Quantum-Safe Cryptography: The Time to Prepare Is Now

The following is an excerpt from a contributed opinion piece on Dark Reading by Scott Totzke, CEO & Co-founder of ISARA Corporation.

Quantum computing is real and it's evolving fast. Is the security industry up to the challenge?

Media reports that Google may have used a quantum computer to crack a problem even the fastest supercomputers could not solve is a significant milestone on the journey to large-scale quantum computing. For cybersecurity professionals who have been waiting for this milestone, this should be the proverbial starting pistol to begin ensuring their infrastructure is agile and resilient.

Quantum supremacy — the point at which a quantum computer can solve a problem that classical computers cannot — is the long-chased milestone that proves that quantum computing can be more than just a science project. In a paper briefly posted on the NASA website — and then taken down — Google engineers reportedly described using a quantum processor to solve a specific calculation in three minutes and 20 seconds that would have taken the most advanced classical supercomputer 10,000 years. Quantum computers process information with qubits, which behave according to quantum mechanics and offer a new bag of tools — such as superposition and interference of states, quantum entanglement, and the uncertainty principle. This makes them fundamentally different, and more powerful than classical computers.

While scientifically and technologically significant, the real-world relevance of Google's potential achievement is extremely limited. We're still far from the large-scale, noiseless quantum computer that will break current encryption standards. And that's good, because it provides organizations around the world — from enterprises and governments to security solution providers and original equipment manufacturers — the time necessary to begin protecting their networks, connected devices, and confidential data. But it is a wake-up call — and the time to prepare may be shorter than some think.

Because quantum computers can solve problems that confound classical computers, they will also be capable of cutting through some of the most common public-key cryptographic algorithms used globally. This means all the data — from financial records and medical charts to military orders and diplomatic communiques — that moves safely around the world today, as well as connected devices that rely on embedded security to remain trusted and protected, will be vulnerable to exposure with a large-scale quantum computer.

Such data is already vulnerable to a "harvest and decrypt" attack, in which a hacker steals encrypted data with long-term value — Social Security numbers, military information — and sits on it until a quantum computer can crack the encryption and unlock the secrets. Likewise, it's quite possible that many connected devices with long useful lives — including cars and smart sensors being designed today — will still be in use when quantum computers are widespread. For these reasons, the need to think about quantum-safe computing is now — and not something to put off for a few more years. Think about how rapidly the digital age advanced and overtook industries that did not adapt.

The good news: There are robust cryptographic approaches that are resistant to the capabilities of a quantum computer. (Disclosure: ISARA is among of handful of teams working to make these mathematical approaches practical in commercial applications.) Implementing them, though, is likely to take several years. The time to prepare is now, even though we do not know for certain when a quantum computer will be powerful enough to break current encryption.

What every good IT manager does know is that there rarely is a system upgrade that goes exactly as planned. And for many organizations, changing cryptography is logistically challenging, costly, and time-consuming. Encryption is embedded so deeply into most systems that upgrading it will require a full risk assessment to identify all of the parts of a company's infrastructure that use cryptography and where the most vulnerable components of a network are so that a proper migration plan can be established.

Cryptographic agility — commonly defined as the ability to respond and adapt to the ever-changing cybersecurity environment, needs, and threats — allows organizations and OEMs to easily change cryptographic algorithms without major changes to the surrounding infrastructure. Although not a field that has been at the forefront of the technology industry, it will be vital in the coming years. The National Institute of Standards and Technology advocates this type of agility.

Read the complete article on Dark Reading.