or a diagonal pair. The receiver, Bob, also picks one of the two pairs at random when he measures, and afterwards they tell each other over an ordinary public channel which pair they used, without ever revealing the bits, and keep only the bits where their choices matched.

An eavesdropper who intercepts the photons has to guess the pair as well, and her wrong guesses corrupt about a quarter of the bits Alice and Bob keep, so when they compare a sample and find too many errors they know someone was listening and throw the key away. A final step called privacy amplification squeezes the remaining key through a mathematical function so that any scraps an eavesdropper picked up become useless, leaving a key that no amount of computing power can recover.

Bennett and a summer student, John Smolin, built the first working apparatus in Bennett’s office at IBM in 1989, a device about two metres long made of mirrors, polarisers and photon detectors and run on software written by Brassard and his students, and it sent photons across 32.5 centimetres of open air. With four colleagues the pair went on in 1993 to describe quantum teleportation, the transfer of an unknown quantum state between two places using shared entanglement and an ordinary message.

They shared the Wolf Prize in Physics in 2018, and on 18 March 2026 the Association for Computing Machinery named them winners of the 2025 A.M. Turing Award, which IBM described as the first time the prize had recognised quantum research. Bennett was 82 and had spent more than half a century at IBM, and Brassard, then 70, is still a professor at the Université de Montréal.

Artur Ekert and the E91 entangled key

Artur Ekert, a Polish-born doctoral student at the University of Oxford, came at the problem from another angle and published his own scheme in Physical Review Letters in 1991. Ekert’s protocol, now called E91, uses entanglement, the linkage between two particles whose measurement results stay correlated however far apart they are taken, so a source sends out pairs of entangled photons and Alice and Bob each measure one half of every pair. To catch an eavesdropper they run a Bell test, a statistical check devised by the physicist John Bell in 1964 that tells genuinely quantum correlations apart from any explanation based on hidden pre-set values, and if someone has tampered with the photons the correlations drop below the level the test requires.

Bennett, Brassard and David Mermin showed in 1992 that a simplified entangled version of Ekert’s idea is mathematically equivalent to BB84. The Bell test had a further use that took three decades to reach the laboratory, because it certifies secrecy from the measurement statistics alone and so allows device-independent quantum key distribution, a form of the protocol that stays secure even when the users do not trust whoever built their hardware, and the first laboratory demonstrations appeared in 2022. Ekert later became a professor at Oxford and the founding director of the Centre for Quantum Technologies in Singapore.

The Singapore centre was founded in December 2007 with S$150 million from the country’s National Research Foundation, according to Physics World. Ekert, still an Oxford professor, is now a Distinguished Fellow there.

The Bell test at the heart of E91 also had to be made watertight. In 2015 groups at Delft University of Technology, the University of Vienna and the US National Institute of Standards and Technology reported Bell tests that closed the main loopholes together, and the Delft team wrote that its result “paves the way for implementing device-independent quantum-secure communication”. In October 2022 the Nobel Prize in Physics went to Alain Aspect, John Clauser and Anton Zeilinger “for experiments with entangled photons, establishing the violation of Bell inequalities and pioneering quantum information science”.

Quantum key distribution leaves the laboratory

On 21 April 2004 Zeilinger’s group in Vienna used entangled photons sent through 1.45 kilometres of optical fibre laid in the city’s sewers to secure a bank transfer from Vienna City Hall to the headquarters of Bank Austria Creditanstalt. By then a company already existed to sell the technology, because four University of Geneva researchers, Nicolas Gisin, Grégoire Ribordy, Olivier Guinnard and Hugo Zbinden, had founded ID Quantique in 2001, and in 2025 it became part of IonQ.

Geneva put the company’s equipment to public use in the Swiss federal elections of 21 October 2007, when the canton protected the line carrying ballot data from its central counting station to the government data centre. The State Chancellor, Robert Hensler, said that “the value added by quantum cryptography concerns not so much protection from outside attempts to interfere as the ability to verify that the data have not been corrupted in transit between entry and storage.” In 2017 ID Quantique said the system still secured every federal and cantonal election there.

China then took the technology into orbit. The Micius satellite was launched from the Jiuquan Satellite Launch Center on 16 August 2016, with Pan Jianwei of the University of Science and Technology of China as chief scientist. In 2017 his team reported in Science that Micius had sent entangled photon pairs to two ground stations 1,203 kilometres apart, and in Nature that it had beamed keys to the ground at more than a thousand bits per second from up to 1,200 kilometres away.

