Quantum Computing and the Threat to Digital Security
Quantum computers – if sufficiently large – will allow to efficiently solve some of the mathematical problems behind current cryptography, and virtually all digital communication would become insecure. The threat is already relevant today as encrypted communication can be captured and stored, and decrypted once a sufficiently powerful Quantum computer can be built. Recent progress in Quantum computing has triggered an increased sense of urgency among governments and standardization bodies. Industry and government bodies are called upon to take appropriate measures. IBM outlines how organizations, industry associations, and authorities should position themselves and demonstrates how IBM, as a company, is organizing its own migration to quantum-safe cryptography.
AI Summary
Disclaimer: This session information was generated with the help of AI.
The information has been reviewed and refined by the Swiss Cyber Storm team before publishing.
Marco Brenner of IBM Research Zurich argues that quantum computing has moved from science fiction to industrial reality, and that a cryptographically relevant quantum computer will arrive unannounced. Such a machine would break all public-key cryptography in use today, removing the foundation of trust behind digital services across entire business ecosystems. Drawing on IBM’s own quantum-safe transformation, he explains why symmetric encryption is not the concern, why migration is a hard cut rather than routine housekeeping, and why organizations should register the risk, enable hybrid key exchange now, and target priority use cases for around 2030.
Video chapters
0:00IBM Research Zurich and its quantum mission6:02Comparing today's quantum computers10:03Business potential and industrialization of quantum12:45Why public-key cryptography is at risk15:51Quantum risk as loss of trust18:31Ecosystem-wide migration and harvest now, decrypt later21:02Roadmaps and research breakthroughs shortening timelines24:03Authority timelines and Swiss guidance25:17Conclusions and roles in the migration27:12Q&A on migration versus routine housekeeping
Key facts
- Integer factorization, discrete logarithm and elliptic curve problems, which underpin today's digital signatures and key exchange, are all at risk from a sufficiently powerful quantum computer.
- The National Institute of Standards and Technology (NIST) selected four post-quantum algorithms in 2022 and has standardized three of them; three of the four were developed under the leadership of, or with strong contributions from, researchers at IBM Research Zurich.
- Current quantum processors offered on IBM's cloud have around 120 to 150 programmable qubits and can reliably run quantum programs of a few thousand, up to perhaps 10,000, steps.
- Hybrid key exchange is already available for TLS 1.3 (Transport Layer Security) and can be activated to counter the harvest now, decrypt later threat.
- Timelines from authorities, one a mandate and two recommendations, call for priority use cases to migrate key exchange and signatures to quantum-safe cryptography by around 2030 to 2031.
Ideas
- Quantum threats should be framed for boards not as a cryptography issue but as the loss of the foundation of trust that makes digital business possible, and therefore as an existential and business continuity risk.
- Comparing quantum computers requires looking beyond headline qubit counts to programmable qubits, resistance to noise (how many operations can run reliably) and the speed of a single operation, which can range from nanoseconds to milliseconds.
- Quantum-safe migration cannot be done by one organization alone: public-key cryptography underpins whole business ecosystems, so partners must move together, with industry associations and governments providing guidance and shared information.
- Research breakthroughs make timelines unpredictable, such as a method for building error-corrected qubits with around a tenth of the previously estimated physical qubits, and new designs of machines aimed specifically at breaking short-key elliptic curve cryptography.
- Business units will not wait for security to be ready, because early adopters of quantum computing, for example in financial services, expect a significant competitive advantage.
Keywords
- post-quantum cryptography
- quantum-computing
- harvest now, decrypt later
- hybrid key exchange
Quotes
- “Future quantum computers will not just create vulnerabilities. They actually remove the reason why we trust digital services.”
- “Don't worry about increasing key sizes of AES because of quantum computers.”
- “The change we have to do is is a hard cut. So we have to get rid of legacy cryptography.”
- “If you use the word cryptography twice in a board meeting, then people just probably start to sleep.”
Recommendations
- Put quantum-safe migration on the agenda by adding it to the organization's risk register, so that existing risk processes make it difficult to ignore.
- Activate hybrid key exchange on TLS 1.3 connections now as an effective measure against harvest now, decrypt later, but test it in loaded environments first because post-quantum algorithms need considerably more resources.
- Plan to migrate priority use cases to quantum-safe key exchange and signatures by around 2030, rather than relying on cryptographically relevant quantum computers arriving no earlier than 2035.
Resources
- IBM Quantum Platform — Tool — Recommended by the speaker as a practical way to get started with quantum computing and understand its capabilities first-hand.
- NIST Post-Quantum Cryptography Standards — Framework — Provides the standardized quantum-safe replacements for key exchange and digital signatures that migration efforts should adopt.
- FINMA guidance on quantum-safe cryptography — Guide — Described by the speaker as worth reading because it reminds organizations that they are responsible for managing their own risk.
About the speaker
Marco Brenner
Program Executive
at
IBM Research
Marco Brenner works as a Program Executive at IBM Research in Switzerland, with a special focus on cryptography and state-of-the-art data protection solutions to support confidentiality and compliance.
He works as part of IBM Research on innovative solutions and is responsible for their implementation for customers throughout Europe.
Marco holds a Master’s degree from ETH Zurich in Computer Science with a specialization in Cryptography and Information Security, and an MBA from Henley Management College/University of Reading.
Read more …
Read more …