As experts predict that cryptographically relevant quantum computers may be built within the next 10 to 20 years, companies must respond by building algorithms into products and services we use every day. The “harvest now, decrypt later” attack, where encrypted data is captured and held until a quantum computer can break the encryption, poses a significant threat.
To counter this, the National Institute of Standards and Technology (NIST) initiated the Post-Quantum Cryptography project in 2016 to select and standardize quantum-resistant algorithms. After assessing 82 algorithms from 25 countries, NIST identified the top 15 finalists and alternative algorithms, with draft standards released in 2023. Cybersecurity experts are now encouraged to incorporate these new algorithms into their systems. NIST’s effort is crucial as it develops guidance through an open process involving industry, government, and academia.
Technology managers can prepare by inventorying systems that use encryption and alerting tech departments and vendors about upcoming changes.
Historically, it takes around 10 to 20 years for new algorithms to be standardized and fully integrated into information systems. Meanwhile, predictions vary widely on when a sufficiently powerful quantum computer will be built, with some estimates suggesting it could happen in less than 10 years.
Even if we implement post-quantum encryption algorithms before such computers are built, there’s still the risk of “harvest now, decrypt later” attacks. This means adversaries can capture encrypted data now and hold onto it, hoping to break the encryption with a future quantum computer. This threat underscores the importance of transitioning to post-quantum cryptography immediately.
NIST has taken a proactive approach by initiating the selection and standardization of quantum-resistant algorithms in 2015. After evaluating 82 algorithms from 25 countries, they identified top candidates and released draft standards in 2023. Cybersecurity experts are now encouraged to incorporate these new algorithms into their systems.
The NIST-led effort is crucial because the agency has extensive experience developing encryption algorithms through an open process that brings together industry, government, and academia. Their mission is to develop standards broadly useful to everyone, not just a particular company or group.
So, what can we do now to prepare for cryptographically relevant quantum computers? Technology managers should inventory their systems for encryption applications, alert their tech departments and vendors about the upcoming change, and learn more about migrating to post-quantum cryptography through NIST’s National Cybersecurity Center of Excellence project page.
Understanding the difference between post-quantum cryptography and quantum cryptography is also essential. While they share similar names, they are distinct approaches. Post-quantum cryptography is a defense against potential cyberattacks from quantum computers, relying on mathematical techniques like elliptic curves. Quantum cryptography, on the other hand, uses the principles of quantum mechanics to create new forms of secure encryption.
By taking proactive steps now, we can ensure that our information systems are prepared for the potential threats and opportunities presented by cryptographically relevant quantum computers.
External Link: Click Here For More
