www.informationweek.com
John Edwards, Technology Journalist & AuthorJanuary 30, 20255 Min ReadBartlomiej Wroblewski via Alamy Stock PhotoA growing number of security experts are warning that quantum computing might soon devastate existing cryptographic systems, leading to a security crisis that could devastate businesses and governments worldwide.Researchers and other security experts are drawing a direct parallel between the pending quantum security danger and the notorious Y2K threat, only on a much larger scale. In essence, the current basic and widely-used encryption mechanisms, such as factorization-based cryptography, are highly vulnerable to quantum computings processing power.AvalancheThe major security issue is the ability of quantum computers to rapidly break cryptographic algorithms, which are used in multiple security architectures and products, says Doug Saylors, partner and cybersecurity lead, with global technology research and advisory firm ISG. He notes in an email interview that modern cryptography is easily broken by quantum computing. As a result, file encryption becomes completely worthless. "Imagine every private conversation, every strategic plan, every forecast or product under development, all out in the open for public consumption, from competitors to suppliers to partners," Saylors states. The reputation damage alone, he believes, "could be bankruptcy-inducing."Related:Cryptographers have demonstrated that quantum computers can break asymmetric encryption algorithms, such as RSA and ECC, which are widely used for secure communication and digital signatures, says Archana Ramamoorthy, senior director, regulated and trusted cloud, at Google Cloud. This vulnerability can enable attacks, such as 'store now, decrypt later'. "As a result, the longevity of hardware firmware signatures generated by similar asymmetric encryption algorithms is also threatened," she warns in an online interview. "In contrast, symmetric cryptography appears less vulnerable to quantum attacks."Everybody KnowsQuantum security's biggest challenge is identifying the exact date on which a solution will be needed, says Tom Patterson, quantum security global lead at business advisory firm Accenture, in an email interview. "Unlike Y2K, when we knew exactly when it would happen, but we didnt know what would happen, with QDAY we know exactly what will happen and what to do about it, but we're not sure if it's needed in a day or a decade." The challenge for IT and security leaders today, he adds, "is where to slot quantum security into their five-year plan, and how best to get started today."Responding to the threat quantum computing poses to current asymmetric algorithms, leading organizations, including the U.S. National Institute for Science and Technologies (NIST), are now working with researchers worldwide to create and test cryptographic algorithms that are resistant to the power of quantum computers. "The aim is to standardize these quantum-resistant algorithms and complete a thorough crypto analysis," Ramamoorthy says.Related:According to Ramamoorthy, NIST has already endorsed three quantum-safe algorithms, based on extensive research and analysis by the global cryptographic community: FIPS 203, FIPS 204 and FIPS 205. "These algorithms address key exchange for secure communications and digital hashes used in various cryptographic operations," she says, adding that NIST is also considering additional algorithms to further bolster the security of digital certificates. "This ongoing work is crucial to safeguarding the privacy and security of our digital lives and ensuring that our communications remain confidential and protected."The FutureThe solution side of quantum security is advancing even faster than quantum computers themselves, Patterson observes. "We now have the first of many new NIST encryption standards that aren't susceptible to a quantum computing decryption attack, which is great progress and great news." He adds that "crypto agility, a data encryption practice used to ensure a rapid response to a cryptographic threat, is gaining traction, helping enterprises to actively manage new NIST standards as they appear.Related:There are also advances being made in using quantum information science itself to defend against quantum computing attacks. With new research, development, and early deployments of quantum key distribution (QKD), a secure communication method that implements a cryptographic protocol incorporating components of quantum mechanics which, when perfected, will provide a way to exchange keys anywhere without fear of compromise, the future looks far from hopeless.Closing TimeQuantum security is a good-news story in that there are already solutions to mitigate the critical new risk, Patterson says. He believes that upgrading old and vulnerable encryption methods early will help enterprises save time and money while lowering current and future risks. "While there's a cost to do the upgrade, running on the latest secure encryption is no more expensive than running old vulnerable encryption, so it's good from a budgeting perspective as well."The light at the end of the tunnel is the fact that quantum computing can be used to defend against quantum attacks, and researchers are already beginning to catalog presumed attack vectors and design countermeasures, Saylors says. "We're still three to five years out from the potential for an attack, but quantum-based countermeasures could prevent the attack from spreading to other organizations."About the AuthorJohn EdwardsTechnology Journalist & AuthorJohn Edwards is a veteran business technology journalist. His work has appeared in The New York Times, The Washington Post, and numerous business and technology publications, including Computerworld, CFO Magazine, IBM Data Management Magazine, RFID Journal, and Electronic Design. He has also written columns for The Economist's Business Intelligence Unit and PricewaterhouseCoopers' Communications Direct. John has authored several books on business technology topics. His work began appearing online as early as 1983. Throughout the 1980s and 90s, he wrote daily news and feature articles for both the CompuServe and Prodigy online services. His "Behind the Screens" commentaries made him the world's first known professional blogger.See more from John EdwardsNever Miss a Beat: Get a snapshot of the issues affecting the IT industry straight to your inbox.SIGN-UPYou May Also LikeWebinarsMore WebinarsReportsMore Reports