[tux3]

The main use-case is giving the first organization that can build a really big one the ability to break most existing encryption on the Internet, forcing us to migrate to post-quantum crypto.

There are really very few other applications at the moment. It's actually a well-known and very hard challenge to try to find interesting tasks where quantum algorithms beat classical ones. Experts have spent much effort trying to come up with one of these, and nigh invariably another expert comes back some time after with a classical algorithm that is just as fast as the quantum one on the same task.

[fragmede]

This is 5,000 gates, but to practically break a 4k RSA key, you'd need millions of gates, so we're still a long way away. Still, you could record my RSA-encrypted conversation today, and decrypt it in, say, 50 years. Shor hope I haven't said anything too incriminating!