IOI
Quantum computers, if developed sufficiently, will be capable of decrypting much of today’s cryptography. Private communications, commercial data, and military secrets will all be exposed as a result.
Quantum computers today are far too primitive to do so. However, material obtained underhandedly now may still be sensitive when more powerful quantum computers become available in a few years.
This possible vulnerability is well known in the computing industry. Some businesses are working to develop, test, and implement new encryption methods that are resistant to quantum computers. Some of these businesses, such as IBM and Thales, have already begun to sell post-quantum cryptography-protected products.
Upgraded PCs, phones, web browsers, and other gadgets will bring quantum-safe encryption into your life. However, enterprises, governments, and cloud computing services bear the brunt of the responsibility for designing and implementing quantum-safe encryption. It’s a huge upgrade that’s on par with addressing Y2K issues or switching from IPv4 to IPv6 for internet connections.
It’s a massive undertaking, but it must be completed. Not only are today’s communications at risk, but quantum computers might also breach the digital signatures that secure the integrity of updates to apps, browsers, operating systems, and other software in the future, allowing malware to infiltrate.
Quantum computing is the hot topic in the industry, attracting millions of dollars in funding. The search giant announced plans for a new quantum computing facility at this month’s Google I/O developer conference, which will employ hundreds of workers with the goal of producing a working quantum computer by 2029. Other tech behemoths like Honeywell, IBM, Intel, and Microsoft are vying for the first power plant.
Cryptographic methods for the post-quantum era
The National Institute of Standards and Technology in the United States is leading a global effort to develop fast and reliable post-quantum cryptography algorithms. It whittled down 82 original submissions to a shortlist of seven finalists for two encryption tasks: transferring digital keys and adding digital signatures.
“We expect toward the start of 2022 or so, we will select a small number of them to begin being standardized,” Dustin Moody, a NIST mathematician working on the effort, said at an IBM cryptography meeting in March. “We hope to have the final version completely ready and published around 2024.”
Using NIST’s post-quantum cryptography mailing list and public PQC conferences, researchers from industry, academia, and government are contributing to the project. Because encryption methods must be thoroughly scrutinised before we can trust them to safeguard our passwords, credit card numbers, financial records, and other sensitive data, the open approach is critical.
It’s unclear when these robots will be able to crack traditional encryption. But there’s a good chance it won’t take long.
There’s a lot of uncertainty, according to John Graham-Cumming, chief technology officer of internet infrastructure business Cloudflare: quantum computers may overcome encryption in five years or 20 years. Cloudflare, on the other hand, has already put post-quantum defences to the test and aims to use them for internal operations this year.
Intel and NTT Research researchers, as well as 451 Research analyst James Sanders, believe it will take a decade.
What is the urgency of resolving the issue?
“I’m not nearly hair on fire,” said Brian LaMacchia, Microsoft Research’s encryption lead. “However, I’m a little charred.”
Now is the time to gather data; later will be the time to crack it.
The urgency stems from the fact that today’s encrypted data could be captured and broken at any time. When internet routing problems push traffic over borders to China or other countries, hackers or nations can record network data.
“It might even be too late if you want long-term security,” said Thomas Pöppelmann, a cryptography engineer at Infineon and co-creator of one of the PQC algorithm candidates.
The problem is summed up succinctly by NIST. Our present cryptography systems based on public keys will not be able to withstand the test when cyber enemies have access to quantum computing power. Nothing can be done to keep the secret safe.
Much of today’s encryption is based on public key cryptography. It combines two digital keys, one secret and the other public, that can be used to protect communications when used together. It’s used to secure connections between your browser and your bank, or between a company server and a distant backup system, for example.
Encryption cracking and Shor’s algorithm
Professor Peter Shor of MIT discovered in 1994 that quantum computers could detect prime factors of integers using a technique that is now named after him. According to Seth Lloyd, another MIT professor and a pioneer in the field, Shor’s algorithm was the spark that sparked interest in quantum computing from companies, universities, and intelligence agencies.
The findings explain why huge corporations and well-funded startups are accelerating their quantum computing progress. Quantum computer designers are increasing the number of qubits (the fundamental data processing elements) in their machines while also inventing error correcting strategies to keep them running smoothly.
Quantum computing progress is speeding up.
Deepwatch, a cybersecurity business, has accelerated its encryption cracking timeline due to quantum computing advancements. Instead of taking 20 years, Marissa “Reese” Wood, vice president of product and strategy, believes it will take 10 to 15 years.
A normal computer would take around 300 trillion years to crack communications secured with a 2,048-bit digital key using today’s widely used RSA encryption method. A quantum computer with 4,099 qubits, on the other hand, would take only 10 seconds, according to Wood.
Google, for example, plans to construct a quantum computer with 1,000 “logical” qubits (those stable enough to conduct a long calculation) in 2029.
What are the options for post-quantum encryption?
In many ways, the quantum transition is more difficult than previous encryption enhancements. One issue is that digital key sizes will almost certainly increase, necessitating more memory to process them. It won’t be easy to switch algorithms, especially for smart home gadgets and other items with limited computer capacity.
Companies may integrate “crypto agility” in today’s computer architecture even before NIST selects its winners, ensuring their systems aren’t dependant on a single encryption method. That’s the advise of several experts, including Andersen Cheng, CEO of Post-Quantum, a London-based firm that helps consumers cope with a variety of issues.
“People thought I was mad” when he co-founded Post-Quantum in 2009, Cheng said. “I don’t think they’re laughing anymore.”
Experts also advocate a hybrid strategy that uses both conventional and post-quantum security encryption to double-protect data. This allows system administrators to accept PQC sooner without having to worry as much about potential flaws in still-developing algorithms. Hybrid encryption is now possible, though most experts expect widespread use of PQC to wait until NIST completes its standardisation work.
Several IBM cloud computing products already include quantum-safe cryptography. “If you have secrets that you need to keep hidden for the next 10 to 30 years, you should start this move as soon as possible,” IBM Research cryptography researcher Vadim Lyubashevsky said.
Thales, a French company that, like IBM, has a PQC algorithm in NIST’s final round, has started allowing clients to test the technology. Given its clout with finance and government clients, this is critical.
It wasn’t a simple upgrade.
It’s more difficult to switch to quantum-safe encryption with slower-moving computing architecture.
“The signature algorithm for Estonian voting cards is physically burned into a chip,” explained Jol Alwen, chief cryptographer at Wickr, a secure communications startup. “It’ll take a lot of effort to fix it.”
Computer systems that regulate power grids and military operations will be another difficult remedy. They usually last a long time. However, post-quantum cryptography updates will occur wherever sensitive data is stored, according to Gartner expert Martin Reynolds.
“Everyone will be delighted we accomplished it in 20 years,” Reynolds added.
