Adiabatic quantum computing (AQC) is the quantum computing model where you do not push qubits around with discrete gates. Instead, you set up a Hamiltonian whose ground state encodes the answer to your problem, and you let the system evolve slowly (adiabatically) toward that ground state. D-Wave Systems built a $10 billion business on a related idea called quantum annealing. The two models are similar but not identical, and the differences matter for cryptography. This article walks through what AQC is, how it relates to D-Wave, the equivalence to gate-model quantum computing proved by Aharonov in 2004, what AQC can break (mostly nothing in cryptography), and why QNSQY's post-quantum stack is calibrated against the gate model rather than the AQC model.
The River Analogy
Imagine a river bed shaped like a hilly landscape. You drop a leaf into the river at one end. If the river flows slowly enough, the leaf settles into the lowest point at each section it passes through. As the landscape gradually changes downstream, the leaf moves with it, always staying in the lowest valley.
Adiabatic quantum computing is like this. You start with a quantum system in the ground state of an easy Hamiltonian (the leaf at a known low point of a flat valley). You slowly change the Hamiltonian into your target problem Hamiltonian, where the ground state encodes the answer to a hard problem. If you change the Hamiltonian slowly enough, the system tracks the ground state, and at the end, you have the answer.
The "slow enough" condition is given by the adiabatic theorem: the change rate must be much slower than the inverse square of the energy gap between the ground state and the first excited state. If the gap closes during the evolution, you need to slow down even more. In hard problems, the gap can become very small, and the required time can grow exponentially.
This is the entire core of AQC. Set up a Hamiltonian, evolve slowly, read the answer.
AQC vs Quantum Annealing
The terms are often used interchangeably but they are not the same thing.
Adiabatic quantum computing is the idealized model. Strict zero temperature, infinitely slow evolution, fully programmable Hamiltonians. The model is mathematically equivalent to gate-model quantum computing.
Quantum annealing is the practical, finite-temperature, finite-time variant. It has thermal fluctuations, the evolution is fast enough that some excited-state contamination is unavoidable, and the Hamiltonian is restricted to a specific class (the transverse-field Ising model). D-Wave's hardware implements quantum annealing, not full AQC.
| Property | AQC (theory) | Quantum annealing (D-Wave) |
|---|---|---|
| Temperature | Zero (idealized) | Finite (15 mK on D-Wave) |
| Hamiltonian flexibility | Any (in principle) | Restricted to Ising / QUBO |
| Connectivity | Any | Pegasus / Zephyr (sparse) |
| Equivalent to gate model | Yes (Aharonov 2004) | Restricted, depends on hardware |
| Typical run time | Polynomial in problem size (depending on gap) | Microseconds per run, repeated |
| Can run Shor's algorithm? | In principle, yes (with overhead) | No |
The Aharonov 2004 Equivalence
Aharonov, van Dam, Kempe, Landau, Lloyd, and Regev proved in 2004 that AQC and gate-model quantum computing are universally equivalent. Their paper, "Adiabatic Quantum Computation is Equivalent to Standard Quantum Computation", published on arXiv in 2004 and SIAM Journal on Computing in 2007, showed that any gate-model algorithm can be translated to an AQC algorithm with polynomial overhead, and vice versa.
This is a deep result. It says AQC is not a weaker model than gate-model quantum computing; it has the same computational power. So in principle, an AQC machine could run Shor's algorithm and break RSA-2048.
The catch is the polynomial overhead. The translation requires constructing a Hamiltonian whose evolution implements a specific gate sequence. The required Hamiltonian is highly non-local (touches many qubits at once) and has a small minimum energy gap. To run on real hardware, you would need:
Programmable many-body interactions across all qubits. Very long evolution times to satisfy the adiabatic condition. Very low temperatures to prevent thermal excitation. Very high precision in the Hamiltonian coefficients.
D-Wave's hardware does not have these capabilities. Its Hamiltonian is limited to two-body Ising interactions on a sparse graph, its temperature is finite, and its evolution time is in microseconds. So while AQC is theoretically capable of running Shor's algorithm, D-Wave's quantum annealing is not.
What D-Wave Actually Solves
D-Wave's machines solve QUBO (Quadratic Unconstrained Binary Optimization) and the Ising model. These are equivalent formulations of the same problem class, NP-hard in general, and they capture many real-world optimization problems:
Portfolio optimization, where you pick a basket of assets to maximize return for a given risk. Scheduling and routing, where you assign tasks to machines or routes to vehicles. Machine learning, where some training problems can be cast as Ising-model optimization. Drug discovery, where molecular conformations can be encoded as Ising problems. Materials science, where finding ground states of spin systems is the natural task.
