How much computing power would a quantum computer need to break elliptic-curve keys faster than migration completes?

Your question sits at the intersection of cryptanalysis timescales and organizational migration schedules—a genuine policy concern—but the preprints provided don't directly address the resource estimates needed to break elliptic-curve keys *within a specific migration window*.

Here's what the archive does tell us:

What breaking elliptic curves requires:

Shor's algorithm can compute discrete logarithms on elliptic curves, which would break the cryptographic schemes in widespread use [AG-2024.05-2225]. However, the concrete quantum resource cost remains uncertain. One preprint compares different quantum factoring and discrete-log algorithms [AG-2024.05-2347], concluding that state-of-the-art approaches require substantial computational memory and gate operations, but it doesn't quantify requirements for cryptographically relevant (e.g., 256-bit) elliptic curves specifically.

A separate study [AG-2024.03-2172] notes that Shor's algorithm "has become an available quantum computer application," but again doesn't specify hardware demands.

Why this matters for migration:

The gap between "when quantum computers are powerful enough" and "when migration to post-quantum schemes is complete" defines a window of vulnerability. Most credible estimates (not in these preprints) suggest breaking 256-bit elliptic curves would require millions of physical qubits and billions of gate operations—a scale likely years away. That's why migration timelines matter.

What's missing:

The provided preprints don't estimate the qubit count, error rates, or runtime needed to break specific elliptic-curve key sizes within a given timeframe—you'd need cryptanalysis-focused papers or NIST post-quantum reports to answer your question precisely.