# **STANFORD UNIVERSITY**
## **CS 221: AI-Powered Cybersecurity**
### **Defending Against Quantum Attacks — 2026 Edition**
#### *Revised & Upgraded Study Guide — Complete Edition*
---
# **PART 1: FOUNDATIONS OF THE QUANTUM THREAT LANDSCAPE**
---
## **Page 1 — Executive Summary & Course Orientation**
### 1.1 The Convergence of AI and Quantum Cryptography
The year 2026 marks a critical inflection point in cybersecurity. Two transformative
technologies — **artificial intelligence** and **quantum computing** — are
converging to fundamentally reshape the threat landscape. This course examines
how AI systems can be deployed to defend against quantum-enabled attacks while
simultaneously addressing the novel vulnerabilities that AI itself introduces into
cryptographic infrastructure.
The central thesis of this guide: **cybersecurity in the quantum era cannot rely on
cryptographic strength alone.** It requires an integrated defense architecture
combining:
- Post-quantum cryptographic primitives (PQC)
- AI-driven anomaly detection
- Quantum-aware threat intelligence
- Organizational crypto-agility
> 💡 **Key Framing Concept:** The threat is not just "quantum computers breaking
encryption someday." The threat is *already active* through HNDL campaigns
(explained on Page 3), meaning organizations that delay migration are already
compromised in slow motion.
---
### 1.2 Learning Objectives
Upon completion of Part 1, students will be able to:
1. Articulate the mathematical foundations of Shor's and Grover's algorithms and their
specific impact on RSA, ECC, and symmetric encryption
2. Evaluate the four NIST-standardized PQC algorithms: ML-KEM, ML-DSA, SLH-DSA,
FN-DSA
3. Analyze the "harvest now, decrypt later" (HNDL) threat vector and its implications
for long-term data confidentiality
,4. Design AI-powered anomaly detection architectures for quantum-precursor attack
identification
5. Assess trade-offs between lattice-based, hash-based, and code-based
post-quantum approaches
6. Formulate phased migration strategies from classical to post-quantum
infrastructure
7. Evaluate the dual-use risk of Quantum AI (QAI) in offensive and defensive
cybersecurity
8. Apply regulatory frameworks (CNSA 2.0, NIST IR 8547, FIPS 140-3) to compliance
planning
---
### 1.3 The Urgency of 2026 — Why Now?
Three converging developments make 2026 the decisive year:
| Driver | Development | Implication |
|--------|------------|-------------|
| **Hardware Progress** | Qubit resource estimates for breaking RSA-2048 dropped
from ~20M to ~100K physical qubits | CRQCs may arrive 2030–2035, not 2040+ |
| **Regulatory Deadlines** | NSA CNSA 2.0 requires quantum-safe systems for new
NSS by January 1, 2027 | Compliance window is closing |
| **Active HNDL Campaigns** | Nation-state actors confirmed collecting encrypted
traffic since ~2018 | Data stolen today can be decrypted retroactively |
> ⚠️**Critical Insight:** There is no "safe waiting period." Every day of delayed
migration extends the retroactive exposure window.
---
## **Page 2 — Mathematical Foundations of Quantum Threats**
### 2.1 Shor's Algorithm: The Existential Threat to Public-Key Cryptography
In 1994, Peter Shor demonstrated that a sufficiently powerful quantum computer
could factor large integers and compute discrete logarithms in **polynomial time
O(log³ N)**, compared to the best classical sub-exponential algorithms running in
roughly **O(e^(log N)^(1/3))** time.
