Dr. Ash Rossiter

Cybersecurity is a fundamental and growing part of what it means for us to be safe. Emerging technologies pose significant threats to cybersecurity protocols that protect digital communications and sensitive data. Recently, the focus of concern has been on artificial intelligence (AI) and its potential to facilitate ever more sophisticated scams. A more concerning risk over the longer term, however, comes from quantum computing.<a href="about:blank" rel="noopener noreferrer" target="_blank">[1]</a>One of the most fundamental pillars of cybersecurity is cryptography. Because of quantum computers’ superior computational power, various cryptographic ciphers may become obsolete and hackable. Recent headlines claiming that Chinese scientists have hacked "military-grade encryption" using quantum computers have sparked panic and speculation about the future of cybersecurity.<a href="about:blank" rel="noopener noreferrer" target="_blank">[2]</a> It is important to remember that the media often seeks out sensational stories. To be sure, the prospect of quantum computers cracking sophisticated encryption algorithms makes for dramatic headlines, but is this based in reality?The remainder of this paper provides an overview of developments in quantum computing and especially how it relates to cyber security. It argues that while quantum computing has latent potential to revolutionize encryption/decryption it will be some years before this threatens current cryptographic methods. In the meantime, there are actions that those charged with securing sensitive data can take to prepare for encryption in the quantum age. On the technology readiness level scale, quantum computing is still largely in the developmental stage. Rapid advances in recent years, however, do mean we could see commercially viable machines emerge in the not-too-distant future. While digital computers store data as bits (the ones and zeros of binary), quantum computers use qubits that exist as a one, zero, or both at the same time. This superposition state creates a practically infinite range of possibilities, allowing for incredibly fast simultaneous and parallel calculations.With that level of processing power available, quantum computers have the potential to bypass the encryption locks that currently protect the world’s communications and data. It is estimated that, in the next 15 years, quantum computers will be sufficiently functional to easily break current strong public-key cryptosystems.According to some commentators, Rivest–Shamir–Adleman (RSA)<a href="about:blank" rel="noopener noreferrer" target="_blank">[3]</a> encryption, a public-key cryptosystem that is widely used from everything from online banking to secure communications, is on the verge of collapse due to new quantum breakthroughs.<a href="about:blank" rel="noopener noreferrer" target="_blank">[4]</a>Breaking RSA encryption using quantum computers remains a possibility that drives ongoing research. Indeed, quantum computing has long been touted as a potential threat to RSA encryption due to algorithms like Shor’s, which, in theory, can factor large numbers exponentially faster than classical algorithms. However, computers would require thousands or even millions of qubits with low error rates—a technological milestone that is still years, if not decades, away. Moreover, military-grade encryption, which typically involves algorithms like the Advanced Encryption Standard (AES), would require orders of magnitude more computing power to break.News stories misrepresenting current quantum annealing capabilities as breaking military-grade encryption are not only inaccurate, but they damage the credibility of the field. As Duncan Jones, head of cybersecurity at&nbsp;Quantinuum, a leading quantum computing company, says: "If you were the Chinese military and you had just broken AES, media coverage wouldn't be on your priority list. Instead, you would maximize your informational advantage, without revealing you’ve broken a critical global cipher."<a href="about:blank" rel="noopener noreferrer" target="_blank">[5]</a>Researchers continue to explore quantum-resistant cryptographic algorithms, known as post-quantum cryptography. These algorithms are designed to be secure against both classical and quantum attacks, ensuring the longevity of digital security in a future where powerful quantum computers may exist.In an announcement on 21 February 2024, Apple unveiled what it called, "a groundbreaking&nbsp;post-quantum cryptographic protocol." Apple claims its system, PQ3, offers protection of data sent over its iMessage platform against "even highly sophisticated quantum attacks."