|
Quantum computers augur a step change in computing and processing power. By exploiting the ability of particles to be in a superposition of different states, quantum computers can conduct calculations far beyond the capacity of any classical computers, whose unit of data (a byte) can be in only one of two states: zero or one.
This gives quantum computers tremendous computing capabilities. But with power comes risk. In the hands of hackers, cybercriminals, rogue actors or belligerent states, quantum computers could wreak havoc. One of the biggest worries is their ability to solve the mathematical problems that today’s encryption systems rely on.
The dominant approach to encryption relies on the factorization of prime numbers, which are easy to generate but hard to invert without a key, if the final number is sufficiently large. While this hedges them from classical computing methods, quantum computers can easily break these codes. Theoretically, it would take a quantum computer just a few hours to break advanced encryptions such as the RSA and ECC data transmissions standards used in blockchain, undermining the security and integrity that are its primary selling points.
Given the ubiquity of these encryption techniques in our economy, finding quantum-proof encryption is critical. Earlier this month, the US National Institute of Standards and Technology (NIST) announced four candidates for quantum-proof algorithms, developed by companies including Thales, IBM and Qualcomm. Three of these algorithms use structured lattices, a family of math problems that quantum processing confers no advantage for. Another four algorithms are under consideration as part of NIST’s effort to develop a post-quantum cryptographic standard.
This announcement is of global significance. NIST was one of the first public bodies to acknowledge the threat posed to encryption, and its process is being watched by other cyber agencies, including the EU Agency for Cybersecurity (ENISA) and France’s Agence National de la Sécurité des Systèmes d'Information (ANSSI). Germany’s Federal Office for Information Security has been evaluating post-quantum alternatives since before the launch of NIST’s standardization process. China has been running its own post-quantum encryption competitions since 2018.
It remains to be seen if NIST’s shortlisting process will whittle down to a best-in-class suite of algorithms that other countries will adopt as standards, or whether different approaches could emerge. France’s ANSSI, for instance, has already cautioned that the maturity of NIST’s post-quantum algorithms should not be overestimated and recommends a hybrid approach including current cyber defense mechanisms, given the risks of transitioning to algorithms that may turn out to have weaknesses yet to be identified.
Yet it is clear that action is necessary. While there are hurdles to overcome before quantum computers are widely available, forecasting the maturity curve of a new technology is notoriously difficult. And innovation has been progressing rapidly.
Currently available quantum machines have a limited number of quantum bits, or ‘qubits’, and cannot hold quantum states for more than a few microseconds, which introduces errors, or ‘noise’, into calculations. But Rigetti, a leading startup, announced a commercial 80-qubit system in December, and IBM expects to achieve a 4,000+ qubit system by 2025. Progress is also being made on helping quantum computers operate at room temperature - a key step to their industrial commercialization, though it also comes with some performance trade-offs.
Companies have to move quickly rather than kicking the can down the road hoping the quantum issue will take decades to arrive. This is all the more important that quantum computing capability can be applied retroactively, meaning sensitive data existing today, such as military intelligence or health data, could be gathered in encrypted form and cracked in the future. Industries that use data with a long 'shelf life', or that make data-driven products with a long lifespan, could already be at risk of a quantum-powered attack.
Automotive manufacturers, for instance, are investing heavily in connected vehicles. Considering manufacturing production timelines and the multi-decade life cycle of vehicles, cars being built today will likely be on the roads when the first quantum computers become generally available. Organizations with sensitive datasets that are kept for long durations, such as trade secrets or medical data, are also in the risk zone already.
For companies and governments, the first step will thus be to evaluate which systems and how much data is at risk. The US, for instance, recently issued a national security memorandum requiring all federal agencies to produce an inventory of quantum-vulnerable IT systems.
The task facing cyber security chiefs is not enviable. There is still no definitive clarity over the best performing quantum-resistant algorithm; NIST will not finalize its standards for another two years and shortlisted candidates could come up short. Companies do not have many vendors to choose from; post-quantum cryptography products account for just 2% of the global cryptography market. And then comes the skills problem. Businesses are already facing a 2.7 million-strong cyber security workforce gap globally - wait till they start trying to hire quantum cryptographers…
| 
