Preparing Today for the Encryption Challenges of Tomorrow
Earlier this month, the National Institute of Standards and Technology (NIST) made a groundbreaking announcement, publishing its final recommendations for algorithms deemed secure against the emerging threat of quantum computing. These 'post-quantum' algorithms are expected to provide robust protection in the short-to-medium term. However, long-term security remains uncertain, as it is based on significant, untested assumptions. We must stay vigilant and prepare for potential vulnerabilities.
Emerging Threat
Encryption is categorized into two types: 'symmetric' and 'asymmetric.' Asymmetric encryption is the backbone of most internet security protocols, safeguarding everything from private messaging to online banking. The security of these algorithms hinges on the difficulty of performing certain mathematical computations. Quantum computers, however, have the potential to efficiently execute these calculations, thereby compromising the integrity of current asymmetric encryption. As a result, there has been a hunt for new secure encryption solutions against quantum computers.
Recognizing this threat, the global cryptographic community has been in pursuit of new encryption solutions that can withstand the power of quantum computing. On August 13, 2024, NIST announced three standards for post-quantum secure algorithms. As the leading authority on cybersecurity standards, NIST’s announcement is a major milestone for global security. This marks the culmination of a rigorous competition that began in 2017, where 82 algorithms proposed by cryptographers worldwide underwent extensive analysis. After multiple rounds of testing, only three algorithms remained resilient and performant enough to shape the future of internet security.
Evaluating the Quantum Threat
Quantum computers operate on principles such as superposition and entanglement, allowing them to perform calculations far beyond the reach of conventional computers. To date, two quantum algorithms, Shor’s algorithm (1994) and Grover’s algorithm (1996), have been identified as cryptographically relevant. Shor’s algorithm demonstrates that the mathematical foundations of asymmetric cryptography can be efficiently solved, rendering them insecure. Grover’s algorithm, on the other hand, can significantly accelerate brute-force attacks on symmetric cryptography.
The implications of these algorithms are profound. If implemented, they could fundamentally disrupt information security as we know it. However, the development of quantum computers capable of running these algorithms remains uncertain. Such a device would require thousands of qubits, which in turn would necessitate millions of physical qubits and billions of operations. While the largest quantum device currently controls 1,120 qubits, the race to scale these systems is intensifying, with over $55 billion invested globally in this endeavor. The timeline for achieving a cryptographically relevant quantum computer is unclear—it could be decades away or as soon as 2030.
Post-Quantum Security
In response to this looming threat, the global cryptographic community has focused on developing new algorithms based on different mathematical problems. The announcement of NIST’s standards for post-quantum cryptography (PQC) is a critical step for our security infrastructure. However, there is an important caveat: the security of these algorithms has only been evaluated against known attacks. This is particularly concerning given that quantum computing is still in its early stages.
The first cryptographically relevant quantum computer has yet to be built and is likely some way off. Our understanding of its capabilities will likely evolve as quantum computing technology advances. Given NIST’s seven-year post-quantum cryptography search (and likely multi-decade rollout), it may well be that advances in quantum cryptanalysis out-pace encryption standards.
Historically, encryption standards have evolved alongside improvements in classical computing. However, we cannot afford to rely on the same reactive approach with quantum computing.
Secure Quantum Communication
An alternative approach to mitigating the quantum threat is Quantum Key Distribution (QKD). QKD uses quantum information to securely share secret keys for symmetric cryptography, instead of relying on asymmetric encryption techniques. QKD has the benefit that it is secure against any attack by a quantum-enabled adversary, including unknown attacks. In this way, QKD offers truly future-proof security.
However, QKD is not without its limitations. It is primarily effective for encryption—a small subset of modern cryptography—and requires highly specialized equipment, such as single-photon detectors, which are challenging to deploy across commercial networks. Nevertheless, for institutions where compromised security poses significant risks, such as governments, militaries, and critical infrastructure providers, QKD presents a valuable solution.
At Rhea Space Activity (RSA), we are at the forefront of QKD technology, developing free-space QKD solutions to ensure highly secure communication even in the presence of optical noise. Our secure quantum communications module, the Quantum Lovelace Optical Communication Kit (QLOAK), is designed to integrate seamlessly with existing optical communication terminals and operate effectively in daylight, coexisting with laser communication signals.
Securing Our Future
NIST’s announcement of post-quantum secure algorithms is a critical milestone in preparing for the arrival of cryptographically relevant quantum computers. While these algorithms provide a robust defense for the near term, the rapid pace of quantum computing advancements necessitates ongoing vigilance and innovation.
The migration to post-quantum encryption standards is not only a technical challenge but also a massive logistical and financial undertaking. NIST recommends setting a goal of 2035 to complete the global transition to these new encryption types. This timeline underscores the urgency of the task, as it could take well over a decade and require significant financial resources. For example, a recent report from the White House’s Office of Management and Budget estimates the total government-wide cost required to perform a migration from 2025 and 2035 will be approximately $7.1 billion. The longer this transition takes, the more advanced quantum computers will become, increasing the risk that even these new encryption standards may be rendered obsolete.
The time to integrate quantum encryption is now; delaying this effort could leave global systems vulnerable just as the quantum threat becomes a reality. Should future quantum computers prove capable of breaking these algorithms, we may find ourselves needing to embark on another costly and time-consuming migration, with the same 10-year horizon and untold billions required to secure global systems once again. Rhea Space Activity is committed to pushing the boundaries of secure quantum communication, today.
Opmerkingen