Genuinely stable and effective quantum computers may still seem like a far-off dream, despite much public hype, but the technology is advancing behind closed doors – and with it, a rush to generate quantum-resistant algorithm standards.
Current public key encryption algorithms rely on mathematical steps that are hard to solve in reverse. If your encryption is using a number bigger than 2,048 bits, current computers can’t break it. Quantum computers will have no such problem, posing a challenge for everyone from policy makers, to cryptographic key creators, to, arguably, CISOs with an (admittedly long-term) eye on the threat horizon.
Quantum Technology Development
So far the UK has committed roughly £1 billion into the development of quantum technologies such as the establishment of the National Quantum Technologies programme, and on creating a National Quantum Computing Centre.
Andersen Cheng CEO of Post-Quantum, a British company working on post-quantum encryption tools and techniques told Computer Business Review: “The landscape has changed completely now because in the last three or four years, billions of dollars have now gone into building a [true] quantum computer.”
See also: IBM Doubles Quantum Performance
However, most of this is destined towards the design of quantum computers rather than thinking about the mitigations needed on the security side.
He said: “Logically it makes no sense… if you’re putting in tonnes of money in building a quantum computer, you believe it will happen. But then when you have created the Frankenstein monster you don’t have a way to contain it.”
His company has developed a technique known as “never-the-same” (NTS) which is based on the McEliece cryptosystem, as part of its efforts to plan ahead. (NTS relies on injecting random noise into a message. This noise is removed on decryption using error correcting techniques in large part stemming from the inventions of the company’s co-founder, Professor Martin Tomlinson, co-invented Tomlinson-Harashima Pre-coding.)
Content from our partners
He entered that technique into a competition to find the best quantum-resistant algorithms. It has been shortlisted, but it has competition…
The Search for an Alternative
The U.S. National Institute of Standards and Technology (NIST) is leading the charge to find and switch the world to quantum-resistant algorithms.
With a public competition last year that attracted some of the world’s brightest minds, it attracted over 70 candidate algorithms which has now been whittled down to 26. (It aims to announce a final 10 to 13 candidates by June).
Its stated goal: To create “new public-key cryptography standards will specify one or more additional unclassified, publicly disclosed digital signature, public-key encryption, and key-establishment algorithms that are available worldwide, and are capable of protecting sensitive government information well into the foreseeable future.”
This is still very much an active search as teams assess the trade-offs; be that key signing speed, key size or generation time.
John Merrill, CEO of DigiCert told Computer Business Review: “We advise companies to be prudent and start preparing now. Companies need to be able to swap out current cryptographic algorithms within the organisation without a major impact on operations. We advise customers to use a certificate manager for their digital certificate deployments, with automated discovery to know where their certificates are used, which algorithms they deploy, and when they need to be renewed.”
Quantum Key Distribution
Many are looking to Quantum Key Distribution as a way of avoiding the threat.
This relies on unique hardware to create digital keys for use in encryption processes. These systems importantly do not rely on encryption that is devised through mathematical equations.
Toshiba QKD hardware
Image Credit: Toshiba
Instead, Quantum Key Distribution or QKD uses hardware that can encoded onto photons in order to create two secret keys that can be used for communicating data securely.
The major advantage of QKDs is that if someone tries to observe the key generation process then that act will introduce errors that will reveal the intrusion into the network.
This is a hardware solution that requires investment and is currently not fit for large scale data encryption and transmission over long distances.
Andrew Shields, assistant Managing Director at Toshiba Research Europe, a key developer of QKDs, told Computer Business Review: “Today, we’re at price points, which are, let’s say, several tens of thousands of pounds. So, expensive, but not very, very expensive for enterprises; maybe comparable to a high end firewall.
He added: “But what we’re seeing now is a lot of the technology has been integrated onto chips that can make it much smaller and much cheaper in the future, orders of magnitude cheaper. Even so, it’s like everything it starts very expensive, but eventually it will become very cheap in the future.”
Meanwhile, as post-Quantum’s Chenq notes: “People are now starting to think oh, yes, this is an existential risk. We don’t want to be the first company affected by it. We want to be the last man standing. So people are now paying a lot more attention.”
