The race to become quantum-safe

For many, quantum computing is a little like nuclear fusion. Each is at the very furthest reaches of deep tech – and each its its own way will change the fabric of the world when realised.

Physicists hope that commercial nuclear reactors could be realised by the early 2040s. But quantum computing could come sooner – far sooner.

When it does arrive – and leaders in the space now say it could do by 2029 – quantum computing will represent the most severe of risks to our encryption algorithms. Luckily, experts are already working on establishing standards for post-quantum approaches – now it’s up to business to put them in place. How long do we have to adopt post-quantum encryption? And what are challenges are business leaders up against?

In this episode, Rory is joined by Jason Soroko, senior fellow at Sectigo, to unpack the technicalities of post quantum cryptography and what it means for cybersecurity professionals.

Highlights

"We now just had a paper that was just announced where optically corrected physical qubits down to 10,000 physical qubits can now be considered a cryptographically relevant quantum computer. And that, actually, has prompted the likes of Google and even Cloudflare to say that they're going to be preparing as if 2029 is the date, and that's not long from now."

"So when you think about blockchain and cryptocurrencies, a lot of people think 'I'm good, this is hashing, I don't have to worry about this'. Well, Google just reminded everybody that cryptocurrency wallets are basically a PKI key pair, and that key pair is typically generated by a specific ECC curve, and that will absolutely be vulnerable."

"My fear is that down the chain, everybody has so much work to do that they're putting this as a level 10, plan Z that will never get get dealt with. I think, though, that the one of the reasons why I forgive anybody for also making that mistake is, there's not a lot right now to be sold as from the vendor community to people."

"This is what you're seeing right now, that not all the standards are completely written yet. And so therefore I think, to me as an open source steward, I would be taking inventory of where am I using RSA or ACC, anywhere in my projects?"

Footnotes

• Post-quantum cryptography is now top of mind for cybersecurity leaders
• Get started on post-quantum encryption, organizations warned
• Google just revised its ‘Q-Day’ timeline: Quantum computers could break existing encryption techniques within three years – and enterprises are nowhere near ready
• What will the Quantum-Safe 360 Alliance mean for your business and its post-quantum security posture?
• NCSC: Timelines for migration to post-quantum cryptography
• NIST: Post-quantum cryptography

Subscribe 

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Join us on LinkedIn