The Opportunity of Quantum and the Threat of Cybersecurity
In a very real sense, there is a paradox embedded within quantum technology. The same processing power that will enable faster drug discovery, materials science and optimization studies is the very same processing power that may eventually undo the cryptographic systems upon which our digital infrastructure rests. Manahel Thabet acknowledges this dichotomy. She sees it as two sides of the same coin: enormous potential on one side and a significant security issue on the other side that should be
addressed before it becomes critical.
Why Quantum Computing Will Matter to Cryptography
Today’s digital security relies almost entirely on public-key cryptography. Public-key cryptography relies on the fact that certain mathematical problems are exceptionally difficult for traditional computers to solve. Decades ago, Shor’s algorithm demonstrated
that a sufficiently powerful quantum computer could theoretically solve those identical problems efficiently. However, everything hinges on that word “sufficiently”. Currently, no quantum computer has the scale or stability to be cryptographically relevant and therefore capable of breaking the encryption currently being utilized. The threat exists. It is simply not an immediate threat. It is a long-term threat. In addition, that word “someday” does a great deal of heavy lifting in that sentence.
Understanding Post-Quantum Cryptography
PQC, or post-quantum cryptography, refers to new cryptographic algorithms designed specifically to withstand attacks from both classical and quantum machines. Standards organizations have published several PQC algorithms, providing companies with time to
begin migrating their existing cryptographic systems to PQC before they absolutely must. In addition, cryptographic agility, the ability to replace existing encryption methodologies without dismantling and reconstructing an entire system, is becoming increasingly
important.
Harvest Now, Decrypt Later
If anything transforms this from a distant concern into an urgent one, it is Harvest Now, Decrypt Later. An attacker does not require access to a functioning quantum computer today to steal valuable information. An attacker can collect encrypted data today and wait until encryption can be broken. For anything that must remain confidential for years or even decades, financial data, health data, national security data, Harvest Now, Decrypt Later fundamentally alters the equation. Companies cannot wait until cryptographically relevant quantum computers exist before migrating their systems, because by that point, it is too late for any data that has already been collected.
From Quantum Risk to Quantum Readiness
Quantum readiness requires managing this transition as a process, not as a crisis. Practically speaking, this involves identifying where vulnerable cryptography is currently deployed, determining which systems are protecting the longest-lived confidential data,
and developing a migration plan based upon realistic technical assessment rather than speculation.
Leaders Must Prepare Before the Quantum Transition
Manahel Thabet states emphatically that this is not merely an IT department’s problem to resolve. This issue encompasses strategic planning, risk management, governance and long-range planning at the executive level. Those organizations that initiate this process now, before there is any pressure created by an active threat, will be well-positioned when the quantum transition occurs.
