Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

5/23/2018
11:45 AM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

What Should Post-Quantum Cryptography Look Like?

Researchers are tackling the difficult problem of transitioning toward a new mode of cryptographic protections that won't break under the pressure of quantum computing power.

As quantum computing starts barreling away from the theoretical world and into the  realm of reality, the security community is on a timer. Most experts say that once quantum computers come online, they'll have the computational powers to easily break modern cryptography. A new report out today from the Cloud Security Alliance's Quantum Safe Security Working Group says that security researchers, vendors and enterprises need to start working now if they want to beat quantum's cryptographic buzzer.

Considering how long it takes for the IT world to transition to new encryption measures when old ones wear thin, the CSA report warns that the window until quantum reaches widespread adoption - about 10 to 15 years - might not be as long as it seems right now. 

"Cryptographic transitions take time, often a very long time," the report explains, pointing to the decade-long transition it took to get from 1024- to 2048-bit RSA key sizes, or the move to elliptic curve-based cryptography (ECC). "The transition to quantum-resistant cryptography is likely to take at least ten years. It is therefore important to plan for transition as soon as possible," according to the report.

The good news is that researchers have been working on this problem for a long time and they've got some good ideas on where cryptography should be headed. For example, NIST just last month held a workshop that featured some 80 research submissions in its Post Quantum Crypography Standardization initiative. The CSA report offers a breakdown of five of the most promising categories of cryptographic methods that could stand as post-quantum cryptography alternatives.

The five major contending algorithmic classes are:

  • Lattice-based cryptography,
  • Hash-based schemes,
  • Elliptic curve isogenies,
  • Multivariate cryptography, and
  • Code-based cryptography.

According to Roberta Faux, lead author of the CSA report, there are pros and cons for each class of algorithm and it's going to take some time for researchers, and later, security engineers, to figure out which is best for a workable standard. 

For example, she says the community is going to have to have a lively debate to balance out three big trade-offs, namely key size, bandwidth and confidence level. 

If you consider code-based schemes, they've got a fast computational speed and they've been around so long that they've got a high degree of confidence from many in the security community. But their key size is large - some might say impractically so, Faux says. Meanwhile, isogeny-based cryptography has got small key sizes but the computation is still expensive and it's relatively new so there's less confidence there.

"I think the community agrees that we still need more time  to investigate the wide range of post-quantum cryptographic algorithms," Faux says, "and [to] understand the issues involved in migrating from existing public key cryptography to post-quantum cryptography."

Related Content:

 

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
holochain-wins
50%
50%
holochain-wins,
User Rank: Apprentice
5/24/2018 | 10:11:36 PM
answer to post quantum cryptography
It seems many are mistaken about some things so I will elaborate some: going dark is already here. Almost like America's Berlin wall is falling, without highly secure encryption our countries military would be vulnerable overnight. Without CONTINUED research and development within the United States to stay ahead, making larger conventional munitions would be useless. 

What would post-quantum look like?

ANSWER: Since the marketing hype of late promotes how encryption will be cracked in days in the future, is NOT taking into account places like FreeEmailEncryption's algorithms have already made cracking obsolete currently in the field. They use a charding technique, morphing dynamic algo, million bit variable offline key generation for using with supercomputers, and there defeat of brute force cracking with key/message expiration, man in the middle protection, padding, alerting. They even have a way to setup attackers with a honey pot. So replay attacks are stopped and cracking can not happen. That is post quantum. It is here today. Since there method relies heavily on cracking with trillions of computations to solve the password, quantum level brute forcing is 19th century cryptanalysis! The future will have users generating trillion bit keys on morphic algorithms using inhome supercomputers or distributed applications on holochains the new internet.
Florida Town Pays $600K to Ransomware Operators
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/20/2019
Pledges to Not Pay Ransomware Hit Reality
Robert Lemos, Contributing Writer,  6/21/2019
AWS CISO Talks Risk Reduction, Development, Recruitment
Kelly Sheridan, Staff Editor, Dark Reading,  6/25/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-1619
PUBLISHED: 2019-06-27
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. The vulnerability is due to improper session ...
CVE-2019-1620
PUBLISHED: 2019-06-27
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to upload arbitrary files on an affected device. The vulnerability is due to incorrect permission settings in affected DCNM software. An attacker could ex...
CVE-2019-1621
PUBLISHED: 2019-06-27
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to gain access to sensitive files on an affected device. The vulnerability is due to incorrect permissions settings on affected DCNM software. An attacker...
CVE-2019-1622
PUBLISHED: 2019-06-27
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. The vulnerability is due to improper access controls for certain URLs on affected DCNM software...
CVE-2019-10133
PUBLISHED: 2019-06-26
A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to upload cohorts contained a redirect field, which was not restricted to internal URLs.