Preparing for the Quantum Apocalypse

Jason Soroko at Sectigo explains how enterprises can get ready for quantum computing now

 

For nearly 50 years, public key infrastructure (PKI) has formed the secure cryptographic foundation for the world’s digital systems. But quantum computing may break down this defence.

 

PKI digital certificates act as passports or “digital identities” to authenticate between people, devices and systems, as well as to encrypt data and sign documents. PKI is a ubiquitous technology that enters most of our lives several times a day without us knowing it.

 

PKI relies on two standardized cryptographic algorithms: RSA 2048 (Rivest – Shamir – Adleman) and ECC 256 (elliptic-curve cryptography). This technology underpins almost all aspects of digital life, allowing enterprises to securely transact business within their own networks and wider.

 

However, today’s cryptographic algorithms will become unfit for purpose when quantum computing becomes powerful and stable enough to easily decrypt existing algorithms.

 

Quantum computing is an advanced type of computation that leans on quantum physics to run multiple processes simultaneously, breaking down PKI-based defences. While the average computer today would need around 300 trillion years to break a traditionally encrypted piece of content, a quantum computer, with its ability to ‘guess’ keys in parallel, would need about a week.

 

Scientists consider the predicted fallout of quantum computers to be so severe, that it has been dubbed the ‘Quantum Apocalypse’. When the first quantum computer becomes operable, whoever owns it will be able to easily decrypt data under the highest encryption. This could be anything from the control systems upholding the national electric grid, to sensitive personal and industrial data within an enterprise.

 

There is no time to waste on preparing for this transition. To remain secure, it is imperative enterprises adopt new families of quantum-resistant cryptography as soon as possible.

 

Most estimates of the timing of this quantum computing capability being sufficient to render current cryptographic algorithms obsolete are within a decade.  Since PKI is so ubiquitous and foundational, the time to start planning is now.

 

Keeping the Quantum Apocalypse at bay

The good news is that organisations across the world, from the fields of academia and technology to the public sector are uniting to discover new, quantum-safe algorithms.

 

The USA’s National Institute of Standards and Technology (NIST) announced its post-quantum algorithm winners in July, and now standards bodies and hardware/ software manufacturers must implement new cryptography to all computing systems. Standardisation of these algorithms is expected by 2024.

 

Although standardisation will take time, it is paramount that enterprises and governments transition to quantum-safe PKI certificates immediately. Hybrid PKI certificates will bridge the gap during the transitional phase. These use both traditional and quantum-safe algorithms, allowing enterprises to transition from traditional PKI to post-quantum PKI in a manageable way.

 

This process, however, is not without its challenges; replacing all of the certificates and keys circulating in digital systems is a mammoth task. Despite the challenges in making this transition, it is mission-critical for all enterprises, as failure to replace even one certificate can lead to breaches, data losses, or operational disruption.

 

Crypto agility in the quantum transition

Crypto agility, meaning the ability of an enterprise’s ecosystem to ensure its fundamental cryptographic primitives are current, reliable, and robust, is critical as IT teams make this transition to the quantum era.

 

The first step is to gain a full understanding and visibility of all certificates and keys present in the enterprise environment so that IT teams can replace them all. Now, to appreciate the enormity of this task, let’s consider just how many certificates exist in an enterprise environment. Employees’ devices like phones, laptops, and servers are validated using certificates. Their credit cards, e-passports, keycards, etc. have PKI technology.

 

To put it simply, PKI exists in nearly every aspect of work and personal life.

 

For this full visibility of certificates, automation is key. This can be done using Certificate Lifecycle Management (CLM), which will allow enterprises to manage all the certificates in their systems at once, renewing and cancelling them as necessary.

 

The most advanced CLM solutions can manage the transition of all certificates, regardless of what Certificate Authority issued them. This makes CLM extremely effective in the transition from existing PKI certificates to quantum-resistant ones, as it ensures no stone is left unturned.

 

Likewise, cryptographic industry leaders have published a growing opus of free resources such as Quantum Labs, to help organisations and governments migrate to quantum-resistant algorithms and prepare for the quantum era.

 

Immediate action needed

With rapid developments in quantum computing, it is no longer a problem for the future. Quantum computing is knocking at the door and won’t wait patiently while enterprises brace for impact. Instead, immediate action must be taken to mitigate future quantum-related threats.

 

Enterprises and governments must embrace the transition to quantum-safe algorithms or risk their sensitive data being compromised.  Start by taking inventory of systems that include PKI and cryptographic functions.  Use discovery features of CLM software to find where certificates are being used.  The time to start is now.

 

---

 

Jason Soroko is CTO at Sectigo

 

Main image courtesy of iStockPhoto.com