Whether D-Wave actually beats classical heuristics on these problems is contested. Some benchmarks show modest speedups, others show no advantage when classical solvers are tuned. The 2014 Ronnow et al. paper "Defining and detecting quantum speedup" in Science showed no quantum speedup on random Ising problems compared to optimized classical simulated annealing. Newer claims by D-Wave on more structured problems are debated in the academic literature.
What D-Wave is genuinely useful for is providing a different optimization technology that sometimes finds better solutions than classical heuristics on specific problem types. It is not a universal speedup machine.
Cryptanalysis on AQC
The general picture: AQC could in principle threaten cryptography if a fully programmable AQC machine of sufficient size existed. No such machine exists. D-Wave's quantum annealer is not such a machine. Future AQC hardware would have to overcome formidable engineering challenges before becoming a cryptanalytic threat.
Specific attacks studied:
Factoring small RSA. Several papers have factored small numbers (up to 200,099 in 2018, larger in subsequent work) on D-Wave by encoding factoring as QUBO. Scaling to RSA-2048 requires the QUBO size to grow polynomially, but the connectivity and gap requirements blow up beyond what current annealers handle.
Discrete log on small groups. Smaller-scale attacks have been studied, again at toy sizes only.
Lattice problems (LWE, SIS). Encoding lattice problems as QUBO is possible but inefficient. The lattice dimension must be very small for current annealers to attempt anything, and even so, no useful attacks have been demonstrated.
The takeaway: AQC and quantum annealing are not the imminent cryptanalytic threat. Gate-model machines running Shor's algorithm are. NIST's standards (FIPS 203, 204, 205) and NSA's CNSA 2.0 are calibrated against gate-model quantum computers, not against AQC.
What AQC Is Useful For
Even if it is not a cryptography breaker, AQC and quantum annealing have legitimate use cases:
Optimization. As noted, D-Wave is sold for optimization tasks where classical heuristics get stuck in local minima. Quantum tunneling can sometimes help escape these.
Materials simulation. Finding the ground state of a complex spin Hamiltonian is the natural task for AQC. Real-world materials science problems can sometimes be encoded this way.
Quantum machine learning. Some training problems for restricted Boltzmann machines can be sampled using quantum annealing. Whether this is faster than classical sampling is research-active.
Constraint satisfaction. Many real-world problems (scheduling, routing, packing) have the structure that maps to QUBO. Annealers can attempt them, sometimes giving useful results.
These are real applications, not vaporware. They are also not relevant to cryptography in any near-term sense.
QNSQY's Threat Model and AQC
QNSQY's encryption uses lattice-based (ML-KEM, ML-DSA), hash-based (SLH-DSA, LMS), and code-based (HQC) algorithms in hybrid mode with classical X25519 and Ed25519. The threat model assumes:
A future quantum attacker has a large gate-model quantum computer. The attacker can run Shor's algorithm against any algorithm whose security reduces to factoring or discrete logs. The attacker can run Grover's algorithm against any symmetric cipher or hash function. The attacker cannot run any unknown polynomial-time algorithm against lattice or hash problems.
AQC and quantum annealing are not separately considered, because:
If a future AQC machine is fully programmable, it is by Aharonov 2004 equivalent to a gate-model machine, and the same Shor and Grover threats apply. If a future AQC machine is restricted to a specific Hamiltonian class (like D-Wave today), it cannot run Shor's algorithm, and is therefore not a threat to lattice or hash-based crypto.
So whether the future quantum attacker uses gates or adiabatic evolution does not change QNSQY's design. The lattice and hash math holds against both.
Hybrid Mode as Defense in Depth
QNSQY does not bet on any single algorithm. The hybrid mode combines a classical key exchange (X25519, well-studied for over a decade) with a post-quantum key encapsulation (ML-KEM, NIST-standardized in 2024). To recover a session key, an attacker must defeat both layers. Breaking X25519 requires either a major classical advance in elliptic curve discrete log algorithms or a working Shor's algorithm. Breaking ML-KEM requires either a major classical or quantum advance in lattice cryptanalysis.
The same logic applies to signatures. Ed25519 plus ML-DSA (or SLH-DSA in the hash-based slot) means an attacker has to forge two independent signatures. Even if a future AQC machine somehow weakens one of the families, the other still stands.