Micius also acted as a relay between continents, sharing keys between stations in China and Austria 7,600 kilometres apart. On the ground, China built a fibre trunk line of more than 2,000 kilometres between Beijing and Shanghai, and in January 2021 Pan’s group described a network joining more than 700 fibre links to two satellite links, spanning a total of about 4,600 kilometres. Both rely on trusted relays, stations where the key exists in readable form and whose operators must be trusted.

Security agencies in Britain and the United States remain unconvinced. In a white paper published on 24 March 2020 the UK National Cyber Security Centre, the NCSC, said that it “does not endorse the use of QKD for any government or military applications”, citing its specialised hardware and need for authentication. The US National Security Agency said in October 2020 that it “does not support the usage of QKD or QC to protect communications in National Security Systems”, warning that trusted relays add insider threat risks and that the security of such systems is “highly implementation-dependent rather than assured by laws of physics”.

Peter Shor’s algorithm and the threat to public-key encryption

Peter Shor, a mathematician at AT&T Bell Laboratories, gave quantum computing its first serious threat to encryption in 1994. At the Foundations of Computer Science symposium that year he presented an algorithm showing that a large enough quantum computer could factor big numbers into their primes, and solve a related task called the discrete logarithm problem, in a time that grows only modestly with the size of the number, while the best methods on ordinary computers slow down almost exponentially. Public-key cryptography, the system that lets two strangers set up a secure connection over the internet without meeting first, depends almost entirely on those two problems being hard, with RSA built on factoring and Diffie-Hellman key exchange and elliptic-curve cryptography built on discrete logarithms.

Shor’s method turns factoring into a hunt for a period, the length after which a particular sequence of numbers starts repeating. It then applies a quantum Fourier transform, a quantum version of the mathematical tool that picks out the frequencies hidden in a signal, which makes the computer’s wave-like amplitudes reinforce one another at the correct period and cancel out elsewhere, so a measurement at the end reveals the period with high probability and ordinary arithmetic turns it into the factors. Every later effort to replace RSA and elliptic curves, including the standards described further down, is a response to this 1994 paper.

A year later Shor published the first quantum error-correcting code, which spreads one unit of quantum information across nine qubits, the basic units of quantum information that can hold a weighted blend of 0 and 1, so that errors can be spotted and repaired. That gave the first answer to critics who argued real hardware would always be too noisy to run his algorithm. He received the Nevanlinna Prize in 1998, shared a Breakthrough Prize in Fundamental Physics with Bennett, Brassard and David Deutsch in 2023, and is now a professor of applied mathematics at the Massachusetts Institute of Technology.

Shor took a mathematics degree at Caltech in 1981 and a doctorate in applied mathematics at MIT in 1985, then spent a year as a postdoctoral researcher at the University of California, Berkeley. He joined AT&T Bell Laboratories in Murray Hill, New Jersey, in 1986 and became a professor at MIT in 2003.

The algorithm first ran on real hardware in December 2001, when Lieven Vandersypen, Isaac Chuang and colleagues at IBM’s Almaden Research Center and Stanford University factored 15 into 3 and 5 using seven atomic nuclei in a single molecule, steered with nuclear magnetic resonance. The team was careful to write that “such scalability is not implied by the present work”.

In 2013 John Smolin of IBM and two colleagues argued in Nature that such experiments relied on “compiling” the algorithm, choosing in advance a starting number with a short repeating period. Pushed to the limit, the trick factored products of large primes with only two qubits, so the true measure of difficulty, they argued, is the length of the period found rather than the size of the number.

Lov Grover’s algorithm and the square-root shortcut

Lov Grover, a colleague of Shor’s at Bell Labs, published a quantum algorithm in 1996 for searching an unsorted list, the kind of problem where an ordinary computer can only check entries one at a time. Grover’s method finds the right entry in a number of steps proportional to the square root of the list’s length, so a million items take around a thousand quantum steps, and it works by repeatedly nudging up the amplitude of the correct answer and shrinking the others until a measurement almost certainly lands on it.

For cryptography this matters less than Shor’s result, but it reaches the other half of modern encryption, symmetric ciphers such as the Advanced Encryption Standard, AES, in which both sides use the same secret key, and hash functions, the one-way fingerprints used to check that data has not been tampered with. Trying every possible key is exactly the kind of blind search Grover speeds up, which in principle cuts a 128-bit key down to the strength of a 64-bit one, which is why the US National Security Agency now specifies 256-bit keys for national security systems. The speed-up is only quadratic and the algorithm splits badly across many machines, so most cryptographers consider symmetric encryption safe once key lengths are doubled, and Shor’s algorithm remains the main reason the world is replacing its public-key systems.

