# JoS QUANTUM

> JoS QUANTUM GmbH is a quantum technology company based in Frankfurt am Main, Germany. We develop quantum algorithms for the simulation of complex systems using quantum computers, focused on real industrial use cases in finance, security, and energy — together with the engineering judgment to estimate what those algorithms will, and won't, require from quantum hardware.

## What we do

- **Quantum algorithm development** for simulating complex systems, with deep expertise in quantitative finance and quantum communication security.
- **Hardware requirement estimation**: qubit counts, gate depth, and error-correction overhead for running an algorithm at useful scale.
- **Quantum amplitude estimation** for business-risk modelling — a quadratic speedup over Monte Carlo, developed with Deutsche Börse Group (2021).
- **Quantum communication & security**: QKD security proofs and post-quantum cryptography migration, backed by granted patents.

## Services

- Keynote on quantum technology (0.5–1 h)
- Introduction to quantum computing (2 h)
- Introduction to quantum communication & security (2 h)
- Training & in-depth algorithm development (1–5 days)
- Proof of concept (3–24 months)
- Strategy advisory on future priorities (ongoing)

## Pages

- [Home](https://jos-quantum.de/): Overview, services, research papers, and patents.
- [Services](https://jos-quantum.de/offer/): Engagement formats by time commitment.
- [RSA break-cost estimator](https://jos-quantum.de/shor/): Interactive demo estimating the quantum resources Shor's algorithm needs to break an RSA key, and the year hardware roadmaps are projected to reach them.
- [Quantum business-risk model](https://jos-quantum.de/risk/): Interactive demo estimating tail risk with quantum amplitude estimation, runnable in the browser on a simulator.
- [Blog](https://jos-quantum.de/blog/): Research notes and demo walkthroughs from the JoS QUANTUM team.

