Cybersecurity in the Age of Quantum Computing: The Top Ten Considerations for a Crypto-Agile Solution

From IC Insider Thales Trusted Cyber Technologies

by Bill Becker, CTO, Thales TCT

The public sector is making considerable investments in quantum computing technology, but so are hackers. As the technology becomes more widely accepted, it opens up the possibility of more rapid attacks and a threat to public key cryptography. Once that is broken, the nation’s critical infrastructure becomes exposed to substantial damage.

Consequently, it’s essential for federal agencies to adopt a position of “crypto-agility,” to ensure that their encryption solutions can stand up against new and faster attacks in the age of the quantum computer.

In this article, we’ll look at the background of quantum computing in government, technologies to mitigate quantum attacks, and the top ten considerations for a truly crypto-agile solution. Together, this should provide a baseline understanding of how we’ve come to this point, and where we need to go to protect the nation’s infrastructure from the potential threats posed by bad actors with access to quantum technology.

Preparing for leadership, but not necessarily for cyber defense

The history of quantum computing in the federal sector is actually quite brief. The National Quantum Initiative Act, introduced in 2018, was designed to ensure the continued leadership of the United States in quantum information science and applications of the technology. The Act calls for a coordinated federal program to accelerate quantum research and development for the economic and national security of the United States. The strategy for United States quantum R&D is described in the National Strategic Overview for QIS.

To underscore its goal of quantum leadership, the U.S. government is making major investments in the technology. In 2020, the Department of Energy invested $625 million into multidisciplinary Quantum Information Science Research Centers to support the National Quantum Initiative. The US Army Research Office funds extensive research in quantum computing, and the US Air Force considers the technology capable of transforming information and space warfare.

But for all the investment in quantum technology, it’s questionable as to whether cybersecurity is taking an equal share of the focus. In a February 2022 report issued by Dimensional Research, more than 600 cybersecurity professionals across industry and government were surveyed about their readiness for quantum attacks on cyber encryption. According to the findings, 75% believe that quantum attacks will defeat current encryption. Despite that belief, only 13% were reported to have purchased products to fight the threat.

Preparedness against quantum-based attacks is clearly a challenge that hasn’t been adequately addressed. Only 21% of the security professionals polled felt prepared for advancing encryption attacks; some 38% believe their organizations will be ready within the next two years.

That two-year window prediction is a good thing. Most survey respondents also believe that advancing quantum technologies will break current encryption standards within the next two years.

It seems to be a race to determine what happens first: cyber protection or cyber defeat.

The reason for quantum-safe cybersecurity

While classical computers code information into bits, sending electrical or optical pulses representing 1s and 0s (a binary code), quantum computers use quantum bits (known as qubits). These qubits, typically subatomic particles such as electrons or photons, can store information as 1s, 0s or anywhere between these values, due to a principle known as superposition. Because qubits can store more information than bits, the computational power of quantum technology is exponentially greater.

So too is its potential to do harm. The same computing power that allows complex problems to be solved can, in turn, be applied to undermine cybersecurity. That’s a threat to public key cryptography in particular – if that is broken, critical infrastructure, banking systems and more are vulnerable to attack.

It’s not unlikely, therefore, that quantum computing might render today’s cryptographic systems useless. By some estimates, quantum computers will exist outside the lab in around five years’ time. Consequently, IT and cybersecurity professionals must be ready with cybersecurity measures to protect critical infrastructure and sensitive data from this new vector of attack.

At present, there are three main types of technologies available to mitigate the risks of quantum attacks (further advances are likely to arrive on the scene in the near future).:

1. Quantum Random Number Generation (QRNG). When generating cryptographic keys that are used to encrypt/decrypt data, it is crucial that numbers are seeded from a source that is not vulnerable to bias, or easy to predict.

This randomness is already an essential part of cryptography. It will become more important still in the quantum era, as computers begin to ascertain patterns in a fraction of the time they do today. Pseudo Random Number Generators (PRNG) – which use inputs from the environment around them, such as a system clock or keyboard strokes – will simply not be random enough.

By comparison, QRNG provides high entropy, generating a true source of randomness by leveraging principals from quantum physics. This approach fires photons (particles of light) at a semi-transparent mirror, assigning them a value of 0 or 1, depending on whether they are absorbed or reflected.

Because these photons will behave completely randomly, there is no pattern to be observed as seeds are being generated.

2. Quantum Key Distribution (QKD). Once keys are generated, they must be distributed in a way that guarantees forward secrecy, and thus data integrity.

QKD distributes keys via photons across an optical link. The technology uses a property of quantum physics known as the “observer effect” to verify the security and authenticity of these distributed keys.

This principle states that, in quantum physics, observation causes perturbation. If a photon in transit were to be intercepted, the act of observing the particle would cause it to collapse into its final state.

What that means is, if a cybercriminal attempted to intercept a key being carried using QKD (for example, by wiretap), an alert would go out to the intended recipient that they key had been observed or tampered with, and therefore was not safe to use. The sender and recipient then have the opportunity to generate a new key before any sensitive data is transmitted using the compromised one.

