It's Time Security Teams Begin Prep for Quantum Computing

It seems that every week new news breaks regarding the progress toward reaching practical quantum computing. While this is excellent news for the promised benefits quantum computing will provide, it helps society tackle the biggest problems in computing that traditional computers just can't handle. These include potential breakthroughs in artificial intelligence, the complex modeling involved in nuclear fusion, improved solar cells, cancer, and disease treatments, and financial markets modeling.

Yet, the most significant impact for security professionals will be quantum computing's impact on cryptography and how quantum computers will render many of the cryptographic algorithms used throughout the enterprise today obsolete. For instance, widely used public-key cryptography schemes depend on the inability of "classical" computing to solve prime factors in huge integers. However, for a fully functioning and powerful quantum computer, it will be quite feasible.

Many security managers and CIOs make a mistake thinking quantum computing is so far off that it's not worth their worry. But news about advancements keeps coming. Just last week, global investment banker Goldman Sachs made it known that it had been working with Silicon Valley firm QC Ware for some years to begin solving complex market calculations within a handful of years.

Quantum computing and its impact on enterprise security are coming a lot more quickly than most anticipated.

Building quantum resilient algorithms

When it comes to protecting enterprise data from the powerful computing power of quantum targeted at traditional encryption schemes, all is not without hope. But there's not a lot of time for standards bodies, governments, and end-user organizations to get done what needs to get done before the day of practical quantum computing arrives. The first order of business, and one well underway by such organizations as the US's National Institute of Standards and Technology (NIST), is developing post-quantum cryptographic algorithms that are resilient against attacks based on quantum computing.

Of course, developing post-quantum cryptographic algorithms is just the beginning. These protocols need infrastructures in place; they need to be implemented within new and existing business technology and security systems. Enterprises, for their part, need to inventory all of their systems dependent on at-risk cryptography schemes and determine if they can upgrade those systems with new schemes or if they will need to be replaced when quantum computing arrives. They also need to start thinking about upgrade paths for new products as they are acquired.

While it may be some time before powerful quantum computers are available to typical online adversaries, nation-states and organizations closely aligned with nation-states will likely be the first to have such capabilities. NIST and the National Cybersecurity Center of Excellence are on the case. Late last month, they released their paper, Getting Ready for Post-Quantum Cryptography: Exploring Challenges Associated with Adopting and Using Post-Quantum Cryptographic Algorithms.

Steps enterprises can begin taking to build resiliency now

When quantum computers do arrive that can solve prime factors in huge integers, all stored keys throughout the enterprise will need to be replaced with (hopefully) keys resistant to quantum attacks. Also, old data backups will need to be securely wiped or re-encrypted. Once it arrives, there's no way enterprises can fully trust not only the confidentiality of their stored encrypted data, but they also can't trust the integrity of that data, either, as there would be nothing to stop adversaries from manipulating that data.

"Integrity and sources of information will become unreliable unless they are processed or encapsulated (such as being re-signed or timestamped) using a mechanism that is not vulnerable to quantum computing-based attacks," the NIST report warns. Also, if an adversary managed to steal a copy of previously encrypted data, there's nothing enterprises can do to stop that data from being exposed.

Fortunately, there's been a lot of work completed in the race to develop crypto algorithms that will help ensure those fears don't become a reality. And more work is currently underway. However, because no one understands quantum computing's impact or ultimate capabilities, it's not entirely clear what algorithms will be resilient against the encryption-cracking powers of quantum computing.

Still, according to NIST and the NCCoE, there are many things enterprises can do to prepare for the upcoming impact of post-quantum cryptography on encryption.

The first is for enterprises to identify where in their organization they have algorithms that are at risk and that will require some type of remediating action, which will include not only security tools and products but also those in use by their service providers and software and hardware used elsewhere in the organization. To identify those encryption schemes that will be at risk, enterprises should monitor encryption standards bodies and related organizations who will be busily identifying and publishing such at-risk schemes.

Some of the standards organizations enterprises should monitor include the Internet Engineering Task Force, the International Organization for Standardization/International Electrotechnical Commission, the American National Standards Institute/International Committee for Information Technology Standards, the Trusted Computing Group, and others.

The successful transition to quantum will require public-private cooperation

For its part, the private industry will have to create tools that help enterprises identify where their at-risk cryptographic systems are being used within their organization and inventory those systems. Once that's determined, enterprises will have to figure out how, or even if, those cryptographic systems can be replaced.

For most organizations, none of that is going to be easy. It will require vendors to work closely with their customers and keep them advised of roadmaps to update encryption and keep customers appraised of the update path: are there limits to key sizes within the products? Are there limiting throughput thresholds? Does the current implementation support the ability to upgrade crypto? Can the device's crypto be upgraded with software, or will it require a hardware replacement?

This inventorying of systems and reaching out to vendors could take years. That means enterprises will have to get ready for post-quantum encryption risks, identify what encryption algorithms they have in use within their inorganization, and then develop a migration path for those algorithms or replace systems dependent on those algorithms entirely. Enterprises will ultimately have to weigh the value of those systems, the weight and sensitivity of affected data, and take the appropriate steps to remediate.

While no one knows when quantum computing will be capable of breaking today's commonly deployed crypto, enterprises are certainly better off being prepared ahead of time rather than find the quantum computing breakthrough arrive. They have little idea about how to move forward and protect their systems from compromise. Because when it does come, all data protected by today's commonly deployed crypto will be exposed.