The U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) has chosen the first group of encryption tools that are designed to withstand the assault of a future quantum computer, which could potentially crack the security used to protect intellectual property and privacy in the digital systems companies rely on every day such as online banking and email software.
The July 5 announcement should serve as a wake-up call to corporates, says Ali El Kaafarani, CEO of UK-based PQShield, a World Economic Forum Technology Pioneer and one of The Innovator’s 2021 Startups of The Week. The company contributed a public key encryption algorithm and three digital signature algorithms announced as standards by NIST.
When large-scale quantum computers – machines that exploit quantum mechanical phenomena to solve mathematical problems that are difficult or intractable for conventional computers – are built, they will be able to break many of the public-key cryptosystems currently in use, according to NIST, a physical sciences laboratory operated by the U.S. Department of Commerce.
While it is hard to predict when quantum computers will be perfected, once access becomes available all existing public-key algorithms and associated protocols will be vulnerable to criminals, competitors, and other bad actors. “It is critical to begin planning for the replacement of hardware, software, and services that use public-key algorithms now so that the information is protected from future attacks,” says El Kaafarani. “Companies and organizations need to put a transition roadmap in place and determine which areas are the most vulnerable so they know where to start. Visibility is power.”
Bad actors are already adopting a “harvest now, decrypt later” approach, stealing encrypted information and storing it on their own servers until they can get more computing power to decrypt it. “When quantum computers become available all the data that have been harvested somewhere will be actually readable, so every minute, every hour, and month and year that companies take no action to protect themselves they are handing their IP, medical records and everything else they store to someone who can decrypt it later,” he says.
The quantum threat has been high on the global security agenda for months, with governments and their partners planning their transition to quantum-resistance even before NIST’s standards were announced. In a recent White House fact sheet following the G7 summit, the deployment of Post-Quantum Cryptography was listed as one of the key challenges of the 21st century.
In January, a White House Memorandum called for US government agencies to identify any encryption not compliant with quantum-proof standards and provide a timeline towards transition. Separately, the French national security agency ANSSI has recommended the immediate introduction of post-quantum defences throughout the private sector.
There are three unknowns that make it urgent for business and organizations to act, El Kaafarani says.
The first is “we don’t know when a quantum computer will be able to decrypt information sent over the Internet,” he says. “People are speculating that it could be five, ten or fifteen years but there is no proof it is not going to happen sooner”. The second reason is that the first person or organization to build a fully functioning quantum computer may not announce it publicly, meaning a bad actor might use it to surreptitiously start decrypting everything from medical records to company IP without anyone realizing it. “The third unknown – and this is very critical – is that the majority of organization don’t even know how long it is going to take to make the transition to post-quantum cryptography,” he says. “If you look at these three unknowns you will understand the need to start identifying why you are using cryptography and how you are using it and define a clear transition roadmap. This should have happened yesterday. If you haven’t started, you are already late.”
Most security algorithms that companies depend on are used in components of many different communications, processing, and storage systems, he says. “It is going to take up to ten years to change everything they have to this new standard.”
Indeed, it took almost two decades to deploy the modern public key cryptography infrastructure known as RSA that is widely used for secure data transmission.
What’s At Risk
In 1994 a mathematician named Peter Shor device a quantum algorithm that in theory allows a sufficiently large and fault tolerance quantum computer to crack the majority of the currently used public key cryptosystems.
The bad news is that RSA, a public-key cryptosystem that is widely used for secure data transmission and related cousins such as elliptic-curve cryptography (ECC),will be broken by quantum technologies. Blockchain technology is based on RSA and ECC, so over the next three to five years blockchain will have to migrate quantum safe protocols. That’s just the start. Today there are more than 20 billion physical devices in the world such as mobile phones, IOT devices, laptops and servers. Every one of them will need a software upgrade to make them quantum safe, says Jack Hidary, who leads SandboxAQ, an enterprise SaaS company he spun out from Google parent Alphabet that delivers solutions that leverage quantum technologies and AI and run on today’s classical computing platforms. “The sustainability of our financial system and e-commerce, for example, depends on it,” he said in an interview with The Innovator.
The goal of post-quantum cryptography is to develop cryptographic systems that are secure against both quantum and classical computers, and can interoperate with existing communications protocols and networks.
“The message is post quantum crypto relies on math, which means it runs on classical computers and doesn’t need anything quantum for it, says El Kaafarani. “It is a drop-in one-to-one replacement of the cryptography we have been using.”
In June 2015, El Kaafarani moved from Hewlett-Packard Labs to Oxford University’s Mathematical Institute to start a Post-Quantum Cryptography project. A short time later NIST announced that was starting work on standardizing Post-Quantum Cryptography, making it clear that having a fully-functioning, fault tolerant, quantum computer is no longer out of reach.
The idea for PQShield came to him over the next three years while observing how businesses were not doing enough to be ready for this monumental change, he says. PQShield officially launched in May 2018 with the help Oxford’s Mathematical Institute, Oxford University Innovation and Oxford Sciences Innovation. It has been working with NIST on standards since its inception.
PQShield offers “an end-to-end solution in terms of hardware and software” and can additionally evaluate “what else a company can improve in its security architecture,” El Kaafarani says. A key differentiator is that some of its researchers and engineers are taking an active role in the development of the NIST post-quantum cryptography standardization process.
PQShield’s contributions have been adopted as the first standard for a full suite of public key encryption and digital signatures.
“We co-developed and co-designed the algorithms in collaboration with great researchers and engineers and the wider cryptography/security community analyzed them,” says El Kaafarani.“That is why there is confidence in these algorithms, they were scrutinized by the global cryptography community for six years.”
The next step is to draft a document that defines everything about the algorithms but NIST’s work is not finished. The goal is to adopt more than one suite of algorithms as standards so that if one set is eventually cracked there will be others from different math fields to fall back on, he says.
“Work on the transition does not have to wait for full NIST standards, as hybrid cryptography allows practitioners to safely deploy quantum resistant schemes without comprising security levels,” concludes a May 12 article in Nature authored by Sandbox AI’s Hidary and nine other industry experts. The article recommends that work on the transition to post quantum computing begin as soon as possible and that companies experiment with different families of post quantum computing algorithms.
This article is content that would normally only be available to subscribers. Sign up for a four-week free trial to see what you have been missing.
To read more of The Innovator’s Deep Dives click here
