The rapid developments in Quantum Computing prompted a shift towards post-quantum cryptography (PQC). Experts predict that, by as early as 2035, quantum computers will be able to break current encryption systems. Organizations must implement measures to protect data.
The Rise of Quantum Computing
Quantum computers will surpass traditional computers for specific tasks by 2030. Michele Mosca, co-founder of the Institute for Quantum Computing at Canada’s University of Waterloo, estimates a 50% chance of quantum computers breaking standard public-key encryption within 15 years. Industries like finance, healthcare, energy, and transportation face significant risks.
NIST’s PQC standardization
The United States National Institute of Standards and Technology (NIST) has significantly standardized algorithms to resist quantum computer attacks.
NIST has selected two core PQC algorithms (CRYSTALS-Kyber and CRYSTALS-Dilithium) and two backup algorithms (FALCON and SPHINCS+).
- CRYSTALS-Kyber, a key encapsulation mechanism (KEM) algorithm, employs lattice-based cryptography. It offers small key sizes suitable for resource-constrained devices. It is faster than elliptic curves and RSA but has a larger footprint.
- CRYSTALS-Dilithium is a digital signature algorithm superseding DSA, providing secure and efficient signing operations.
- FALCON delivers smaller signatures and public keys, making it suitable for bandwidth-constrained applications.
- SPHINCS+ uses hash-based cryptography, created as a backup in case weaknesses appear in Dilithium, but it has larger signature sizes.
EU’s Quantum readiness
The European Union is addressing post-quantum cryptography by working with Member States and the United States to transition to PQC and exploring quantum cryptography initiatives. The EU’s security and cybersecurity strategies highlight encryption as key for cyber-attack resilience.
The European Quantum Communication Infrastructure Initiative (EuroQCI) aims to safeguard sensitive data using quantum physics. The EU actively participates in the US-led NIST post-quantum cryptography standardization process and funds research for the PQC transition.
Risks under security and privacy laws
Organizations face risks under security and privacy laws due to potential “store now, decrypt later” attacks. Threat actors collect and store encrypted data and plan to decrypt it once they acquire decryption capabilities. Failure to adopt PQC measures may result in legal and financial repercussions.
- Organizations should perform a quantum threat analysis.
- Develop a risk-oriented roadmap for executing the transition.
- Promote the continuation of extensive research on post-quantum cryptography and standardization efforts.
Recommendations
Combining Quantum Key Distribution (QKD) and PQC schemes will be critical, as QKD is theoretically safe from decryption by quantum computers.
Hybrid solutions of classic and PQC algorithms are vital as an intermediate step before the complete transition to PQC and QKD. Standards for crypto agility should be part of the design process of new applications and devices.
The transition to post-quantum cryptography is crucial for maintaining digital security. NIST and the EU are leading efforts to standardize and implement PQC algorithms. Organizations must prioritize PQC adoption to protect against quantum computing threats and ensure compliance with security and privacy laws.
Pablo Valerio – Editor @ EETimes.com – Colaborador de ATGroup