Grover studied electrical engineering at the Indian Institute of Technology Delhi, graduating in 1981, and took a doctorate in the same subject at Stanford University before joining Bell Labs in 1984 to work on computer-aided chip design. A chip design system he built there was used to produce several thousand AT&T commercial chips, and he moved to physics research at Bell Labs in 1998 before retiring in 2008 to work as an independent researcher.

Proving BB84 safe, and then breaking the boxes

BB84 looked sound from the start, but a complete proof that it resists every attack quantum physics allows took more than a decade. Dominic Mayers produced the first in 1996, a long and difficult argument that the Journal of the ACM eventually published in 2001, and Hoi-Kwong Lo and Hoi Fung Chau gave a separate proof in Science in 1999 for an entanglement-based scheme that assumed both users had fault-tolerant quantum computers. In 2000 Shor and John Preskill of Caltech linked BB84 to the error-correcting codes Shor had helped invent and wrote a short proof that is still the version most students learn.

Those proofs assumed perfect equipment, and much of the next twenty years went on finding where real equipment falls short. Early lasers sometimes fired two photons instead of one, letting an eavesdropper skim off the spare in what became known as the photon-number-splitting attack, until Won-Young Hwang, then Lo, Xiongfeng Ma and Kai Chen, and separately Xiang-Bin Wang developed decoy states between 2003 and 2005, extra pulses at varied brightness that expose anyone siphoning photons. In 2010 Lars Lydersen, Vadim Makarov and colleagues at the Norwegian University of Science and Technology and in Erlangen showed that shining bright light into the detectors of two commercial systems could blind them and let an attacker dictate the key without raising the error rate.

Attacks of this kind led Lo, Marcos Curty and Bing Qi to propose measurement-device-independent quantum key distribution in 2012, a design in which the detectors no longer need to be trusted, and Makarov has carried on probing commercial systems for weaknesses ever since. Twin-field quantum key distribution, proposed by Marco Lucamarini and colleagues at Toshiba in Cambridge in 2018, has since pushed secure links to hundreds of kilometres of optical fibre.

The lattice builders and the new standards

The replacement for RSA that governments and tech companies are now rolling out is post-quantum cryptography, a name Daniel J. Bernstein of the University of Illinois Chicago coined in 2003 for ordinary software encryption designed to withstand quantum attack. It runs on conventional computers and swaps factoring for problems that no known quantum algorithm can solve quickly. The leading family is built on lattices, regular grids of points stretching through hundreds of dimensions, where the hard task is finding the grid point nearest a given location when the grid has been described using a deliberately awkward set of directions.

Miklós Ajtai of IBM showed in 1996 that some lattice problems are hard on average whenever they are hard in their worst case, a guarantee factoring has never had, and in the same year Jeffrey Hoffstein, Jill Pipher and Joseph Silverman at Brown University designed NTRU, a fast lattice encryption scheme whose descendants are still in use. Oded Regev, now at New York University, introduced learning with errors in 2005, a problem in which an attacker is handed a long list of linear equations with small random errors mixed in and asked to recover the secret behind them, and it won him the Gödel Prize in 2018. Chris Peikert of the University of Michigan, Vadim Lyubashevsky of IBM Research Zurich, Léo Ducas of CWI in Amsterdam and Damien Stehlé, now of CryptoLab, were among those who turned these ideas into working designs, and Lyubashevsky, Ducas and Stehlé were co-authors on the CRYSTALS team behind the Kyber and Dilithium schemes.

The US National Institute of Standards and Technology, NIST, opened a public competition in 2016 that drew 82 submissions and published its first three post-quantum standards in August 2024. FIPS 203, now called ML-KEM, handles key exchange and is based on Kyber, FIPS 204, called ML-DSA, covers digital signatures and is based on Dilithium, and FIPS 205, called SLH-DSA, is a signature scheme built only from hash functions that grew out of the SPHINCS+ design produced by a large team that included Bernstein and Andreas Hülsing. NIST picked the code-based scheme HQC as a backup for key exchange in March 2025, and a fourth standard, FN-DSA, based on the compact Falcon signature scheme and NTRU lattices, has yet to be published as FIPS 206 by the post-quantum project that Dustin Moody leads.