This directly destroys the hardness assumptions of:
- **RSA** — security relies on integer factorization difficulty
- **ECC** — security relies on elliptic curve discrete logarithm problem (ECDLP)
- **Diffie-Hellman** — security relies on discrete logarithm problem (DLP)
**How Shor's Algorithm Works (Conceptual):**
```
, Step 1: Reduce factoring N = p × q to finding the period r of f(x) = aˣ mod N
Step 2: Use Quantum Fourier Transform (QFT) to find period r exponentially faster
Step 3: Derive factors p and q from r using classical post-processing
Total complexity: O((log N)² (log log N) (log log log N))
```
**Quantum Vulnerability Matrix:**
| Cryptographic System | Hard Problem | Classical Complexity | Quantum Complexity
(Shor) | Verdict |
|---------------------|-------------|---------------------|--------------------------|---------|
| RSA-2048 | Integer Factorization | Sub-exponential | Polynomial | **BROKEN** |
| ECC (secp256k1) | ECDLP | Exponential | Polynomial | **BROKEN** |
| Diffie-Hellman-2048 | DLP | Sub-exponential | Polynomial | **BROKEN** |
| AES-128 | Brute-force search | 2¹²⁸ | 2⁶⁴ (Grover) | **Weakened** |
| AES-256 | Brute-force search | 2²⁵⁶ | 2¹²⁸ (Grover) | **Secure** |
| SHA-256 | Preimage/collision | 2²⁵⁶/2¹²⁸ | 2¹²⁸/2⁸⁵ | **Secure** |
---
### 2.2 Grover's Algorithm: The Symmetric Cipher Challenge
Grover's algorithm provides a **quadratic speedup** for unstructured search
problems — finding a specific input among N possibilities in **O(√N)** queries instead
of O(N).
**Practical Impact:**
| Algorithm | Classical Security | Post-Grover Security | Status |
|-----------|-------------------|---------------------|--------|
| AES-128 | 128-bit | ~64-bit | **Insufficient** |
| AES-256 | 256-bit | ~128-bit | **Acceptable** |
| SHA-256 | 256-bit | ~128-bit | **Acceptable** |
| SHA-1 | 160-bit | ~80-bit | **Deprecated** |
| 3DES | 112-bit | ~56-bit | **Broken** |
**Key Takeaway:** Unlike Shor's algorithm (which completely breaks public-key
cryptography), Grover's algorithm is mitigable by **doubling key lengths**. No
symmetric algorithm replacement is needed — only parameter upgrades.
---
### 2.3 The Resource Estimate Revolution of 2025–2026
The most significant recent development is the dramatic reduction in estimated
physical qubit requirements:
**Google Quantum AI (2026):**
## **CS 221: AI-Powered Cybersecurity**
### **Defending Against Quantum Attacks — 2026 Edition**
#### *Revised & Upgraded Study Guide — Complete Edition*
---
# **PART 1: FOUNDATIONS OF THE QUANTUM THREAT LANDSCAPE**
---
## **Page 1 — Executive Summary & Course Orientation**
### 1.1 The Convergence of AI and Quantum Cryptography
The year 2026 marks a critical inflection point in cybersecurity. Two transformative
technologies — **artificial intelligence** and **quantum computing** — are
converging to fundamentally reshape the threat landscape. This course examines
how AI systems can be deployed to defend against quantum-enabled attacks while
simultaneously addressing the novel vulnerabilities that AI itself introduces into
cryptographic infrastructure.
The central thesis of this guide: **cybersecurity in the quantum era cannot rely on
cryptographic strength alone.** It requires an integrated defense architecture
combining:
- Post-quantum cryptographic primitives (PQC)
- AI-driven anomaly detection
- Quantum-aware threat intelligence
- Organizational crypto-agility
> 💡 **Key Framing Concept:** The threat is not just "quantum computers breaking
encryption someday." The threat is *already active* through HNDL campaigns
(explained on Page 3), meaning organizations that delay migration are already
compromised in slow motion.
---
### 1.2 Learning Objectives
Upon completion of Part 1, students will be able to:
1. Articulate the mathematical foundations of Shor's and Grover's algorithms and their
specific impact on RSA, ECC, and symmetric encryption
2. Evaluate the four NIST-standardized PQC algorithms: ML-KEM, ML-DSA, SLH-DSA,
FN-DSA
3. Analyze the "harvest now, decrypt later" (HNDL) threat vector and its implications
for long-term data confidentiality
,4. Design AI-powered anomaly detection architectures for quantum-precursor attack
