However, with the emergence of Shor's efficient quantum algorithm for factoring integers and computing discrete logarithms it became evident that the power of quantum mechanics also had implications for classical cryptography based on computational assumptions. From the day of the first construction in a laboratory of just one quantum computer with registers large enough to factor contemporary RSA moduli, the RSA cryptosystem will be rendered more or less useless, and very few people and institutions would feel comfortable using the system, even for increased key-lengths.

We have no guarantee that this day is far into the future.

One often hears recommendations for key-sizes of public-key cryptosystems needed to obtain security for 30 years and even 50 years. Anyone wanting a real security of this magnitude should probably take the construction of the quantum computer into consideration.