Quantum computing and its impact on cybersecurity [Q&A]

Quantum computing with its vastly improved processing capability offers the chance of many positive developments in research and science. But it also represents a potential threat to our current encryption models.

How big is quantum's threat to cybersecurity? And should we be taking action on this now? We talked to Skip Sanzeri, QuSecure co-founder and COO, to find out.

BN: What are some of the main trends around quantum computing development?

SS: The quantum computing industry is evolving rapidly. Just a few years ago we were struggling to find companies that had more than a few dozen qubits and now we are in the 100-qubit era. Companies such as IBM, IonQ, Google, and PsiQuantum are talking about having a thousand or more qubits by mid-decade. If coherence continues to advance and noise can be reduced, these systems will be even more powerful. The promise of quantum computing, due to the exponential nature of qubits in superposition, can do amazing things for society -- but job one is cybersecurity.

With the advent of quantum computing upon us, the potential for many positive enhancements to our society may be forthcoming, including algorithms to cut through global emissions and quantum chemistry for personalized medicine. At the same time, tens of billions of dollars are being spent by foreign nations to develop quantum computers (some of which have been openly declared as 'weaponized'). A quantum computer with approximately 4,000 qubits will be able to break RSA 2048 which is the primary algorithm that we rely on to keep the world's data safe on the internet. So, we should prepare for the possibility that the first use of quantum computing may be for harm rather than good.

BN: Why is the need for action now when we know quantum computers are years away?

SS: Store now, decrypt later attacks are the biggest reason to start upgrading networks and communications to post-quantum cybersecurity (PQC). Foreign nation states are stealing data every second of the day. This data is harvested and stored on computers waiting to be decrypted. Quantum computers will be able to crack encryption (proven mathematically by Shore’s Algorithm) once we reach the scale of around 4,000 qubits. We refer to this as 'Q-Day.' So, all data that is encrypted with current, non-PQC is at risk today of a quantum computer decrypting it in the future. For example, if a quantum computer with enough power to crack encryption is developed in five years, data stolen today would still be very valuable if it has 10, 20, or more years of shelf life. National security secrets, bank account information, and electronic health records may have data security requirements of up to 75 years. Making matters worse, many experts estimate that changing our current encryption across an enterprise or government agency could take as long as 10 years. Adding this to the shelf life of data means that there are 10 more years of exposed data which attackers can weaponize or use against us. In many cases, we are already behind.

Therefore, enterprises (and government already has mandates in place) should start looking very closely at PQC to encrypt current communications and data. If data is stolen but has quantum encryption, it will be safe for decades after Q-Day.

BN: What are the main challenges around addressing the post-quantum cyber threat?

SS: There are a variety of challenges to overcome when thinking about how organizations can become quantum resilient.

First, any change is difficult. Moving from older, legacy systems to newer technologies takes a great deal of planning, time and resources in order to not disrupt operations. Therefore, any upgrades, especially to cybersecurity, need to be backwards compatible so that the upgrade process can move more efficiently.

Second, cutting-edge technology always comes with risk. Betting on new technologies requires significant risk assessment to ensure that upgrades are carefully planned, and best-of-breed vendors are chosen. Using standards-based technologies such as the algorithms that NIST is recommending will help reduce risk. Also looking for companies that have referenceable clients, federally approved credentials, post-quantum cybersecurity, and successful implementations will reduce risk.

BN: What are some of the things organizations should look for in a PQC solution to best protect their data?

SS: Enterprises and government agencies need to look for solutions that are standards-based, backwards compatible, and have cryptographic agility. Using NIST algorithms helps satisfy standards risk. Selecting vendors that can transfer between existing systems and protocols to newer post-quantum protocols is vital so that companies don’t have to rip and replace software, which causes disruption and risk. Cryptographic agility means that implementations can use a variety of cryptographic standards such as any of the NIST finalists, which further means that an organization can choose its cryptography versus being locked into just one type of cryptography due to a given vendor’s choice. By finding a partner like QuSecure that has an adaptive orchestrated solution with continuous availability that standardizes on all the NIST finalists, an organization can know that they have optimized their choice.

BN: There seem to be multiple options in terms of PQC solutions, which are the most optimal and why?

SS: A variety of vendors are coming on scene to help meet this massive upgrade need. There are some solutions that focus on Quantum Key Distribution (QKD). QKD is the idea that you can use two devices to transmit keys via entanglement making the transmission theoretically ‘un-spyable,’ but it is currently severely range-limited. It is currently only useful for highly specific applications and requires significant scientific breakthroughs to make it applicable to larger networks. Some vendors offer quantum random number generation (ORNG), which serves generally random numbers for use in cryptographic keys. This solves the threat of pseudo random keys (programmatically generated random numbers, which is the standard today) being reverse engineered, but QRNG alone does not address the threat posed to public key cryptography by Shor’s Algorithm attacks.

Other vendors have teams of mathematicians that offer post quantum cryptographic algorithms, and these fall into two camps. The first is a class of proprietary cryptographic algorithms, and it is generally not recommended to implement non-standard algorithms in an enterprise or government environment. The second class is a handful of companies that have written NIST finalist algorithms and offer generally application specific implementations. Still other vendors offer consulting services for PQC implementation.

Optimally an organization should find the right mix of post-quantum cybersecurity software, hardware and services, and ideally utilize a vendor that provides for quantum orchestration across the enterprise to all nodes, communications and data. Features such as PQC policy management, key orchestration and backwards compatibility are elements that every organization should review so that implementation is seamless and much easier.

Photo Credit: The World in HDR / Shutterstock.com