Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10:00 AM
Connect Directly
E-Mail vvv

Quantum Computing Breakthrough Accelerates the Need for Future-Proofed PKI

Public key infrastructure is a foundational security tool that has evolved to become a critical base for future advancements. Today's generation of PKI can be coupled with quantum-resistant algorithms to extend the lifespan of digital certificates for decades.

Rumors of a quantum technology breakthrough were confirmed last month with the release of a report by Google's AI Quantum team, University of California, and others. Quantum computing, a complex technology that had been predicted to take years to come to market, suddenly gained urgency thanks to this breakthrough.

Quantum computing is a complicated concept but, in simple terms, it's a way of encoding and correlating information at massive scale. Achieving quantum computing will change the way the world communicates as well as how it manages and protects data — it's an advancement that will radically change the cybersecurity landscape.

Quantum supremacy or true quantum computing is best demonstrated by running a mathematical algorithm that a classical computer would take years to complete. In its report, Google claims that the research team ran an algorithm that would take a classical computer 10,000 years to complete with 30 seconds of quantum processing time. If proven to be true, it's a strong indication that we are getting much closer to quantum computing becoming a reality rather than a theoretical possibility.

Even if this figure is disproven — IBM immediately refuted the "10,000 years" figure with an estimate of 2.55 days — it's just a matter of time. Since the cost of classical computation roughly doubles for every qubit added, IBM's own extrapolation indicates that with just six more qubits, it would take the classical computer over a year. Advancements pioneered by Google and others make the arrival of 60-qubit machines inevitable, and, regardless of advancements, 2.55 days versus 30 seconds is still a difference of four orders of magnitude.

Why Crypto-Agility Is Key
The cryptographic algorithms we use today will rapidly degrade with the onset of quantum compute capability. The SHA-1 to SHA-2 migration in recent years is an excellent comparison: When it became widely accepted that SHA-1 was no longer safe to use, most began migrating their public key infrastructure (PKI) to SHA-2. Technically speaking, SHA-1 presented significant security risk because of the ease of access a spoofed certificate and key presents to an attacker. Like many of the certificate-based attacks we've seen in recent years, attackers can successfully spoof a trusted certificate authority's signature, replacing a legitimate certificate with their own, granting them entryway to the target network. Even newer manipulation techniques mean some digital identities can be compromised by rederiving the associated private key. Keyfactor researchers demonstrated this year that over 400,000 certificates found on the Internet could be compromised due to insufficient entropy when generating RSA private keys.

The SHA-2 migration was a massive undertaking for IT teams and highlighted the critical nature of an enterprise's ability to track and manage its cryptographic keys. Today, an average enterprise holds upward of hundreds of thousands of certificates and keys — and that number continues to grow. With so many certificates, it is essential that automated methods are deployed to quickly replace these certificates if the cryptography they rely on becomes insecure.

Operationally speaking, even without quantum advancements, managing PKI is challenging, time consuming, and expensive. Our research shows that 71% of businesses don't know how many certificates and keys they have. Introducing a crypto-agile framework  — which enables cryptography like PKI to adapt quickly to advancements, from SHA-1 to SHA-2, for example — is essential to manage not only today's PKI demands but also to manage the automation and transformation that quantum computing will demand. Adopting a single, automated platform provides complete visibility to every certificate and key, complementing the crypto-agile framework. 

Future-Proofing PKI with Quantum-Safe Certificates
In addition to PKI automation to support management, quantum-safe certificates are critical to future-proofed PKI that can scale and transform with quantum computing advancements. This is critically important for companies manufacturing Internet of Things and connected devices. 

Consider that a business that builds devices with a life span of four to seven years (for example, pacemakers, insulin pumps, automobiles, planes, and trains) has an obligation to design the ability to update the cryptography on its devices. Some may argue that not doing so is willful negligence, which puts the company at risk of unnecessary product recalls and may pose massive liabilities in life-critical systems.

When it comes to sensitive communications across connected devices, it's not enough to rely on existing algorithms until quantum computers can break them. Due to limited use of communication protocols with a property called forward secrecy — a feature of key agreement protocols that requires the use of a new key to encrypt a session, giving the user assurances their session keys will not be compromised — stored communications can often be decrypted after the fact, allowing potential access to massive amounts of sensitive data. With quantum computers, these stored communications without forward secrecy will be exposed.

The reality of this breakthrough means that quantum advancements are closer than we think. PKI is a foundational security tool and form of cryptography that has stood the test of time and evolved to become a critical base for advancements to come. Today's generation of PKI can be coupled with quantum-resistant algorithms that can extend the lifespan of digital certificates for decades to come.  

Overwhelmed IT leaders must look at PKI and other cryptography as critical infrastructure, and, like every other element within their security framework, evaluate the tools they can adopt to help them streamline and automate PKI management. Future-proofing PKI today means enterprises can integrate tomorrow's technologies with confidence.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "8 Backup & Recovery Questions to Ask Yourself."

Kevin von Keyserling is Chief Strategy Officer at Keyfactor. In this role, Kevin is responsible for company operations and oversees Keyfactor's organic and acquisition growth strategy.  JD Kilgallin is a Senior Integration Engineer at Keyfactor. In this role, he works to ... View Full Bio
Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.