Time to Quell the Alarm Bells Around Post-Quantum Crypto-Cracking

As computer scientists march forward in the process of taking quantum computing into the practical realm, cybersecurity vendors and practitioners will need to be ready with encryption mechanisms that can withstand the power of quantum's compute potential. But risk experts say that future-proofing measures for post-quantum cryptography don't have to be created in panic.

Contrary to the way some early pundits have painted the post-quantum computing landscape, the truth is that there will be no quantum cliff in which today's encryption mechanisms will suddenly become obsolete, says Dr. Colin Soutar, the US quantum cyber-readiness leader and managing director for Deloitte Risk & Financial Advisory, which just released a report on quantum encryption. He explains that in reality, the transition to quantum is going to be an ongoing process.

"There's a lot of discussion around quantum right now, and there's a lot of conflation of different ideas. There are even some alarmist statements about how everything needs to change overnight to update to quantum-resistant algorithms," says Soutar. "That implies there's a specific date (for quantum adoption), and there's really not."

Viewing post-quantum security problems from that kind of lens can help the cybersecurity industry start to work the issue with the same kind of risk management and roadmap planning steps they'd take for any other kind of serious emerging technology trend.

Building Awareness, Not Alarmism

One thing is for certain: The drumbeat for quantum computing and post-quantum cryptography is getting louder.

Quantum computing stands to give the computing world a major boost in the ability to tackle multi-dimensional analysis problems that strain today's most advanced traditional supercomputers. Whereas traditional computers fundamentally work based on the storage of information in binary, quantum computing is not limited by the "on" or "off" position of information storage.

Quantum computers depend on the phenomenon of quantum mechanics called superposition, in which a particle can exist in two different states simultaneously. They take advantage of that phenomenon by using "qubits," which can store information in a variety of states at the same time.

Once perfected, this will give quantum computers the ability to greatly speed up data analysis on tough problems in areas as disparate as healthcare research and AI. However, this kind of power also makes these computers ideal for cracking cryptographic algorithms. This is the crux of the push for awareness from security advocates over the last several years to ensure that the industry starts preparing for that post-quantum reality.

"Our view on this is less about being alarmist and saying, 'You need to update everything now' and more of raising the awareness to start to think about what your data are, what your risk could be relative to that data and the crypto you use," Soutar says. "And then deciding when you might want to think about, start looking at discovery on your roadmap, and then updates later."

According to the survey released by Deloitte this week, the good news is that among those technology and business executives who are aware of quantum computing, a little over 50% also understood the attendant security considerations to it as well.

Timing the Post-Quantum Security Impact

The trick in all of this for security professionals is that there are a lot of fires to put out elsewhere before worrying about something that could be years away. Today's quantum computers operate in the research realm only. They require immensely specialized equipment — including microwaves manipulating quantum objects within supercooled environments that operate at near absolute zero in many instances. There is a long way to go on the research front for quantum computers to work in a commercially viable fashion, and no one is quite sure on what the timeline will be.

That "ambiguity of the timeline" is complicated, says Soutar, who explains there are numerous timelines to consider from a post-quantum cryptography perspective.

"The implications of quantum computing on cybersecurity is fairly well known, and it could be huge. I mean, cryptography is endemic in what we do throughout the economy. The thing is that the timing is unknown because first, a quantum computer needs to be mature and viable enough and commercially robust as well, to actually be able to run Shor's algorithm," he says, referring to an algorithm for finding prime factors of an integer that is the benchmark for whether a quantum computer could effectively break public key cryptography. "Secondly, attackers need to get access to data, and they need to untangle that data."

The other variable in this is a concept of attack called "harvest now, decrypt later," where attackers gather encrypted information now with the understanding that they could break it through quantum computing resources at a later date. The Deloitte survey shows that 50.2% of organizations believe they could be at risk for harvest now, decrypt later schemes.

"That then opens up risk to this data that I'm expecting to be good for the lifetime out of an individual," Soutar says. "Maybe it's personal information, or it's financial information that I want to be secure for at least 10 years. Or it's national security information which may have longer requirements on it."

He adds, "So, people are starting to think about, 'Well, what data do I have and how do I need to protect it? For how long? Secondly, how long is it going to take me to do the updates to post quantum cryptography? When should I start thinking about it?'"

These are the big timeline questions for security and quantum computing experts, who are still at odds over whether we've got 5, 10, or 15 years before the quantum effect impacts encryption. Soutar reiterates that perhaps the better thought process is to stop thinking about it as a definitive date the industry times for, and instead think about relative risk over time. He explains that this is an idea put forward by Dr. Michele Mosca, co-founder and CEO of Evolution Inc, and co-author of a report earlier this year that details that line of thinking.

"Then you can start to think, if I'm with a huge organization, maybe it's going to take me a decade to do the updates," Soutar explains. "I've got all these medical devices or other OT devices that I've got to think about the supply chain communications, and how do I enforce this on my suppliers?"

He adds, "So, again, it's getting that right degree of understanding so that people can start to maybe even quantify what the risk is, and stack that up against other cyber-risks that they're looking to invest in over time."

Working on the Boring Parts

At the end of the day, Soutar says that maybe that the quantum lens can be a bit distracting to security. As long as organizations keep quantum on the horizon, it may just be a matter of making "perfunctory updates to crypto" that might not be that big of a deal for the industry if it is all done in due time.

"The quantum threat to crypto should really just be something that's addressed over time. Just do updates as the algorithms get standardized," says Soutar, who believes that the industry should be talking about the nuts and bolts of standardization, which can be boring but also are the most important way to start moving forward. "As they go through that process, then companies and governments have more confidence in making the changes, doing the updates, and they just do it. So, it really should be a non-event."

That's not to say that Soutar believes security practitioners should be sticking their heads in the sand with regard to quantum risk to security postures. The risks will accelerate, but it's just a matter of working that encryption roadmap like any other part of the cyber-risk roadmap. That includes doing risk assessments, discovering and classifying data, and projecting risk over time.

"It's never a bad idea to go look around in the attic. You don't know what you're going to find there. When we do that, when we go through basic cryptography, there are things that we find," he says. "You might say, 'Well, let's update that or let's make sure that we've got the right segregation of duties relative to that.' Or, 'Have we got all the responsibilities and governance laid out?' Again, it's the boring things. But those are things that you find when you look through the quantum lens."

Deloitte's survey shows that it may take some kind of regulatory push to prod security practitioners into serious steps on post-quantum cryptography. Soutar hopes that the industry is able to come together in the coming years to develop a framework for post-quantum cryptographic methods perhaps in the same spirit as the NIST Cybersecurity Framework (CSF).

"It's not a bad idea to have some framework out there when there's a whiff of potential regulation downstream," he says. "I think that's always better than just regulation, having something that's voluntary and outcome-based."