The Race Is On to Fight a Cyber Threat That Doesn’t Exist

A new set of algorithms chosen by the US government will allow organizations to start the long process of preparing for quantum attacks.

US government chose new cryptographic algorithms designed to protect our digital futures. (REUTERS)

The cybersecurity community was set alight last week by the announcement of new cryptographic algorithms designed to protect our digital futures. Now the race us on to roll out software and hardware that will secure computers against a threat that still only exists in theory.

After a six-year search, the US Commerce Department's National Institute of Standards and Technology on July 5 announced it had found four algorithms “that are designed to withstand the assault of a future quantum computer” that will be included in its set of official standards. Another four remain under consideration and may be included in the list later. The final standards, which will include parameters and implementations of the algorithms, will be finalized over the next two years.

An algorithm is a mathematical recipe for taking one set of information and converting it into another form. In cryptography, such algorithms are deployed to make messages hard to read by an external party, or to verify the legitimacy of data such as a signature or password. Many of those examined by NIST have been around for decades, meaning there's plenty of time for researchers to break the algorithms — some were shown to be insecure during the selection process.

It's a common misunderstanding that secure cryptography is impossible to break. Instead, computer scientists use the term infeasible — meaning an encrypted message can be reverse engineered, in theory, but it would take an extremely long time to do so.

Current security approaches hold because modern computers use binary units — bits — to reduce all numbers to 1s and 0s, and then perform calculations. But quantum computers can function on more than two binary bits at a time (they're known as qubits), meaning they can crunch huge amounts of data faster. What might take years on a classic computer could take hours or even minutes with a quantum computer. That makes everything we keep secure — from encrypted messages to cryptocurrencies — vulnerable to quantum attack. 

The caveat is that no such quantum computers exist. Scientists have been rushing to master related concepts such as quantum entanglement, but no one has yet worked out how to create a system that is stable, accurate and reproducible. Simply knowing that such a breakthrough will come is enough to force governments to start preparing now.

The last time the world was united around such a huge digital task was a quarter century ago. A bug, known as Y2K, occurred because many digital calendars only accounted for two digits. As a result, the one-year shift from 1999 to 2000 would be incorrectly viewed as a 99-year jump backwards. Everything from banks to aviation systems to traffic lights were considered vulnerable, so software was rewritten to handle the error.

Now it's time to prepare for the post-quantum era.

“It's kind of like the Y2K problem, except that we don't actually know the date,” said Nicolas Roussy Newton, Taipei-based co-founder and Chief Operating Officer of BTQ, which is developing post-quantum software and semiconductors. “There's the threat that data stolen today could be decrypted in the future by quantum computers.”

In May, US President Joe Biden ordered all federal departments to develop plans to safeguard against the looming threat ahead of NIST choosing its recommended algorithms. Germany and France had already announced their choices, giving them a small head start.

NIST's announcement serves as the starter's gun for government and civil-society organizations to make preparations. Some of it will be pretty straightforward because even though the final standards aren't decided, the broad approaches are already known. Semiconductors and computers will take longer.“If you do anything in software, you can start migration immediately,” said Andersen Cheng, London-based chief executive officer of Post-Quantum, a startup which developed software to survive quantum-computing attacks, including a virtual private network and biometric identity systems. “But if you do it in hardware, it takes time for parameters to be decided, which could take another 18 months.”

The rollout won't come all at once, and could take decades. Those organizations with more money and a greater need for secrecy will start first — likely the Central Intelligence Agency and National Security Agency — before trickling down to banks and communications providers. Within 20 years even email services and webcams will have post-quantum algorithms built in to ensure security.

The road to a post-quantum world is a long one. Unfortunately, we don't know how long. But at least preparations have begun.

Tim Culpan is a Bloomberg Opinion columnist covering technology in Asia. Previously, he was a technology reporter for Bloomberg News.