identification
5. Assess trade-offs between lattice-based, hash-based, and code-based
post-quantum approaches
6. Formulate phased migration strategies from classical to post-quantum
infrastructure
7. Evaluate the dual-use risk of Quantum AI (QAI) in offensive and defensive
cybersecurity
8. Apply regulatory frameworks (CNSA 2.0, NIST IR 8547, FIPS 140-3) to compliance
planning
---
### 1.3 The Urgency of 2026 — Why Now?
Three converging developments make 2026 the decisive year:
| Driver | Development | Implication |
|--------|------------|-------------|
| **Hardware Progress** | Qubit resource estimates for breaking RSA-2048 dropped
from ~20M to ~100K physical qubits | CRQCs may arrive 2030–2035, not 2040+ |
| **Regulatory Deadlines** | NSA CNSA 2.0 requires quantum-safe systems for new
NSS by January 1, 2027 | Compliance window is closing |
| **Active HNDL Campaigns** | Nation-state actors confirmed collecting encrypted
traffic since ~2018 | Data stolen today can be decrypted retroactively |
> ⚠️**Critical Insight:** There is no "safe waiting period." Every day of delayed
migration extends the retroactive exposure window.
---
## **Page 2 — Mathematical Foundations of Quantum Threats**
### 2.1 Shor's Algorithm: The Existential Threat to Public-Key Cryptography
In 1994, Peter Shor demonstrated that a sufficiently powerful quantum computer
could factor large integers and compute discrete logarithms in **polynomial time
O(log³ N)**, compared to the best classical sub-exponential algorithms running in
roughly **O(e^(log N)^(1/3))** time.
This directly destroys the hardness assumptions of:
- **RSA** — security relies on integer factorization difficulty
- **ECC** — security relies on elliptic curve discrete logarithm problem (ECDLP)
- **Diffie-Hellman** — security relies on discrete logarithm problem (DLP)
**How Shor's Algorithm Works (Conceptual):**
```
, Step 1: Reduce factoring N = p × q to finding the period r of f(x) = aˣ mod N
Step 2: Use Quantum Fourier Transform (QFT) to find period r exponentially faster
Step 3: Derive factors p and q from r using classical post-processing
Total complexity: O((log N)² (log log N) (log log log N))
```
**Quantum Vulnerability Matrix:**
| Cryptographic System | Hard Problem | Classical Complexity | Quantum Complexity
(Shor) | Verdict |
|---------------------|-------------|---------------------|--------------------------|---------|
| RSA-2048 | Integer Factorization | Sub-exponential | Polynomial | **BROKEN** |
| ECC (secp256k1) | ECDLP | Exponential | Polynomial | **BROKEN** |
| Diffie-Hellman-2048 | DLP | Sub-exponential | Polynomial | **BROKEN** |
| AES-128 | Brute-force search | 2¹²⁸ | 2⁶⁴ (Grover) | **Weakened** |
| AES-256 | Brute-force search | 2²⁵⁶ | 2¹²⁸ (Grover) | **Secure** |
| SHA-256 | Preimage/collision | 2²⁵⁶/2¹²⁸ | 2¹²⁸/2⁸⁵ | **Secure** |
---
### 2.2 Grover's Algorithm: The Symmetric Cipher Challenge
Grover's algorithm provides a **quadratic speedup** for unstructured search
problems — finding a specific input among N possibilities in **O(√N)** queries instead
of O(N).
**Practical Impact:**
| Algorithm | Classical Security | Post-Grover Security | Status |
|-----------|-------------------|---------------------|--------|
| AES-128 | 128-bit | ~64-bit | **Insufficient** |
| AES-256 | 256-bit | ~128-bit | **Acceptable** |
| SHA-256 | 256-bit | ~128-bit | **Acceptable** |
| SHA-1 | 160-bit | ~80-bit | **Deprecated** |
| 3DES | 112-bit | ~56-bit | **Broken** |
**Key Takeaway:** Unlike Shor's algorithm (which completely breaks public-key
cryptography), Grover's algorithm is mitigable by **doubling key lengths**. No
symmetric algorithm replacement is needed — only parameter upgrades.
---
### 2.3 The Resource Estimate Revolution of 2025–2026
The most significant recent development is the dramatic reduction in estimated
physical qubit requirements:
**Google Quantum AI (2026):**