<a href="about:blank" rel="noopener noreferrer" target="_blank">[6]</a> Moreover, improvements in Quantum Key Distribution (QKD),&nbsp;a secure communication method for exchanging encryption keys only known between shared parties, aim to harness the power of quantum technology to protect data.Organizations need to immediately begin applying diligence in the expectation of a post-quantum age.<a href="about:blank" rel="noopener noreferrer" target="_blank">[7]</a> In 2022, a U.S. law was passed that requires government agencies to act in using post-quantum cryptography.<a href="about:blank" rel="noopener noreferrer" target="_blank">[8]</a> The amount of time that data must remain secure, plus the time it takes to upgrade cryptographic systems, could be greater than the time when quantum computers develop enough power to break cryptography. If that is the case, secrets and sensitive data will be exposed for exploitation. In conclusion, while recent advancements in quantum computing are impressive, the progress represents incremental steps rather than paradigm-shifting breakthroughs. Current cryptographic systems like RSA have not yet been rendered obsolete and neither are they likely to be in the short term. Nonetheless, it is critical that governments and companies introduce post-quantum encryption now to protect against what is known as "harvest now, decrypt later" attacks. This refers to when hostile cyber actors collect masses of data with the intention of decrypting it later when the technology becomes available. Harnessing the power of quantum mechanics in large-scale quantum computers will give us the means to solve many valuable problems for humanity. It is crucial, however, that we take early action to remove the risk from the catastrophic impact of breaking cybersecurity before quantum computers arrive.<a href="about:blank" rel="noopener noreferrer" target="_blank">[9]</a> &nbsp;References:<a href="about:blank" rel="noopener noreferrer" target="_blank">[1]</a> Michele Mosca, "Cybersecurity in an Era with Quantum Computers: Will we be Ready?&nbsp;IEEE Security &amp; Privacy,&nbsp;16(5) (2018), pp. 38-41.<a href="about:blank" rel="noopener noreferrer" target="_blank">[2]</a> An article in South China Morning Post claims that the breakthrough poses a real and substantial threat to the long-standing password-protection mechanism employed across critical sectors, including banking and the military. See Zhang Tong, "Chinese scientists hack encryption in quantum computer experiment: paper," South China Morning Post, 11 October 2024, <a href="https://www.scmp.com/news/china/science/article/3282051/chinese-scientists-hack-military-grade-encryption-quantum-computer-paper" rel="noopener noreferrer" target="_blank">https://www.scmp.com/news/china/science/article/3282051/chinese-scientists-hack-military-grade-encryption-quantum-computer-paper</a>. <a href="about:blank" rel="noopener noreferrer" target="_blank">[3]</a> Named after its inventors, RSA security relies on the computational difficulty of factoring large prime numbers—a task that is feasible for small numbers but becomes exponentially harder as the numbers grow larger.<a href="about:blank" rel="noopener noreferrer" target="_blank">[4]</a> The minimum recommended RSA key size is currently between 2048 and 4096 bits (depending on the sort of information to be protected), since 768- and 1024-bit RSA implementations were broken around 2010.<a href="about:blank" rel="noopener noreferrer" target="_blank">[5]</a> Quoted in Craig S. Smith, "Debunking Hype: China Hasn’t Broken Military Encryption with Quantum," Forbes, 16 October 2024, <a href="https://www.forbes.com/sites/craigsmith/2024/10/16/department-of-anti-hype-no-china-hasnt-broken-military-encryption-with-quantum-computers/" rel="noopener noreferrer" target="_blank">https://www.forbes.com/sites/craigsmith/2024/10/16/department-of-anti-hype-no-china-hasnt-broken-military-encryption-with-quantum-computers/</a>. <a href="about:blank" rel="noopener noreferrer" target="_blank">[6]</a> Apple Security Engineering and Architecture (SEAR), "iMessage with PQ3: The new state of the art in quantum-secure messaging at scale," Blog post, 21 February 2024, https://security.apple.com/blog/ime ssage-pq3/ <a href="about:blank" rel="noopener noreferrer" target="_blank">[7]</a> KPMG, "Quantum is Coming — And Bringing New Cybersecurity Threats With It," KPMG: Our Insights (2024), <a href="https://kpmg.com/xx/en/our-insights/ai-and-technology/quantum-and-cybersecurity.html" rel="noopener noreferrer" target="_blank">https://kpmg.com/xx/en/our-insights/ai-and-technology/quantum-and-cybersecurity.html</a>. <a href="about:blank" rel="noopener noreferrer" target="_blank">[8]</a> The&nbsp;Quantum Computing Cybersecurity Preparedness Act 2022, advising US federal organizations to prepare now for a post-quantum cybersecurity (PQC) world.<a href="about:blank" rel="noopener noreferrer" target="_blank">[9]</a> Mosca, op. cit., p. 40.

Will Quantum Computing "Break" Cybersecurity?