The security, confidentiality, and integrity of the Internet are ultimately based on really hard math, aka cryptography. Computers get faster every few years (Moore’s Law, anyone?), meaning those math problems need to be That Much Harder to remain the foundation of security for the digital world. But what happens when our computers shift from transistors to quantum mechanics? That’s when everything based on today’s really hard math problems becomes laughably easy to crack.
Cybersecurity enthusiasts are not looking forward to that moment; it will be an Internet-wide emergency like we’ve never seen before. So, when can we expect quantum cryptography to break Internet security? Great question! That emergency may happen pretty soon. Or it may be a few more years. Some conspiracy theorists suggest it has already happened, and hackers are keeping quiet about it so they can suck up all the data with none the wiser. Ultimately, no one knows, though there are various predictions out there.
What is Quantum Mechanics?
You’ve probably heard about atoms. Teeny tiny particles that combine in various ways to make matter like oxygen and iron. Those teeny tiny particles are made up of even teenier tinier particles, and those sub-atomic particles are like magic.
“Any sufficiently advanced technology is indistinguishable from magic.” Arthur C. Clarke
Those subatomic particles offer some very interesting behavior that scientists and engineers can sometimes predict and manipulate. Predicting and manipulating those subatomic particles is what quantum mechanics is all about, and when it works, it is blindingly fast.
Quantum Computing
Scientists have been studying quantum mechanics for over a hundred years. It wasn’t until 1982, when Richard Feynman wrote in his famous paper, Simulating Physics with Computers, that people started thinking about the possibilities. Things got exciting in 1994 when Peter Shor developed a quantum algorithm. That algorithm was the warning bell that cryptographic systems based on solving current complex math problems would be blown out of the water.
What that algorithm could do was find the prime factors of large numbers in shorter timeframes than ever before. You have probably seen those tables about how long it takes to crack a password (like this one or this one) that shows millions or billions of years to crack a long, complicated password. Now, imagine those numbers cut down to days. More bluntly, what once took a few billion years to solve using traditional computing and existing algorithms will take days with quantum computing.
Post-Quantum Cryptography
With Shor’s Algorithm kicking things off, research is underway to develop more quantum algorithms that can be used as the basis of new cryptographic methods. The U.S. National Institute of Standards and Technology (NIST) has a very active program focused entirely on this area of study.
The goal of this program isn’t just new, advanced math. It’s advanced math that can interoperate with both new and traditional protocols and networks. It takes an amazing mind to figure out how to develop an algorithm that takes advantage of quantum mechanics when computers that use quantum mechanics are not quite ready for prime time. (See what I did there?)
NIST’s take on the probability and timing of the quantum apocalypse scenario is:
“While in the past it was less clear that large quantum computers are a physical possibility, many scientists now believe it to be merely a significant engineering challenge. Some engineers even predict that within the next twenty or so years sufficiently large quantum computers will be built to break essentially all public key schemes currently in use.”
Looking into the Void
The world is on the brink of having new computers that can crack code faster than dropping fine china on a granite countertop. Even if post-quantum cryptography is ready for real-world use around the same time those new computers are a reality, we still have a big problem. Great! What happens to all the material that people, organizations, and governments have been collecting and storing, waiting for the day they can crack it right open? Because it’s unrealistic to say that data collection isn’t happening.
The number of cybersecurity attacks reported goes up every year. According to Harvard Business Review, breaches spiked in 2023. And all that is just what we know about. There is a lot of data already out there, and it’s unlikely that said data is encrypted with quantum-resistant algorithms.
When the first quantum-based computer is produced, we will see some interesting and terrifying information exposures. And if you want to freak out and head to your closest off-the-grid bunker, imagine AI powered by quantum-based computers.
Planning for an Emergency
Like all animals, humans are terrible at staying in emergency mode for long. And preparing for something as mind-blowing as the quantum apocalypse when we don’t know the timing is difficult. Do we treat it as an imminent emergency? Or do we slide it behind all the other emergencies clamoring for our attention? The World Economic Forum breaks down the steps that organizations should build into their plans into three items:
- Be aware that changes in computing that will make your current security models irrelevant will happen.
- Train your workforce to stay aware of changes in best practices for cryptography and conduct assessments of what data you have that is most sensitive to changes in advances in cryptography.
- Remember your IoT devices and other digital assets may also be impacted.
Wrap Up
The Quantum Apocalypse has many cybersecurity practitioners biting their nails as responding to the brave new world of quantum cryptography will not be simple, quick, or cheap. It has business leaders thinking about retirement. And it’s just another Urgent Event for everyone else to worry about (because we don’t have enough to worry about today).
Still, the only thing worse than an apocalyptic event is an apocalyptic event no one saw coming. While there may be nothing for you and your organization to do right now beyond staying aware, that awareness will put you ahead of the game when this new computing paradigm becomes available to the world.
I love to receive comments and suggestions on how to improve my posts! Feel free to comment here, on social media, or whatever platform you’re using to read my posts! And if you have questions, go check out Heatherbot and chat with AI-me.