## Blog

- [Post-quantum security for Bitcoin and Ethereum: an account-type autopsy](https://jos-quantum.de/blog/post-quantum-bitcoin-ethereum/) (2026-07-17): Research note, part 2 of 2. Applies the 2026 Google Quantum AI / Ethereum Foundation / Stanford whitepaper (Babbush, Gidney, Neven, Drake, Boneh; arXiv:2603.28846) to digital assets. Breaking ECDLP on secp256k1 needs ≤1,200 logical qubits and 90M Toffoli gates (or ≤1,450 and 70M), under half a million physical qubits on a superconducting architecture — a ~20× reduction, published with the circuits withheld behind an SP1/Groth16 zero-knowledge proof. Attack taxonomy: on-spend (inside a block interval), at-rest (exposed keys, days of compute), on-setup (one offline break yields a permanent reusable exploit). Fast-clock architectures (superconducting, photonic, silicon) derive a key in ~9 minutes against Bitcoin's 10-minute block, giving a 41% theft window on any broadcast transaction; slow-clock (neutral atom, ion trap) cannot. Counterintuitively faster chains are safer: Litecoin ~2.7%, Dogecoin <1/8000. Bitcoin: ~6.9M BTC vulnerable, 1.7M in P2PK; Taproot (bc1p) is a security regression that re-exposes public keys on-chain, with BIP-360's P2MR the proposed patch; address reuse flattens the distinction between script types, so exposure is a property of behaviour not address prefix; a leaked HD-wallet xpub plus one derived key compromises the whole derivation tree. Quantum mining is not a threat (Grover is quadratic, doesn't parallelise). Ethereum: all five vulnerabilities are at-rest — Account (20.5M ETH, EOAs cannot rotate keys), Admin (~70 contracts, ~$200B stablecoins/RWAs, ~15h to crack), Code (15M ETH L2 TVS), Consensus (BLS12-381, 37M ETH staked), Data Availability (KZG trusted setup — a single on-setup break gives a permanent backdoor usable without any further quantum access). The obstacle to migration is bytes, not cycles: ML-DSA verifies faster than Ed25519 and verification is what every full node does for every signature in every block, but an ECDSA signature plus compressed public key costs ~100 bytes against 3,732 for ML-DSA-44, so at fixed block size a transaction grows by more than an order of magnitude — a block-space argument of the kind that produced the 2017 Bitcoin Cash hard fork, with the paper warning that the resource costs "portend network centralization". Compute bites only in the EVM (no PQC precompiles means verification in bytecode is prohibitively expensive, hence EIP-7932) and on the consensus layer, where the problem is capability rather than speed: ML-DSA cannot aggregate as BLS12-381 does. Deployed mitigations: Project Eleven's yellowpages, ERC-4337/EIP-7702, EIP-7932, and production PQC on QRL, Algorand, XRP Ledger and Solana. Includes risk-committee questions on custody address hygiene, xpub sharing, issuer key governance, L2 proof systems (zk-STARKs hash-based and resistant; optimistic rollups and pairing-based SNARKs not), and the dormant-asset problem (~2.3M BTC unmoved 5+ years, unmigratable, and the Do Nothing / Burn / Hourglass / digital-salvage policy debate).
- [Post-quantum cryptography: what actually breaks, and what replaces it](https://jos-quantum.de/blog/post-quantum-cryptography-basics/) (2026-07-17): Explainer, part 1 of 2. A quantum computer does not break "encryption" — Shor's algorithm breaks integer factorisation and discrete logarithms in polynomial time, eliminating RSA, Diffie–Hellman, ECDH, ECDSA and EdDSA outright, while Grover's quadratic speedup barely dents symmetric ciphers and hashes (swamped by error-correction constants, parallelises poorly, inherently serial). Growing key size defeats Grover but not Shor, whose cost scales only polynomially in modulus size: a 1,024-bit elliptic curve needs ~5,000 logical qubits vs ~1,200 for 256-bit, making large curves "at best partial and temporary" protection. Encryption and signatures fail on opposite clocks: key exchange is harvest-now-decrypt-later (already urgent), signatures are safe until Q-Day then instantly forgeable — worst where a public key is permanently published and controls value, i.e. blockchains. Mosca's inequality (x + y > z). NIST standards: FIPS 203 ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA all final August 2024; FIPS 206 FN-DSA (Falcon) still draft as of mid-2026 due to floating-point Gaussian-sampler side-channel concerns; HQC selected March 2025 as a code-based backup KEM. Redundancy is deliberate — SIKE was destroyed by a classical attack in 2022. The price is size: ECDSA 64-byte signatures vs FN-DSA-512 ~666 B, ML-DSA-44 2,420 B, SLH-DSA-128s 7,856 B (~123×). The common objection that PQC is too slow to compute is mostly a myth for the scheme that will actually deploy: normalised to ML-DSA-44 = 1, Ed25519 signs at 0.15 and verifies at 1.3, RSA-2048 signs at 80 and verifies at 0.4 — so ML-DSA verifies faster than Ed25519 and signs 80× faster than RSA, and verification is the operation that scales with network size. Compute does explode for SLH-DSA (14,000× slower signing for 128s; 720× for 128f) and FN-DSA depends on hardware floating point (3× signing, degrading to RSA-2048 speed when emulated; non-associative FP addition makes cross-platform test vectors and side-channel safety hard, which is why FIPS 206 is late and realistic deployment is ~2033). ML-DSA's real cost is lost versatility — no BLS-style aggregation. Hybrid classical+PQC deployment (X25519+ML-KEM-768, Signal PQXDH, iMessage PQ3) is the standard pattern. NIST IR 8547 deprecates classical public-key crypto after 2030, disallows after 2035 — a statement about migration duration, not about when a quantum computer arrives.
- [Quantum error correction on superconducting hardware: the fast clock and its price](https://jos-quantum.de/blog/qec-superconducting-hardware/) (2026-07-16): Explainer, first in a platform-by-platform series. Builds quantum error correction from first principles (repetition codes; why no-cloning, measurement collapse and continuous errors each have an escape; stabilizers and syndromes; the surface code as the code a planar chip can actually be wired for; code distance and the threshold), then assesses it against real superconducting hardware. Google's Willow measured Λ = 2.14 — below threshold, beyond break-even at 2.4× — with a distance-7 logical error of 0.143% per cycle on 101 physical qubits at a 1.1 µs cycle. Extrapolating that Λ, a 10⁻⁶ logical qubit needs distance 27 and ~1,457 physical qubits. The remaining obstacles are engineering, not physics: measured gate errors (0.33%) still sit 3× above what the famous resource estimates assume (0.1%); leakage costs 4 of 101 qubits; decoders must sustain sub-1.1 µs throughput forever; TLS defects swing T1 by an order of magnitude on 15-minute timescales; ~2.5 coax lines per qubit against 19 µW of cooling power makes a million qubits a refrigeration problem; and cosmic rays wipe the whole chip for ~20,000 correction rounds about once an hour, which no code distance addresses. The compensating advantage is the clock: superconducting is a fast-clock architecture, and that is why it got below threshold first.
- [Inside the risk demo: estimating tail risk on a quantum computer](https://jos-quantum.de/blog/risk-demo-explained/) (2026-07-15): Walkthrough of the quantum business-risk model. How a network of business risks is encoded as a state-preparation circuit (Ry rotations for intrinsic probabilities, controlled-Ry for conditional triggers), how quantum amplitude estimation reads the tail probability P(loss ≥ threshold) with a quadratic speedup over Monte Carlo (error ~1/N vs ~1/√N), and how stacking Grover search over QAE makes the sensitivity analysis — ranking which risk drives the tail — quartic. Fewer than 200 error-corrected qubits at production scale.
- [Why quantum error correction — not qubit count — decides when RSA and ECC fall](https://jos-quantum.de/blog/qec-shor-rsa-ecc/) (2026-07-15): Research note. RSA and ECC will fall to how efficiently Shor's algorithm compiles into fault-tolerant gates, not to raw qubit count. A look at the collapsing physical-qubit estimates for RSA-2048 and ECC-256 across successive studies.
- [Inside the Shor demo: what it takes to break an RSA key](https://jos-quantum.de/blog/shor-demo-explained/) (2026-07-10): Walkthrough of the RSA break-cost estimator. What each number means — logical qubits (~3n), Toffoli gates (~0.3n³), physical qubits, runtime — the scaling laws behind them, and how a key size becomes a projected break-year. The error-correction code alone swings the machine size ~200×; doubling your RSA key does not buy a decade.

## Research

- [A Quantum Algorithm for the Sensitivity Analysis of Business Risks](https://arxiv.org/abs/2103.05475) (2021): Braun, Decker, Hegemann, Kerstan, Schäfer. The Grover-over-QAE construction behind the business-risk demo, analysed on a Deutsche Börse Group risk model.

## Contact

- Email: contact@jos-quantum.de
- Location: Platz der Einheit 2, c/o TechQuartier, 60327 Frankfurt am Main, Germany
- LinkedIn: https://www.linkedin.com/company/jos-quantum