The modern hunters, breaking schemes and pricing the attack

In February 2022 Ward Beullens, then at IBM Research Zurich, showed that Rainbow, a signature finalist in the NIST contest built on systems of multivariate polynomial equations, could have its secret key recovered at the lowest security level in about a weekend on a laptop. In July of the same year Wouter Castryck and Thomas Decru of KU Leuven broke SIKE, a key-exchange candidate based on isogenies, which are structure-preserving maps between elliptic curves, recovering keys at its lowest security level in about an hour on a single processor core, a time the authors later cut to about ten minutes, with the help of a theorem Ernst Kani had published in 1997. Neither attack needed a quantum computer, and both schemes had survived years of public review before falling, which is why NIST keeps backup algorithms drawn from different areas of mathematics.

The lattice schemes had their own scare in April 2024, when Yilei Chen of Tsinghua University posted a paper claiming a quantum algorithm that could solve some versions of learning with errors efficiently, which would not have broken ML-KEM or ML-DSA directly but would have shaken the theory beneath them. Within about a week Hongxun Wu and Thomas Vidick found a flaw in a key step and Chen withdrew the claim, but the episode was a reminder that confidence in lattice security rests on decades of failed attacks, since nobody has proved these problems hard for a quantum computer. Regev himself had moved to the attacking side in 2023 with a new quantum factoring algorithm that uses fewer gate operations than Shor’s for very large numbers, at the cost of more qubits, and Seyoon Ragavan and Vinod Vaikuntanathan of MIT soon cut its memory demands.

Craig Gidney of Google Quantum AI and Martin Ekerå of the Swedish National Communications Security Authority and KTH Royal Institute of Technology estimated in 2019 that factoring a 2048-bit RSA key would take about 20 million physical qubits running for eight hours. A physical qubit is a single noisy piece of hardware, and a logical qubit is a reliable unit built from many physical ones through error correction. Gidney brought that figure down in a May 2025 paper to fewer than one million noisy qubits running for under a week, a twentyfold reduction that Quantum Zeitgeist covered at the time, by using approximate arithmetic, packing idle logical qubits more densely and making the special states that error-corrected machines consume more cheaply.

On 30 March 2026 two more papers turned to elliptic curves. A Google Quantum AI team led by Ryan Babbush, working with the Ethereum Foundation and Stanford University, estimated that secp256k1, the 256-bit curve that secures Bitcoin and Ethereum, could be broken in minutes with fewer than 1,200 logical qubits, or under 500,000 physical qubits on a superconducting machine.

A team from the start-up Oratomic and Caltech that included John Preskill and Dolev Bluvstein estimated that a neutral-atom machine, which uses individual atoms held in laser traps as qubits, could solve the same problem on P-256, a comparable 256-bit curve, with about 26,000 physical qubits in several days, according to a summary in the American Physical Society’s Physics magazine. Google had already set itself a 2029 deadline to move its own products onto quantum-resistant encryption.

Michele Mosca of the University of Waterloo’s Institute for Quantum Computing gave the field the rule of thumb it uses to read these numbers, known as Mosca’s inequality. If the number of years some data must stay secret, plus the number of years needed to move a system onto new cryptography, adds up to more than the number of years until a quantum computer can break today’s encryption, that data is already at risk, because an adversary can record encrypted traffic now and decrypt it later in what is called a harvest now, decrypt later attack. Mosca has co-authored the Global Risk Institute’s annual Quantum Threat Timeline Report since 2019, which asks dozens of researchers each year when such a machine will arrive.

Governments set the deadlines

Governments have turned that arithmetic into dates. On 4 May 2022 the White House issued National Security Memorandum 10, which set the goal of “mitigating as much of the quantum risk as is feasible by 2035” and gave agencies running national security systems a year to document where they use quantum-vulnerable cryptography. In a draft transition plan, NIST IR 8547, published on 12 November 2024, NIST proposed that RSA and elliptic-curve algorithms at the 112-bit security level be deprecated after 2030 and that these quantum-vulnerable algorithms be disallowed at every security level after 2035.

The NCSC published its own migration timeline on 20 March 2025, asking organisations to complete discovery and an initial plan by 2028, finish their highest-priority migration by 2031 and move all their systems, services and products to post-quantum cryptography by 2035. In the United States, Executive Order 14412, signed on 22 June 2026, orders guidance requiring federal agencies to move their high value assets and high impact systems to post-quantum key establishment by 31 December 2030 and to post-quantum digital signatures by 31 December 2031. National security systems fall outside that review, and the NSA must report on their migration to the President each year.

The history of quantum cryptography, year by year