This is why NSA's CNSA 2.0 advisory, NIST's IR 8547 transition guidance, and IETF drafts on hybrid TLS all converge on the same recommendation: deploy hybrid post-quantum schemes during the migration window, not pure post-quantum schemes that bet everything on one mathematical family. QNSQY follows this guidance.
Where AQC Research Goes Next
The future of adiabatic and annealing-style quantum computing is mostly about scaling and connectivity, not breakthrough new applications. D-Wave continues to push qubit counts and improve connectivity in the Pegasus and Zephyr graph topologies. New entrants in neutral atom and Rydberg-atom-based annealing (like QuEra and Pasqal) are exploring quantum optimization with different hardware. Hybrid classical-quantum solvers, where the quantum component handles a subroutine and the classical component handles the rest, are an active commercial direction.
None of this targets cryptography. The post-quantum cryptography community watches AQC research with academic interest but does not adjust its threat model based on it, because the relevant threat (Shor's algorithm at scale) does not run efficiently on annealers. The migration to ML-KEM, ML-DSA, SLH-DSA, FN-DSA, HQC, and LMS is the genuine response to the quantum threat. AQC is a parallel area of quantum computing research with its own commercial trajectory.
Frequently Asked Questions
Can D-Wave break RSA-2048?
No. D-Wave's quantum annealer cannot run Shor's algorithm. Factoring small numbers (up to roughly six figures) has been demonstrated as a research curiosity, but scaling to RSA-2048 requires both qubits and connectivity that no annealer has. There is no published roadmap to a cryptographically relevant D-Wave system.
Is adiabatic quantum computing the same as gate-model quantum computing?
In theoretical computational power, yes (Aharonov 2004). In practical hardware capabilities, no. AQC and gate-model machines run completely different physical implementations. D-Wave's hardware is a quantum annealer, which is a restricted form of AQC and is not directly equivalent to gate-model.
Why does QNSQY use lattice cryptography if quantum annealers cannot break it?
QNSQY's design is calibrated against the strongest quantum threat, which is gate-model machines running Shor's algorithm. Lattice and hash crypto resist both gate-model and (in principle) AQC attacks. We do not design against the weakest threat; we design against the strongest plausible one. This is also NIST's reasoning in FIPS 203, 204, and 205.
Is quantum annealing the same as simulated annealing?
No. Simulated annealing is a classical algorithm that uses thermal fluctuations to escape local minima in optimization landscapes. Quantum annealing uses quantum tunneling on real quantum hardware. The two are conceptually similar but operate on completely different physical principles. Whether quantum annealing is faster than classical simulated annealing on real problems is contested.
What about future AQC hardware that is more programmable than D-Wave?
If such hardware is built, with full programmability and large qubit counts, it would in principle be capable of Shor's algorithm. The engineering challenges (precise multi-body Hamiltonians, low temperature, long coherence times, programmable couplings) are formidable, and no such hardware exists today or is on any near-term roadmap. QNSQY's lattice and hash crypto would still resist it because no efficient algorithm (gate-model or adiabatic) is known against the underlying math problems.
Sources
- NIST. "Module-Lattice-Based Key-Encapsulation Mechanism Standard." FIPS 203, August 13, 2024. https://csrc.nist.gov/pubs/fips/203/final
- NIST. "Module-Lattice-Based Digital Signature Standard." FIPS 204, August 13, 2024. https://csrc.nist.gov/pubs/fips/204/final
- NIST. "Stateless Hash-Based Digital Signature Standard." FIPS 205, August 13, 2024. https://csrc.nist.gov/pubs/fips/205/final
- Aharonov, D. et al. "Adiabatic Quantum Computation is Equivalent to Standard Quantum Computation." arXiv, 2004. https://arxiv.org/abs/quant-ph/0405098
- Ronnow, T. F. et al. "Defining and detecting quantum speedup." Science 345, 420 (2014). https://www.science.org/doi/10.1126/science.1252319
- NSA. "Commercial National Security Algorithm Suite 2.0." September 2022. https://media.defense.gov/2022/Sep/07/2003071834/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS_.PDF
Related Articles
- Quantum Tunneling and Cryptanalysis
- Shor's Algorithm Explained for Laymen
- Why Quantum Threatens Classical Encryption
- What Is Post-Quantum Cryptography?
- ML-KEM Explained
Protect Your Data Before Q-Day Arrives
QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.