How quantum computing may impact cyber security

The concept of quantum computing still sounds futuristic. Theoretically, calculations with a quantum computer could be completed over a hundred million times faster than with today's most powerful supercomputer. The implications for resolving fundamental scientific issues are enormous.

However, this comes with a dark side: encryption that would have taken traditional computers thousands of years to decipher can now be broken in a matter of minutes, if not seconds. The implication of this is that adversaries can collect and store data now to use against you with a quantum computer in the future. Some business and individual information will remain secret for a very long time. Therefore, it is prudent to safeguard data against attacks from quantum computers.

One could be forgiven for doubting the reality of quantum computing given the enormous performance boost it provides compared to conventional "Von Neumann" machines. But the speed comes as a byproduct of the fundamentally different way quantum computing operates. Current computer chips are largely based on John von Neumann's computing model from 1945. The data is read from the input device, processed logically, and written back to storage in a sequential fashion.

This is the way that even the most advanced parallel supercomputers work. Even if the CPU core is performing thousands of operations simultaneously, it will execute each one in turn. While GPUs are more straightforward than CPUs, they still have sequential units—albeit with a lot more units that can be run in parallel. Bits, with their binary representations of "0" and "1," are also used in conventional computing. One state is provided as input, and either the same state or the opposite state is returned as output. Complex problems with many possible solutions may exceed the capabilities of existing architectures if they are broken down into separate sequential calculations.

Not how quantum computers function at all. A quantum computer calculates based on the likelihood of an object's state before it is measured, rather than using a large number of processing cores to perform operations in parallel on individual bits. These states, which can include things like the polarization of a photon or the spin of an electron, are referred to as qubits, and they exist before the object is detected. They mix many possible positions at once rather than just two because these quantum states don't have a clear position before measurement.

Mixed states are not defined until they are measured, but they can be "entangled" with the states of other objects in a mathematically related way. Complex problems can be solved with essentially a single operation by applying the mathematics of this entanglement to an algorithm. On one hand, this can be put to use in extremely challenging scientific endeavors, such as the prediction of multiple particle interactions in a chemical reaction or the development of security codes that are significantly harder to crack than those currently in use. Since they can try many different combinations at once, they can also be used to break codes that were previously unbreakable with available computing resources.

When put into perspective, it would take a conventional computer 22,000 times the age of the universe, or 300 trillion years, to break the widely used 2,048-bit RSA encryption. To find the prime factors of an integer used in encryption keys, however, would take only 10 seconds on a quantum computer with 4,099 qubits using Shor's Algorithm. There is obviously a threat to various kinds of cryptography. Common web connection encryption protocols like SSL and TLS use RSA keys with a bit length of 2,048 and could be cracked by a quantum computer.

We fortunately had not reached this point. In a world where 64-core processors can perform more than 3 billion operations per second per core, 4,099 qubits may not seem like much, but they are still more than the most powerful quantum computer currently in existence. Eagle, IBM's 2021 unveiling, has only 127 qubits. Most quantum processing units (QPUs) have fewer than 50 qubits, including Google's Sycamore (53 qubits) and the Jiuzhang (76 cubits) at the University of Science and Technology of China. D-Wave offers 'quantum annealing' processors with up to 5,760 qubits, but they can't run the Shor's Algorithm necessary to break encryption because they only allow for a small number of outcomes.

Growth, though, is occurring. In 2022, Xanadu will release their 216-qubit QPU, Borealis, while IBM's Osprey will reach 433 qubits and Condor will reach 1,121 qubits. So, while it's true that traditional encryption is still secure for the time being, that won't be the case for very long. NIST predicted that 2,048-bit RSA would still be secure until 2030, but IBM's roadmap aims for 4,158 qubits by 2025, so it's likely that it will be possible to crack it virtually in real time before then. Given that D-first Wave's commercially available quantum computer cost $15 million when it shipped in 2017, it's possible that you won't be able to go out and buy a quantum computing desktop computer by 2030. Though costs will eventually decrease, QPUs are still likely to be a luxury item for only the largest of businesses and nations for the foreseeable future. However, not every one of those nations will have our best interests at heart, and that's where the danger lies.

There is still time to prepare for the threat, and there are already security products available that use post-quantum cryptography. Products like these can safeguard your most private information now while also making it resistant to quantum computer attacks in the future.

All current encryption algorithms are vulnerable to Shor's Algorithm on a quantum computer because they rely on integer factorization, discrete logarithms, or elliptic-curve discrete logarithms. In order to counteract the threats posed by quantum computers, cryptography has evolved into the "post-quantum" era. Investigation based on the six main approaches is in its infancy, but products using the technology are already appearing. QST-VPN is one such service; it is based on the OpenVPN library but uses post-quantum secure algorithms to encrypt user data. The server software is made available through the AWS cloud, and clients are available for Windows, MacOS, and a wide variety of Linux distributions, giving businesses a chance to start shoring up their security before the quantum horse has already bolted.

The speed with which we can perform calculations could be drastically improved with the help of quantum computing. The potential benefits and drawbacks of this are similar to those of any other technological advancement. Since we now have a glimpse into the future of cyber security, we can take measures to ensure that the positive potential of quantum computing outweighs the negative ones.