  Quantum algorithms can break factoring and discrete logarithm based
cryptography and weaken symmetric cryptography and hash functions. In order to
estimate the real-world impact of these attacks, apart from tracking the
development of fault-tolerant quantum computers it is important to have an
estimate of the resources needed to implement these quantum attacks.
  For attacking symmetric cryptography and hash functions, generic quantum
attacks are substantially less powerful than they are for today's public-key
cryptography. So security will degrade gradually as quantum computing resources
increase. At present, there is a substantial resource overhead due to the cost
of fault-tolerant quantum error correction. We provide estimates of this
overhead using state-of-the-art methods in quantum fault-tolerance. We use
state-of-the-art optimized circuits, though further improvements in their
implementation would also reduce the resources needed to implement these
attacks. To bound the potential impact of further circuit optimizations we
provide cost estimates assuming trivial-cost implementations of these
functions. These figures indicate the effective bit-strength of the various
symmetric schemes and hash functions based on what we know today (and with
various assumptions on the quantum hardware), and frame the various potential
improvements that should continue to be tracked. As an example, we also look at
the implications for Bitcoin's proof-of-work system.
  For many of the currently used asymmetric (public-key) cryptographic schemes
based on RSA and elliptic curve discrete logarithms, we again provide cost
estimates based on the latest advances in cryptanalysis, circuit compilation
and quantum fault-tolerance theory. These allow, for example, a direct
comparison of the quantum vulnerability of RSA and elliptic curve cryptography
for a fixed classical bit strength.
