Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

11/18/2019
10:00 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Quantum Computing Breakthrough Accelerates the Need for Future-Proofed PKI

Public key infrastructure is a foundational security tool that has evolved to become a critical base for future advancements. Today's generation of PKI can be coupled with quantum-resistant algorithms to extend the lifespan of digital certificates for decades.

Rumors of a quantum technology breakthrough were confirmed last month with the release of a report by Google's AI Quantum team, University of California, and others. Quantum computing, a complex technology that had been predicted to take years to come to market, suddenly gained urgency thanks to this breakthrough.

Quantum computing is a complicated concept but, in simple terms, it's a way of encoding and correlating information at massive scale. Achieving quantum computing will change the way the world communicates as well as how it manages and protects data — it's an advancement that will radically change the cybersecurity landscape.

Quantum supremacy or true quantum computing is best demonstrated by running a mathematical algorithm that a classical computer would take years to complete. In its report, Google claims that the research team ran an algorithm that would take a classical computer 10,000 years to complete with 30 seconds of quantum processing time. If proven to be true, it's a strong indication that we are getting much closer to quantum computing becoming a reality rather than a theoretical possibility.

Even if this figure is disproven — IBM immediately refuted the "10,000 years" figure with an estimate of 2.55 days — it's just a matter of time. Since the cost of classical computation roughly doubles for every qubit added, IBM's own extrapolation indicates that with just six more qubits, it would take the classical computer over a year. Advancements pioneered by Google and others make the arrival of 60-qubit machines inevitable, and, regardless of advancements, 2.55 days versus 30 seconds is still a difference of four orders of magnitude.

Why Crypto-Agility Is Key
The cryptographic algorithms we use today will rapidly degrade with the onset of quantum compute capability. The SHA-1 to SHA-2 migration in recent years is an excellent comparison: When it became widely accepted that SHA-1 was no longer safe to use, most began migrating their public key infrastructure (PKI) to SHA-2. Technically speaking, SHA-1 presented significant security risk because of the ease of access a spoofed certificate and key presents to an attacker. Like many of the certificate-based attacks we've seen in recent years, attackers can successfully spoof a trusted certificate authority's signature, replacing a legitimate certificate with their own, granting them entryway to the target network. Even newer manipulation techniques mean some digital identities can be compromised by rederiving the associated private key. Keyfactor researchers demonstrated this year that over 400,000 certificates found on the Internet could be compromised due to insufficient entropy when generating RSA private keys.

The SHA-2 migration was a massive undertaking for IT teams and highlighted the critical nature of an enterprise's ability to track and manage its cryptographic keys. Today, an average enterprise holds upward of hundreds of thousands of certificates and keys — and that number continues to grow. With so many certificates, it is essential that automated methods are deployed to quickly replace these certificates if the cryptography they rely on becomes insecure.

Operationally speaking, even without quantum advancements, managing PKI is challenging, time consuming, and expensive. Our research shows that 71% of businesses don't know how many certificates and keys they have. Introducing a crypto-agile framework  — which enables cryptography like PKI to adapt quickly to advancements, from SHA-1 to SHA-2, for example — is essential to manage not only today's PKI demands but also to manage the automation and transformation that quantum computing will demand. Adopting a single, automated platform provides complete visibility to every certificate and key, complementing the crypto-agile framework. 

Future-Proofing PKI with Quantum-Safe Certificates
In addition to PKI automation to support management, quantum-safe certificates are critical to future-proofed PKI that can scale and transform with quantum computing advancements. This is critically important for companies manufacturing Internet of Things and connected devices. 

Consider that a business that builds devices with a life span of four to seven years (for example, pacemakers, insulin pumps, automobiles, planes, and trains) has an obligation to design the ability to update the cryptography on its devices. Some may argue that not doing so is willful negligence, which puts the company at risk of unnecessary product recalls and may pose massive liabilities in life-critical systems.

When it comes to sensitive communications across connected devices, it's not enough to rely on existing algorithms until quantum computers can break them. Due to limited use of communication protocols with a property called forward secrecy — a feature of key agreement protocols that requires the use of a new key to encrypt a session, giving the user assurances their session keys will not be compromised — stored communications can often be decrypted after the fact, allowing potential access to massive amounts of sensitive data. With quantum computers, these stored communications without forward secrecy will be exposed.

The reality of this breakthrough means that quantum advancements are closer than we think. PKI is a foundational security tool and form of cryptography that has stood the test of time and evolved to become a critical base for advancements to come. Today's generation of PKI can be coupled with quantum-resistant algorithms that can extend the lifespan of digital certificates for decades to come.  

Overwhelmed IT leaders must look at PKI and other cryptography as critical infrastructure, and, like every other element within their security framework, evaluate the tools they can adopt to help them streamline and automate PKI management. Future-proofing PKI today means enterprises can integrate tomorrow's technologies with confidence.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "8 Backup & Recovery Questions to Ask Yourself."

Kevin von Keyserling is Chief Strategy Officer at Keyfactor. In this role, Kevin is responsible for company operations and oversees Keyfactor's organic and acquisition growth strategy.  JD Kilgallin is a Senior Integration Engineer at Keyfactor. In this role, he works to ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17103
PUBLISHED: 2020-01-27
An Incorrect Default Permissions vulnerability in the BDLDaemon component of Bitdefender AV for Mac allows an attacker to elevate permissions to read protected directories. This issue affects: Bitdefender AV for Mac versions prior to 8.0.0.
CVE-2020-8009
PUBLISHED: 2020-01-27
AVB MOTU devices through 2020-01-22 allow /.. Directory Traversal, as demonstrated by reading the /etc/passwd file.
CVE-2019-17100
PUBLISHED: 2020-01-27
An Untrusted Search Path vulnerability in bdserviceshost.exe as used in Bitdefender Total Security 2020 allows an attacker to execute arbitrary code. This issue does not affect: Bitdefender Total Security versions prior to 24.0.12.69.
CVE-2019-17102
PUBLISHED: 2020-01-27
An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method `/api/update_setup` does not perform firmware signature checks atomically, leading to an exploitable race condition (TOCTTOU) that allows arbitrary execution of syst...
CVE-2017-16112
PUBLISHED: 2020-01-27
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs:CVE-2017-15010. Reason: This candidate is a reservation duplicate of CVE-2017-15010. Notes: All CVE users should reference CVE-2017-15010 instead of this candidate. All references and descriptions in this candidate have been removed to preven...