3. Quantum Resistant Algorithms (QRA). QRAs are algorithms designed to remain secure in a post-quantum world.

In 2016, the National Institute of Science and Technology (NIST) acknowledged the importance of such algorithms and called for a public submission of post-quantum algorithms. In 2019, NIST announced that 26 of the 69 submissions “made the cut.” Seven of these submissions, of which three are signature schemes, advanced to the third round, in an announcement made July 22, 2020.

NIST hopes to publish standardization documents by 2024, but may speed up the process if major breakthroughs in quantum technologies become available.

Once standardized, current encryption algorithms will need to be replaced with these new quantum-resistant algorithms. This will require an update to all software and hardware devices that use Public Key encryption globally.

The types of algorithms evaluated by NIST can broadly be fitted into three categories:

1. Lattice cryptosystems. These systems are built using geometric structures known as lattices and are represented using mathematical arrays known as matrices.
2. Code-based systems. These use error-correcting codes, and have been part of information security for decades, including public key encryption and digital signature schemes.
3. Multivariate systems. These depend on the difficulty of solving a system of quadratic polynomial equations over a finite field.

Rather than looking at these elements individually, a solution to secure against quantum and classical attacks ideally should combine QRNG, QKD and (when available) QRAs.

The top ten components of crypto-agility

As the threat landscape changes because of continued acceptance of quantum computing, organization must adopt an attitude of crypto-agility, and apply that mindset to the solutions they put into practice.

Crypto-agility enables users to quickly react to cryptographic threats by implementing alternative methods of encryption.  Combining high-assurance, end-to-end encryption with a true source of entropy – and a method of key distribution that aids forward secrecy – will ensure your encryption solution is crypto-agile and has the best chance of protecting your systems and data in the looming age of the quantum computer.

That said, here are ten things to keep in mind as you evaluate solutions for their crypto-agile cyber security capabilities:

1. Quantum-ready. A true crypto-agile solution must be future-proof. Long-term data protection in a post-quantum computing world cannot be guaranteed without incorporating Quantum Resistant Algorithms.
2. Symmetric encryption strength. Crypto-agility is not just about future proofing asymmetric cryptography with QRA. Customers using older applications or protocols that make use of AES with 128 bit encryption keys must have the flexibility to transition to 256 bit AES algorithms to counter the emerging quantum threat.
3. Field programmable flexibility. Flexibility is another key component of crypto-agility. Crypto-agile encryption solutions must enable simple after-market customization, without the need to update the hardware. Technology that provides in-field flexibility and ease of management, while reducing the total cost of ownership of hardware devices, allows users to quickly update their devices as new Quantum Resistant Algorithms become available.
4. Algorithm flexibility. The best encryption solutions come with standards-based algorithms and key sizes enabled by default. In some circumstances, however, users may prefer their encryptors to be configured with larger key sizes or emerging algorithms such as the set of Quantum Resistant Algorithms currently being developed.
5. Protocol updates Crypto-agile solutions must not only support updates to use the emerging quantum resistant algorithms, but they also support an upgrade to the new versions of communications protocols that utilize QRA.
6. Policy-based. Flexible deployment must allow simple policies to be set to manage encryption across the network. Truly agile solutions allow such policies to be set based on a variety of criteria, including use case, performance, and security strength.
7. Data sovereignty. To remain compliant with country- and region-specific data protection legislation, it’s important to consider an encryption solution that allows admins to customize algorithm selection and control where data and keys are stored.
8. Key management. Encryption key management is absolutely crucial to cryptography. Crypto- agile solutions include state-of-the-art, zero-touch key management and support both multiple key algorithms and multiple key systems. For added security, the encryption keys are not visible to anyone but the customer.
9. Alternative sources of entropy. A cryptographic system is only as strong as its weakest link. Because strong key generation depends on quality random numbers, entropy sources used to seed random number generators are an important factor in cryptography. Random numbers can be generated from a variety of hardware and software entropy sources. To mitigate the risk of a compromised entropy source, crypto-agile solutions also enable customers to incorporate alternative sources of entropy, such as an external or on-board Quantum Random Number Generator (QRNG).
10. Quantum Enhanced Keys. Using principles of quantum physics, a QRNG chip produces high quality entropy which is the basis for all random numbers and cryptographic keys used in an encryption solutions’ root-of-trust. High entropy and secure key storage addresses critical applications where high quality random numbers are absolutely vital such as: cryptographic services; numerical simulations; cloud; compliance; IoT-scale device authentication; and trusted digital signatures.

The future is coming

IT and cybersecurity professionals must begin to address the quantum computing threat today. It’s a huge undertaking to assess threats, compare vendors and implement a solution, so the time to act is upon us.

Those who don’t take the threat seriously enough and don’t act right away may find themselves unprepared for the quantum age – or, worse yet, under attack with no defense.

About Thales TCT

Thales Trusted Cyber Technologies, a business area of Thales Defense & Security, Inc., protects the most vital data from the core to the cloud to the field. We serve as a trusted, U.S. based source for cyber security solutions for the U.S. Federal Government. Our solutions enable agencies to deploy a holistic data protection ecosystem where data and cryptographic keys are secured and managed, and access and distribution are controlled.

For more information, visit www.thalestct.com

About IC Insiders

IC Insiders is a special sponsored feature that provides deep-dive analysis, interviews with IC leaders, perspective from industry experts, and more. Learn how your company can become an IC Insider.