Why quantum computers are a security threat

Quantum computers will be able to crack many of the encryption systems commonly in use today. And this has far-reaching implications: after all, many digital services are conceivable only if data exchange and data storage are protected. Just think of online banking, eCommerce, telemedicine or even cloud computing. This need for protection is growing even more urgent with the Internet of Things and new applications such as autonomous vehicles. With this in mind, experts around the world are working at a fever pitch to come up with new methods.

What makes quantum computers so threatening

But what makes quantum computers so threatening to encryption? First we have to understand that, on a fundamental level, the way they operate is different from the binary-digital computers we commonly use today. They use a curious property of the smallest particles: They can be in an indefinite state until they are measured or otherwise disturbed (a phenomenon known as “quantum superposition”). So while today’s computers work with unique zeros and ones, quantum computers work with uncertainties. Each “qubit” can be both zero and one at the same time. This also means: They can perform tasks in parallel that classic computers would have to work through one after the other. And many of today’s encryption methods are not prepared for this.

By way of comparison: With a combination lock, a person would have to try all of the combinations from 0000 to 9999, one after the other, to open it. Each additional numeral extends this process. But because a quantum computer could test all possible combinations simultaneously, this protection is obsolete.

The race has not yet been decided

Quantum computers of this type are not available yet. Microsoft’s security expert Brian LaMacchia, for instance, estimates that it would take a 1000-qubit computer to pose a danger. IBM recently presented a 20-qubit computer. But the advances made in recent years have been substantial, and extensive research is under way all over the world. This new breed of computer could ultimately solve lots of problems in no time, problems that still seem too complex. Artificial intelligence, for example, is part of this. And of course organizations such as the NSA, the American intelligence agency, are keenly interested in the capability of converting all encrypted information into plain text.

The problem is urgent because it is not just about protecting data traffic between a customer and an online shop, for example. It’s also important to store data securely in the long term. Anyone who needs to keep information safe for 5, 10 or 15 years has to deal with this fact today: after all, it is quite possible that the encryption in use up until now will become obsolete during this period.

It is also problematic that interested entities could already tap and store the protected information today – to decrypt it as soon as technically possible. This is what the NSA does, for example.

Post-quantum cryptography has yet to arrive

With this in mind, there are experts and teams around the world working on suitable antidotes, i.e. a “post-quantum cryptography.” One such effort is the EU-funded PQCRYPTO project.

And even if powerful quantum computers still seem many years off, time is already running out. For instance, PQCRYPTO proposed 22 new approaches to the US National Institute of Standards and Technology (NIST). Other groups also joined in calling for added effort in this field. NIST now estimates that it will take three to five years just to review these proposals. Naturally, no one wants to impose a new method that turns out to be an element of uncertainty down the road. But that’s not all: New methods must be cast into standards and disseminated as part of the next step. And these processes can also take a number of years.

The bottom line: What does this mean for businesses?

“Businesses should identify critical assets and include the requirement of long-term security in their risk analysis in order to protect information with a confidentiality period or life span of five to 15 years,” says Enrico Thomae, for example, a post-quantum expert at operational services GmbH. And Tim Schneider, a cryptologist at Telekom Security, also advises dealing with “crypto agility:” Encryption methods should be used in such a way that they can be quickly replaced by new ones if the need arises. This way, companies can react quickly and flexibly as new opportunities become available.