Post-Quantum Cryptography: Stay Calm. Keep Encrypting. In NIST we Trust.

Marco Essomba

Founder & CTO @ BlockAPT | Cybersecurity Expert

Introduction

The potential power of quantum computers to break current encryption algorithms is well documented. The power of quantum computers could bring huge benefits to the way our digital communications are secured today and in the future. At the same time, there is also a huge risk because of the way quantum computers could be used by cybercriminals and various threats actors to break today’s classical encryption algorithms and protocols.
Access to practical quantum computers will pose a significant threat to the way we protect data at rest and data in motion. This is because the existing protocols and algorithms that we rely on to protect our digital communications will be at risk against the sheer brute force of quantum computers. This risk is not just limited to our existing digital communications on the Internet but would seriously undermine the confidentiality and integrity of any system relying on existing classical cryptographic algorithms.

But is it time to panic?

Let’s start with the basics: what is quantum security?

At the fundamental level, quantum computers rely on quantum mechanics principles to create a computation system that can perform calculations using qubits or quantum bits. Unlike bits used in classical computers which can have a state of one or zero, qubits can exist in multiple states simultaneously, allowing it to perform certain tasks faster than classical computers.

The order of magnitude is significant. For certain types of operations, for example cryptography operations that would take a classical computer years to complete, can be completed in seconds in a quantum computer. It is this tremendous power of quantum computers that poses a significant threat to the way we protect digital communications today, not just on the Internet but to any secure digital communications system.

Let’s start with the basics: why do quantum computers pose a threat to our current entire digital security infrastructure?

Today’s digital communications rely on encryption to protect data at rest and data in motion against unauthorised access by threat actors.

Encryption relies on complex mathematics to protect sensitive electronic information, including our day to day use on the Internet to access our online banking securely for example. The key assumption is made that current encryption algorithms rely on maths problems that cannot be solved by even the fastest classical computers, ensuring that our digital communications are inaccessible to unwanted third parties or threats actors.

Encryption algorithms provide a mechanism to transform “clear text” into “code” often referred to as cipher. The cipher can only be unlocked, deciphered or decrypted, by a person or a system that has the relevant key.
The key can be a selected number of combined characters that are usually a long complex combination of letters, numbers, and symbols that can be used to encrypt or decrypt a message. Hence, the process of finding a key can be time consuming and complex requiring significant computational operations.

Classical computers are ill suited for these types of computational operations. However, quantum computers have the significant advantage to tackle types of operations because of their ability to perform calculations using qubits or quantum bits. It is this power that renders any classical encryption algorithms at risk against quantum computers.

Stay calm. NIST is on it.

The National Institute of Standards and Technology (NIST) is a global body that is focusing on developing and guiding the brightest minds in cybersecurity around the world to focus on this challenge head on by improving existing standards and by also developing a new set of protocols that will be quantum resistant whilst remaining applicable to protect against classical computers attacks.

Using its global network of cyber security experts, NIST initiated a worldwide competition to research and develop quantum-resistant cryptographic algorithms.
NIST is looking to develop quantum-resistant cryptography systems that will be interoperable to secure both quantum and classical computers without changing the underlying protocols and standards of our existing digital communications infrastructure.

It’s a matter of when. Not if.

When will a large-scale quantum computer be built and deployed at scale? This is subject to many debates. The recent advancement and breakthroughs in quantum physics have significantly increased the confidence of a physical large scale quantum computer. Some estimate that within ten to twenty years quantum computers will be significantly advanced and accessible to break all public key schemes and algorithms that we currently use to secure our daily digital communications.

If we take into account the transition phase required to upgrade our existing digital communications infrastructure which may take a decade or more to be upgraded, it is clear that we must begin to prepare today.

Stay calm. Keep encrypting.

NIST’s recommendation is clear. Keep encrypting as before following recommended guidelines. Whilst algorithms are being developed and standardisation is currently in progress for one or more quantum-resistant public-key cryptographic and signatures algorithms, the short term solution for organisations is to continue to follow best practices in classical encryption’s methods.

There are several post-quantum software and hardware solutions available today in the market, however, rigorous testing is required before these solutions can be implemented at scale. It will take time before these solutions become the norm.

NIST – Proposed Algorithms

NIST has proposed two main algorithms that can be used for general encryption and digital signatures. The focus of general encryption algorithms is to protect any data in motion travelling through a public network. Digital signatures focus on the identification and authentication of digital transactions.

CRYSTALS-Kyber algorithm was selected because it offers small encryption keys that can be exchanged easily with little overhead whilst providing high speed transactions.

CRYSTALS-Dilithium, FALCON and SPHINCS+ were selected for digital signatures. For high efficiency transactions, CRYSTALS-Dilithium is recommended as the primary algorithm, however, for applications that require much more smallest signatures, FALCON is recommended. As a backup, SPHINCS+ is recommended because it is much larger and slower.

Conclusion:

NIST has made significant progress in the development of one or more algorithms and standards designed to withstand cyber attacks that can be unleashed by quantum computers. This process is ongoing and requires a number of iterations, feedback, and testing before the final algorithms are selected. NIST has proposed four algorithms that can withstand the power of quantum computers.

However, as these algorithms are put through their paces in real world digital communications systems, only time will tell how well they can withstand attacks against quantum computers.

Further reading: