Executive Summary: By April 2026, anonymity networks such as Tor and I2P face existential risks from quantum computing advances. The imminent threat of Shor’s algorithm breaking widely used elliptic curve cryptography (ECC) and RSA-based onion routing poses a critical challenge to anonymity preservation. This article assesses the post-quantum threat landscape for Tor and I2P, evaluates current mitigation strategies, and outlines a forward-looking roadmap for quantum-resistant deployment. Our findings indicate that without accelerated migration to post-quantum cryptography (PQC), both networks could collapse in anonymity guarantees by 2030, with partial degradation observable as early as 2027.
Anonymity networks rely on layered encryption to obscure traffic paths and identities. Tor uses RSA for relay identity and ECC for circuit keys, while I2P employs ElGamal and ECIES in its transport protocols. These cryptographic primitives are vulnerable to Shor’s algorithm, which can factor integers and compute discrete logarithms in polynomial time. Once a sufficiently large quantum computer is available, an adversary could retroactively decrypt intercepted Tor/I2P traffic or actively compromise node identities, stripping anonymity.
Recent advances in quantum error correction (e.g., surface code implementations) suggest that fault-tolerant quantum computers capable of breaking 2048-bit RSA may emerge between 2028 and 2030. However, hybrid attacks using Grover’s algorithm (quadratic speedup for symmetric key search) could reduce effective security margins today, particularly for AES-128 used in Tor’s encryption layers.
Tor’s architecture is especially exposed due to its public directory system and long-lived circuits. Compromise of relay keys via quantum decryption would allow an attacker to impersonate relays, enabling traffic correlation or man-in-the-middle attacks. The Tor Project has recognized this risk and launched the Tor Post-Quantum Initiative, integrating CRYSTALS-Kyber (KEM) and CRYSTALS-Dilithium (signatures) into its experimental releases.
As of Q1 2026, Tor 0.4.9.x includes optional PQC support for directory authorities and selected relays. However, only a small fraction (<5%) of relays support hybrid modes, and client adoption is negligible. The network’s bandwidth overhead from PQC handshakes (Kyber adds ~1–2 KB per handshake) has not yet caused significant congestion, but scaling remains a concern.
I2P’s smaller, peer-to-peer structure offers theoretical resistance to global monitoring, but its reliance on ECC-based NTCP2 and ECIES for SSU2 makes it equally vulnerable. Unlike Tor, I2P lacks a centralized update mechanism, complicating mass PQC deployment. Most I2P peers still run Java-based clients using pre-PQC cryptography, with only experimental builds (e.g., i2pd with Open Quantum Safe integration) available.
There is no coordinated migration plan within the I2P community, and adoption of PQC is hindered by performance concerns and lack of incentives for early adoption. As a result, I2P remains critically exposed, with potential for widespread peer identity compromise under quantum attack.
To bridge the gap until full post-quantum migration, hybrid cryptographic systems—combining classical ECC/RSA with PQC algorithms—are recommended. This approach ensures backward compatibility while adding quantum resistance. The NIST-standardized CRYSTALS suite (Kyber, Dilithium) is the leading candidate due to its efficiency and strong security margins (Kyber-768 ≈ AES-192 security).
Hybrid TLS 1.3 and Noise Protocol extensions are being prototyped for Tor/I2P, allowing gradual rollout without network splits. However, hybrid modes double handshake sizes and increase CPU load, necessitating careful load balancing and fallback mechanisms.
State-level actors (e.g., China, Russia, US) are known to harvest encrypted traffic for “store-now, decrypt-later” attacks. By 2026, such entities are likely conducting feasibility studies on quantum decryption pipelines. Open-source intelligence suggests that Chinese research labs (e.g., CAS) are advancing superconducting qubit arrays, potentially reaching 1,000+ logical qubits by 2027—sufficient for breaking RSA-2048.
Anonymity networks must assume adversaries have quantum capabilities in development. The risk of retroactive deanonymization is not theoretical—it is imminent.
For Tor:
For I2P:
For Policymakers & Funders:
For Users:
The anonymity provided by Tor and I2P is at a crossroads. The post-quantum era is not a distant threat—it is unfolding now. Without immediate, coordinated action, both networks risk catastrophic loss of anonymity within five years. The solution lies in hybrid cryptography, rapid standardization, and community-driven deployment. The time to act is not after the quantum computer arrives, but before it does.
Yes, for now. Classical cryptography remains secure against non-quantum adversaries. However, if you are a high-value target or concerned about long-term secrecy, avoid transmitting sensitive data over these networks until full PQC support is confirmed in your client and network.
Tor aims for full PQ