Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10:00 AM
Connect Directly
E-Mail vvv

Quantum Computing Breakthrough Accelerates the Need for Future-Proofed PKI

Public key infrastructure is a foundational security tool that has evolved to become a critical base for future advancements. Today's generation of PKI can be coupled with quantum-resistant algorithms to extend the lifespan of digital certificates for decades.

Rumors of a quantum technology breakthrough were confirmed last month with the release of a report by Google's AI Quantum team, University of California, and others. Quantum computing, a complex technology that had been predicted to take years to come to market, suddenly gained urgency thanks to this breakthrough.

Quantum computing is a complicated concept but, in simple terms, it's a way of encoding and correlating information at massive scale. Achieving quantum computing will change the way the world communicates as well as how it manages and protects data — it's an advancement that will radically change the cybersecurity landscape.

Quantum supremacy or true quantum computing is best demonstrated by running a mathematical algorithm that a classical computer would take years to complete. In its report, Google claims that the research team ran an algorithm that would take a classical computer 10,000 years to complete with 30 seconds of quantum processing time. If proven to be true, it's a strong indication that we are getting much closer to quantum computing becoming a reality rather than a theoretical possibility.

Even if this figure is disproven — IBM immediately refuted the "10,000 years" figure with an estimate of 2.55 days — it's just a matter of time. Since the cost of classical computation roughly doubles for every qubit added, IBM's own extrapolation indicates that with just six more qubits, it would take the classical computer over a year. Advancements pioneered by Google and others make the arrival of 60-qubit machines inevitable, and, regardless of advancements, 2.55 days versus 30 seconds is still a difference of four orders of magnitude.

Why Crypto-Agility Is Key
The cryptographic algorithms we use today will rapidly degrade with the onset of quantum compute capability. The SHA-1 to SHA-2 migration in recent years is an excellent comparison: When it became widely accepted that SHA-1 was no longer safe to use, most began migrating their public key infrastructure (PKI) to SHA-2. Technically speaking, SHA-1 presented significant security risk because of the ease of access a spoofed certificate and key presents to an attacker. Like many of the certificate-based attacks we've seen in recent years, attackers can successfully spoof a trusted certificate authority's signature, replacing a legitimate certificate with their own, granting them entryway to the target network. Even newer manipulation techniques mean some digital identities can be compromised by rederiving the associated private key. Keyfactor researchers demonstrated this year that over 400,000 certificates found on the Internet could be compromised due to insufficient entropy when generating RSA private keys.

The SHA-2 migration was a massive undertaking for IT teams and highlighted the critical nature of an enterprise's ability to track and manage its cryptographic keys. Today, an average enterprise holds upward of hundreds of thousands of certificates and keys — and that number continues to grow. With so many certificates, it is essential that automated methods are deployed to quickly replace these certificates if the cryptography they rely on becomes insecure.

Operationally speaking, even without quantum advancements, managing PKI is challenging, time consuming, and expensive. Our research shows that 71% of businesses don't know how many certificates and keys they have. Introducing a crypto-agile framework  — which enables cryptography like PKI to adapt quickly to advancements, from SHA-1 to SHA-2, for example — is essential to manage not only today's PKI demands but also to manage the automation and transformation that quantum computing will demand. Adopting a single, automated platform provides complete visibility to every certificate and key, complementing the crypto-agile framework. 

Future-Proofing PKI with Quantum-Safe Certificates
In addition to PKI automation to support management, quantum-safe certificates are critical to future-proofed PKI that can scale and transform with quantum computing advancements. This is critically important for companies manufacturing Internet of Things and connected devices. 

Consider that a business that builds devices with a life span of four to seven years (for example, pacemakers, insulin pumps, automobiles, planes, and trains) has an obligation to design the ability to update the cryptography on its devices. Some may argue that not doing so is willful negligence, which puts the company at risk of unnecessary product recalls and may pose massive liabilities in life-critical systems.

When it comes to sensitive communications across connected devices, it's not enough to rely on existing algorithms until quantum computers can break them. Due to limited use of communication protocols with a property called forward secrecy — a feature of key agreement protocols that requires the use of a new key to encrypt a session, giving the user assurances their session keys will not be compromised — stored communications can often be decrypted after the fact, allowing potential access to massive amounts of sensitive data. With quantum computers, these stored communications without forward secrecy will be exposed.

The reality of this breakthrough means that quantum advancements are closer than we think. PKI is a foundational security tool and form of cryptography that has stood the test of time and evolved to become a critical base for advancements to come. Today's generation of PKI can be coupled with quantum-resistant algorithms that can extend the lifespan of digital certificates for decades to come.  

Overwhelmed IT leaders must look at PKI and other cryptography as critical infrastructure, and, like every other element within their security framework, evaluate the tools they can adopt to help them streamline and automate PKI management. Future-proofing PKI today means enterprises can integrate tomorrow's technologies with confidence.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "8 Backup & Recovery Questions to Ask Yourself."

Kevin von Keyserling is Chief Strategy Officer at Keyfactor. In this role, Kevin is responsible for company operations and oversees Keyfactor's organic and acquisition growth strategy.  JD Kilgallin is a Senior Integration Engineer at Keyfactor. In this role, he works to ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-19
VMware NSX-T contains a privilege escalation vulnerability due to an issue with RBAC (Role based access control) role assignment. Successful exploitation of this issue may allow attackers with local guest user account to assign privileges higher than their own permission level.
PUBLISHED: 2021-04-19
Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote access and remote support capabilities. This connection can be intercepted using DNS spoofing attack and a device initiated remote port-forward channel can be us...
PUBLISHED: 2021-04-19
In Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older an internal management service is accessible on port 8000 and some API endpoints could be accessed without authentication to trigger a shutdown, a reboot or a reboot into recovery mode.
PUBLISHED: 2021-04-19
In Fibaro Home Center 2 and Lite devices with firmware version 4.540 and older an authenticated user can run commands as root user using a command injection vulnerability.
PUBLISHED: 2021-04-19
In Fibaro Home Center 2 and Lite devices in all versions provide a web based management interface over unencrypted HTTP protocol. Communication between the user and the device can be eavesdropped to hijack sessions, tokens and passwords.