Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

11/18/2019
10:00 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Quantum Computing Breakthrough Accelerates the Need for Future-Proofed PKI

Public key infrastructure is a foundational security tool that has evolved to become a critical base for future advancements. Today's generation of PKI can be coupled with quantum-resistant algorithms to extend the lifespan of digital certificates for decades.

Rumors of a quantum technology breakthrough were confirmed last month with the release of a report by Google's AI Quantum team, University of California, and others. Quantum computing, a complex technology that had been predicted to take years to come to market, suddenly gained urgency thanks to this breakthrough.

Quantum computing is a complicated concept but, in simple terms, it's a way of encoding and correlating information at massive scale. Achieving quantum computing will change the way the world communicates as well as how it manages and protects data — it's an advancement that will radically change the cybersecurity landscape.

Quantum supremacy or true quantum computing is best demonstrated by running a mathematical algorithm that a classical computer would take years to complete. In its report, Google claims that the research team ran an algorithm that would take a classical computer 10,000 years to complete with 30 seconds of quantum processing time. If proven to be true, it's a strong indication that we are getting much closer to quantum computing becoming a reality rather than a theoretical possibility.

Even if this figure is disproven — IBM immediately refuted the "10,000 years" figure with an estimate of 2.55 days — it's just a matter of time. Since the cost of classical computation roughly doubles for every qubit added, IBM's own extrapolation indicates that with just six more qubits, it would take the classical computer over a year. Advancements pioneered by Google and others make the arrival of 60-qubit machines inevitable, and, regardless of advancements, 2.55 days versus 30 seconds is still a difference of four orders of magnitude.

Why Crypto-Agility Is Key
The cryptographic algorithms we use today will rapidly degrade with the onset of quantum compute capability. The SHA-1 to SHA-2 migration in recent years is an excellent comparison: When it became widely accepted that SHA-1 was no longer safe to use, most began migrating their public key infrastructure (PKI) to SHA-2. Technically speaking, SHA-1 presented significant security risk because of the ease of access a spoofed certificate and key presents to an attacker. Like many of the certificate-based attacks we've seen in recent years, attackers can successfully spoof a trusted certificate authority's signature, replacing a legitimate certificate with their own, granting them entryway to the target network. Even newer manipulation techniques mean some digital identities can be compromised by rederiving the associated private key. Keyfactor researchers demonstrated this year that over 400,000 certificates found on the Internet could be compromised due to insufficient entropy when generating RSA private keys.

The SHA-2 migration was a massive undertaking for IT teams and highlighted the critical nature of an enterprise's ability to track and manage its cryptographic keys. Today, an average enterprise holds upward of hundreds of thousands of certificates and keys — and that number continues to grow. With so many certificates, it is essential that automated methods are deployed to quickly replace these certificates if the cryptography they rely on becomes insecure.

Operationally speaking, even without quantum advancements, managing PKI is challenging, time consuming, and expensive. Our research shows that 71% of businesses don't know how many certificates and keys they have. Introducing a crypto-agile framework  — which enables cryptography like PKI to adapt quickly to advancements, from SHA-1 to SHA-2, for example — is essential to manage not only today's PKI demands but also to manage the automation and transformation that quantum computing will demand. Adopting a single, automated platform provides complete visibility to every certificate and key, complementing the crypto-agile framework. 

Future-Proofing PKI with Quantum-Safe Certificates
In addition to PKI automation to support management, quantum-safe certificates are critical to future-proofed PKI that can scale and transform with quantum computing advancements. This is critically important for companies manufacturing Internet of Things and connected devices. 

Consider that a business that builds devices with a life span of four to seven years (for example, pacemakers, insulin pumps, automobiles, planes, and trains) has an obligation to design the ability to update the cryptography on its devices. Some may argue that not doing so is willful negligence, which puts the company at risk of unnecessary product recalls and may pose massive liabilities in life-critical systems.

When it comes to sensitive communications across connected devices, it's not enough to rely on existing algorithms until quantum computers can break them. Due to limited use of communication protocols with a property called forward secrecy — a feature of key agreement protocols that requires the use of a new key to encrypt a session, giving the user assurances their session keys will not be compromised — stored communications can often be decrypted after the fact, allowing potential access to massive amounts of sensitive data. With quantum computers, these stored communications without forward secrecy will be exposed.

The reality of this breakthrough means that quantum advancements are closer than we think. PKI is a foundational security tool and form of cryptography that has stood the test of time and evolved to become a critical base for advancements to come. Today's generation of PKI can be coupled with quantum-resistant algorithms that can extend the lifespan of digital certificates for decades to come.  

Overwhelmed IT leaders must look at PKI and other cryptography as critical infrastructure, and, like every other element within their security framework, evaluate the tools they can adopt to help them streamline and automate PKI management. Future-proofing PKI today means enterprises can integrate tomorrow's technologies with confidence.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "8 Backup & Recovery Questions to Ask Yourself."

Kevin von Keyserling is Chief Strategy Officer at Keyfactor. In this role, Kevin is responsible for company operations and oversees Keyfactor's organic and acquisition growth strategy.  JD Kilgallin is a Senior Integration Engineer at Keyfactor. In this role, he works to ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/17/2020
APT Groups Set Sights on Linux Targets: Inside the Trend
Kelly Sheridan, Staff Editor, Dark Reading,  9/11/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5605
PUBLISHED: 2020-09-18
Directory traversal vulnerability in WHR-G54S firmware 1.43 and earlier allows an attacker to access sensitive information such as setting values via unspecified vectors.
CVE-2020-5606
PUBLISHED: 2020-09-18
Cross-site scripting vulnerability in WHR-G54S firmware 1.43 and earlier allows remote attackers to inject arbitrary script via a specially crafted page.
CVE-2020-5628
PUBLISHED: 2020-09-18
UNIQLO App for Android versions 7.3.3 and earlier allows remote attackers to lead a user to access an arbitrary website via the vulnerable App. As a result, if the access destination is a malicious website, the user may fall victim to the social engineering attack.
CVE-2020-5629
PUBLISHED: 2020-09-18
UNIQLO App for Android versions 7.3.3 and earlier allows remote attackers to lead a user to access an arbitrary website via a malicious App created by the third party. As a result, if the access destination is a malicious website, the user may fall victim to the social engineering attack.
CVE-2020-25756
PUBLISHED: 2020-09-18
** DISPUTED ** A buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 due to a lack of bounds checking. A crafted HTTP header can exploit this bug. NOTE: a committer has stated "this will not happen in practice."