One of the biggest challenges surrounding digital technology is securing systems and data. For decades, computer scientists have developed increasingly sophisticated algorithms designed to encrypt data and protect it through frameworks such as public-key cryptography (PKE), which is also known as asymmetric cryptography. Today, these frameworks function relatively well. Billions of transactions and interactions use these algorithms every day.
But storm clouds are looming. As quantum computers advance and creep into the mainstream, they introduce a level of computing power that changes the table stakes. While there are many potential benefits, a major disadvantage is an ability to crack today’s public-key cryptography, including widely used RSA (Rivest–Shamir–Adleman) and Diffie-Hellman frameworks. This would impact everything from routers and virtual private networks (VPN) to the ability to verify digital signatures.
It’s a fact that hasn’t gone unnoticed. In 2016, the U.S. National Security Agency (NSA) issued an alert and recommended that organizations begin looking at ways to switch to more advanced cryptography. A year later, U.S. National Institute of Standards and Technology (NIST) began soliciting new and more advanced algorithms that could withstand cracking by quantum computers and become a standard.
CRACKING THE CODE
At the heart of the problem is that the typical way to make algorithms more difficult to crack involves adding key lines with more bits. But taking this approach with quantum computers doesn’t produce any real gain. For now, quantum computers lack the processing power to succeed in a brute-force assault on classical cryptography algorithms. However, within a few years, once these machines hit a threshold of approximately 10 million physical qubits, they will possess this power.
The risk is palpable for businesses, universities, governments, and more. If quantum computers crack PKE algorithms, more than just devices would be affected. It could expose historical data residing inside organizations. Consequently, mathematicians and computer scientists are developing new and far more advanced cryptographic algorithms that use both classical and lattice-based frameworks. The former relies on non-compact code; the latter uses mathematical formulae or proofs to ensure the integrity of the algorithm. In fact, lattice-based algorithms are part of a broader move toward formal (verified) software.
At present, NIST has narrowed the number of next-generation algorithms to 15. The group of researchers and computer scientists involved with the project continue to test, refine, and update the algorithms to balance speed and security requirements. Within the next year or two, NIST is expected to finalize new standards. This won’t encompass all quantum-resistant algorithms in the future—others could develop algorithms outside the standard—but it’s safe to say that this set of algorithms will be widely used in industry and government.
SECURING THE FUTURE
There are also benefits arising out of this research and the NIST project. For example, more advanced homomorphic encryption will allow data scientists and analytics to study data without having to decrypt it. The technique is already used on a niche basis (Microsoft, for example, has introduced a voting system that uses the technology), but more advanced algorithms would allow it to flourish—and become a powerful tool in the AI and data analytics arsenal.
For now, organizations can prepare for this next phase of cryptography by staying tuned to the NIST initiative and keeping an eye on breaking news in the field. It’s not too early to begin assessing systems, devices, and more, as well as determining when and where quantum-proof algorithms make sense. In many cases, organizations will need to update certificate-management frameworks, devices, and software to support new algorithms. Currently, it’s also a good idea to upgrade older systems to 256-bit keys in order to maximize data protection.
Fortunately, symmetric-key cryptography (which relies on private keys) isn’t as susceptible to being cracked by quantum computing, and it isn’t considered a risk for now. Of course, it’s impossible to rely on symmetric crypto to handle many of the interactions and transactions that take place in today’s computing environment. So, once quantum-safe algorithms appear, it’s wise to migrate to them as soon as possible.