Quantum computing, explained plainly — then the QuScor glossary.
No cryptography background required. Start with the basics, then dig into the specific terms that show up in a QuScor report.
Quantum Basics
How money became digital, how it's kept safe today, and why that's about to change.
01A two-minute history of money
People have traded goods for thousands of years — first directly, then through gold and silver, then paper notes backed by trust in governments. In 2009, someone using the name Satoshi Nakamoto proposed money that needed no bank or government at all: a shared ledger kept honest by math, open to anyone. That became Bitcoin.
02What Bitcoin actually is
Picture a giant public spreadsheet — the blockchain — visible to everyone, editable by no one. When you send Bitcoin, a new line is added. Ownership comes down to one thing: a private key, a secret number mathematically tied to your address. Hold the key, you control the coins. The same logic secures Ethereum, Solana, and the stablecoins (like USDT) that move on top of them — different chains, the same private-key foundation.
03How cryptography protects it today
Bitcoin (and most of the internet — your bank login, your email) relies on elliptic-curve cryptography (ECC), specifically a curve called secp256k1 for Bitcoin's signatures. It's not "unbreakable" in a mathematical sense — it just requires a regular computer roughly billions of years to guess a private key. That's been good enough for fifty years of digital security.
04What a quantum computer actually is
A classical computer stores information as bits — 0 or 1. A quantum computer uses qubits, which exploit quantum physics to represent many states at once. That doesn't make them faster at everything — video games and spreadsheets gain nothing. But for a narrow class of math problems, including the ones ECC relies on, a large enough quantum computer solves them exponentially faster than any classical machine ever could.
05Shor's Algorithm and Q-Day
In 1994, mathematician Peter Shor published an algorithm proving a sufficiently powerful quantum computer could break the integer-factoring and discrete-logarithm problems that RSA and ECC (and therefore ECDSA — the signature scheme behind Bitcoin, Ethereum, and most crypto) depend on. The day a quantum computer becomes powerful enough to do this for real is called Q-Day. A separate result, Grover's Algorithm, only halves the effective strength of symmetric encryption like AES — a much smaller problem, solved by using longer keys. Credible estimates place Q-Day within the next decade, and a Google Quantum AI resource estimate published in early 2026 cut prior estimates further by showing Shor's algorithm needs roughly 20× fewer qubits than previously thought.
06Harvest-Now-Decrypt-Later (HNDL)
Q-Day being years away doesn't mean the risk is years away. Adversaries can record encrypted data today — custody records, wallet logs, communications — and simply hold it until a quantum computer can break it. Anything that needs to stay confidential past Q-Day is already exposed if it isn't migrated now. This is the reason institutions can't treat quantum migration as a someday problem.
07Why "just swap the algorithm later" doesn't work
Institutional cryptographic migration — inventorying every key, every certificate, every vendor dependency, then rolling out new algorithms without breaking production systems — takes most organizations five to seven years to do correctly. The cost of preparing early is bounded and known. The cost of being late is not. That asymmetry is the entire argument for starting now, which regulators, insurers, and auditors are increasingly formalizing into requirements.
QuScor Glossary
The specific terms you'll see in a Quantum Readiness Assessment, an Auditor Package, or a QuScor conversation.
Quantum Readiness Score (QRS)
QuScor's proprietary 0–100 score summarizing an organization's cryptographic and post-quantum migration posture across six weighted categories.
Harvest-Now-Decrypt-Later (HNDL)
An attack pattern where adversaries record encrypted data today with the intent to decrypt it later, once quantum computers are powerful enough to break current encryption.
Crypto-Agility (Algorithm Agility)
The ability to swap cryptographic algorithms — e.g. RSA or ECC to ML-KEM — without a full system rebuild. The core capability regulators and insurers are starting to ask about directly.
FIPS 203 / ML-KEM
NIST's finalized standard for ML-KEM (Module-Lattice-Based Key Encapsulation Mechanism), the post-quantum key-exchange algorithm — the reference point auditors and HSM vendors are building toward.
CNSA 2.0
The NSA's Commercial National Security Algorithm Suite — the required post-quantum algorithm set (ML-KEM, ML-DSA, AES-256) for national security systems. Preferred in network equipment by 2026, mandated across software and firmware by 2027, full cutover by 2035.
Evidence Tier
A confidence rating attached to every finding in a QuScor report — from self-attested questionnaire responses up through validated technical corroboration — so an auditor can see exactly how much independent verification stands behind a number.
Sector Overlay
QuScor's six scoring categories are reweighted by sector — custodian, defense/government contractor, or general enterprise — so a digital-asset custodian's SOC 2 exposure and a defense subcontractor's CNSA 2.0 timeline are scored against different priorities, not one generic rubric.
MPC vs. HSM
Two different ways to protect a private key. An HSM (Hardware Security Module) is a dedicated physical device that generates and holds keys, never exposing the raw key material. MPC (Multi-Party Computation) splits a key into shares held by separate parties so no single party ever holds the whole key. QuScor's key-custody category assesses either architecture on its own merits — the two aren't interchangeable, and migration paths differ for each.
Cryptographic Bill of Materials (CBOM)
An inventory of every algorithm, key, and certificate in use across a system — the standard evidence artifact auditors expect alongside a documented migration plan and proof of pilot deployments.
DORA
The EU's Digital Operational Resilience Act — financial-sector ICT risk regulation that increasingly references cryptographic resilience and third-party dependency, relevant to any QuScor client with EU exposure.
NIST SP 800-171 / CMMC
The federal controls framework (and DoD's certification program built on it) that U.S. defense contractors must meet to handle controlled unclassified information — increasingly referenced alongside post-quantum migration requirements.
ECDSA
Elliptic Curve Digital Signature Algorithm — the signature scheme securing Bitcoin, Ethereum, and most blockchains today. Broken by Shor's algorithm on a sufficiently large quantum computer, which is the root of the entire quantum-readiness conversation.