Facing the quantum challenge

Tim Callan at quantum encryption firm Sectigo outlines his thoughts about how quantum computing is likely to affect cyber-security over the coming months and years

 

Sophisticated cyber threats are ever-present, but an existential danger is getting closer each day: quantum computers. They have the potential to shatter the encryption algorithms underpinning our digital world. Specifically, quantum computers will have the ability to break the RSA and ECC algorithms at a pace disproportionate to the overall speed advances they offer.

 

The consequence of this is that any process protected today by digital certificates will be fundamentally unsafe, leaving our networks wide open to attack by any sufficiently resourced actor.

 

This is not just a hypothetical anymore. Leading experts worldwide acknowledge the gravity of the situation. Governments are scrambling to develop mitigation strategies, and research into post-quantum cryptography (PQC), the new generation of encryption immune to quantum attacks, is accelerating. Yet, within many organisations, it’s not a topic of conversation.

 

The quantum paradox

Quantum computers hold immense potential to tackle complex problems previously considered intractable. This promises breakthroughs in diverse fields, from medicine and materials science, to AI and drug discovery.

 

However, quantum computers are a double-edged sword. The same principles that enable this advancement could also break the foundation of modern encryption – rendering current techniques like RSA and ECC obsolete.

 

This is the paradox of quantum computers: unparalleled computing power balanced by the ability to dismantle the digital trust our society depends on. Neither side of this paradox can be ignored. Organisations must proactively transition to "quantum-safe" algorithms before it’s too late. It’s essential for this transition to be a boardroom discussion in 2024.

 

The scramble for quantum readiness: embracing PQC

With the quantum era on the horizon, this year we’ll witness a surge in activity as businesses and governments prepare. It won’t just be scientists and experts having conversations about quantum computers, it will be a topic in boardrooms across the globe. And the potential disruption of current encryption methods is a key driver. 

 

At the heart of any quantum readiness strategy lies post-quantum cryptography (PQC). By employing these new algorithms, organisations can put in place encryption which is resilient to future quantum attacks.

 

These new algorithms use fundamentally different mathematical schemes that are resistant to the threat posed by quantum computers, and for a period of time we should expect them to coexist with traditional cryptography in “hybrid” certificates that can interact with different systems using two different schemes at the same time.  

 

Crypto-agility in action

Leading the PQC charge is the United States National Institute of Standards and Technology (NIST), who has been spearheading the development and standardisation of PQC algorithms, the shield against this emerging threat.

 

We can expect that widespread adoption of PQC, increased investment in quantum-safe solutions, and meticulous migration plans for critical infrastructure will become part of boardroom discussions this year.

 

Transitioning our environments to quantum readiness before quantum computers become readily available is no longer an option; it’s a necessity. Achieving "crypto-agility" – the ability to adapt encryption mechanisms to evolving threats –needs to be a key focus in those boardroom discussions.

 

Beyond hardware: adapting existing infrastructure

You may be asking if existing hardware can support these new PQC algorithms. While that may vary from device to device, most hardware should cope so long as it can withstand a software update.

 

Updating current encryption, identity, and communication systems with these algorithms is the key, not necessarily investing in dedicated quantum computing platforms. Think of it like swapping out the lock mechanism on a door, instead of replacing the entire door frame.

 

There is also opportunity for phased rollout, where critical systems and data can be prioritised for PQC adoption first, followed by less sensitive areas. This means businesses can leverage their existing infrastructure while adopting new, secure algorithms.

 

Upgrade today, survive tomorrow

Given the rapid pace of quantum computing development, all new IoT devices, services, and applications must be built with quantum-safe PKI from the ground up. Prioritising devices with lifespans exceeding 10 years with these measures ensures long-term security against evolving quantum threats.

 

Quantum computing offers immense promise, but its potential to disrupt cryptography necessitates immediate action. Ignoring this threat is no longer an option. Organisations must embrace "quantum readiness" – not just as a competitive advantage, but as an existential imperative for every sector.

 

By proactively adopting PQC and adapting existing infrastructure, we can mitigate the risks and navigate the quantum era with confidence, unlocking its potential while safeguarding our digital security.

 

---

 

Tim Callan is Chief Experience Officer at quantum encryption firm Sectigo 

 

Main image courtesy of iStockPhoto.com