The search for cryptoagility: Keeping the Quantum Apocalypse at bay

The very fabric of how secure commerce is performed is going to be at risk, and this is important not only for those of us who work in cybersecurity. 

Every facet of life today - finance, telecommunications, transportation, government, and anything else you can think of - is, to a large extent, digital. Vast amounts of critical information, from crucial intellectual property to highly sensitive personal information, are coded as zeros and ones. 

This digital data, when encrypted by algorithms, has served us well since the beginning of digital times: we have the RSA 2048 and ECC 256 algorithms to thank for keeping all our information systems safe. 

To put it extremely simply, encryption protects data because for computers the tasks of encrypting and decrypting data are relatively easy, but trying to break an encryption system is very, very hard even for supercomputers.

That is to say, it is very difficult to discover the encryption key by trying all possible encryption keys against the code, in what is known as a brute force attack. 

Putting in place RSA 2048 and ECC 256 algorithms means  a computer running through all combinations of possible keys needs huge amounts of processing time. To break a system encrypted with RSA 2048, for example, a normal computer would need around 300 trillion years.

The problem is cryptography as we know it will soon stop being unbreakable, and will therefore be rendered useless. The reason is the rapid development of quantum computers. 

Breaking the code: quantum computing against today’s algorithms

Quantum computers take advantage of the very nature of quantum physics to create an entirely new computing paradigm. Instead of the bits and bytes of traditional 0/1 gated computers we have been using so far, they run on quantum bits (known as qubits) which can superpose and entangle themselves in order to perform multiple processes simultaneously. This drastically cuts down processing time. 

Quantum computers along with clever processes defined by Shor’s algorithm will break the RSA 2048 and ECC 256 encryption algorithms that we use today. When they become fully operational and apt to fall into the wrong hands, they will render existing cryptographic techniques obsolete. The exact date is known as Z-Day, likely to occur sometime within the next ten years.

At that point, credit card transactions, passport validations, ID badge systems, the control systems upholding the electric grid, and so many other facets of our modern, digital life, could be cracked open as easily as a smartphone screen. 

Once quantum computers reach the point where RSA 2048 and ECC 256 are compromised, the effects are predicted to be so dire that the outcome is known as the Quantum Apocalypse. 

Bad intentions: quantum computers in the wrong hands

To have this effect, quantum computing need not even be perfected, or even mature. The computer won’t need to decrypt in real-time, after all, to radically compromise the information. As long as it can break RSA and ECC in a reasonable amount of time, say a day of processing, or even a week or a month (as opposed to trillions of years) large-scale data breaches can and will happen. 

When this becomes a reality, a bad actor could steal the files of a high-value data target, store it in its encrypted state and set a quantum computer on the task of breaking its private key. For sensitive information such as cutting-edge research, having the decrypted information available today or in a week makes little difference.

It gets worse: if the bad actor is especially well-resourced, which many of them certainly are, they might simply stash away the stolen information in its encrypted form, in order to decrypt in the future when the technology has caught up.

Granted, this won’t work for all targets: active credit card numbers, for example, are not only easily changed, so probably won’t be active by the time the bad actor gets their hands on a quantum computer. Other types of confidential information, though, such as industrial or state secrets, can still cause severe damage if they see the light of day a decade from today. 

New algorithms for the quantum era

The good news is the Quantum Apocalypse can be averted. 

Organisations across the world, from the fields of academia, technology, and the public sector, are redoubling their efforts to discover and implement new, quantum-safe crypto algorithms. The National Institute for Standards and Technology (NIST) is one of the main players in the race against the Quantum Apocalypse, and its Post-Quantum Cryptography project is working to identify and vet potential next-generation cryptographic schemes. 

The aim is to arrive at one or more algorithms which can be reliably demonstrated to be safe from defeat by advances in quantum computing, and can therefore ensure crypto-agility. This is the ability to update cryptographic algorithms, keys and certificates quickly, to help systems resist the onslaught of quantum computing. The task is not easy: staving off the Quantum Apocalypse will require a complete retooling of PKI systems through all aspects of industry to use these new crypto algorithms. 

“The implementation of any new encryption technology carries risk even before it has a chance to mature. The larger focus for organisations should be on building cryptographic agility, so that they’re able to shift to new ciphers as they become available and the impact of quantum capabilities become real,” writes Eric Hanselman, Chief Analyst at 451 Research, in the recent report “Quantum Computing: Countdown to a Quantum Leap.”

We have not yet arrived at the definitive quantum-safe algorithms which will bring quantum resilience, but the work is underway. Recently, the NIST narrowed the field from 69 potential candidates to 15. However, it is by no means too soon for security experts and IT practitioners need to understand and prepare for this changing landscape.

Help is on the way

While the cryptographic community works to standardise on quantum-safe algorithms, free sets of resources like the new Quantum Labs are available to provide enterprises and other certificate users with information to understand the quantum cryptographic situation and how to ensure continued security as quantum computers become a reality. 

Just because mankind is making a quantum leap, doesn't mean we have to jump back in time.