Quantum Computing and Threats to Secure Communication

There is never a dearth of new terms, discoveries and inventions in the technological world. And sometimes existing terms get reinvigorated. And debates ensue. The debaters argue about the plusses and minuses and make some predictions. Such is the case with “Quantum Computing.” I recently watched and listened to a webinar that provides insights into quantum computing, how advances in that field could pose a threat to secure communications and what is being done to address that threat.

The webinar was sponsored by Intrinsic ID, a leader in security IP for embedded systems based on physical unclonable function (PUF) technology. It was hosted on pufcafe.com. More on PUF Cafe later in this blog. The webinar was conducted as a panel session and moderated by Vincent van der Leest. The panelists were Dr. Pim Tuyls and Dr. Roel Maes. Pim is the CEO and Co-founder, Roel is the principal security architect and Vincent is the director of product marketing at Intrinsic ID. By the way, Intrinsic ID is a spinoff from Philips Research. Pim was one of the pioneers of PUF technology at Philips Research.

This blog is a summary of the salient points I gathered from the webinar panel session.

Before we dive into that, there are a few things to be clarified. For starters, the word “quantum.” In common parlance, it means quantity. But how much quantity? Generally speaking, people may think quantum means a lot, as in quantum improvement. Others may think quantum means instantaneous, thanks to the 1990s’ TV series Quantum Leap. But the theory behind quantum computing is quantum mechanics, the theory describing nature at the scale of sub-atomic participles. And quantum in this context means smallest possible discrete unit of any physical property such as energy or matter.

The other thing to recognize is that the term crypto as used in this webinar is shorthand for cryptography, not to be confused with crypto as in crypto currencies. Nor is this security topic limited to just crypto currency security but rather all kinds of secure communication applications. And this broad scope highlights the sense of urgency of the matter discussed in this webinar.

Quantum Computing

The promise of quantum computing is that it can deliver a level of compute performance that cannot be matched by today’s powerful computer chips. The performance results from tapping quantum phenomena such as superposition and entanglement to achieve computational parallelism.

Refer to figure below for comparing what can/can’t be done with classical computers vs quantum computers from the perspective of cryptography.

Quantum Computing Applications

At this time, there are a few known applications that could benefit from powerful quantum computing. In the field of computational chemistry, studying molecular interactions is a combinatorial problem with a very large search space. When we have powerful quantum computers, personalized drugs could be designed efficiently. Logistics is another field where problems could be solved very efficiently with quantum computing. There may be many more applications in the future.

Given the complexities involved in building quantum computers, it is fair to assume that it may take many years for us to see very powerful quantum computers. Pim says he expects it will take 10 to 20 years. So why this near-term concern about powerful quantum computers becoming a threat to secure communications?

A Few Reasons

Grover’s algorithm was invented in 1996 and uses brute force to deliver a performance at square-root of the search time of classical algorithms. It still takes exponential time but if the key used is not long, security could be compromised.

Shor’s algorithm was invented in 1994 and takes only polynomial time unlike Grover’s algorithm. So, increasing the key length does not have any impact. And this algorithm can break widely used security algorithms such as RSA, DH/DSA ECDH/ECDSA. Refer to figure below for what is worrying everyone.

And based on history, we know it takes a long time to upgrade all systems to start using newer security standards. For example, National Institute of Standards and Technology (NIST) established the Advanced Encryption Standard (AES) in 2001. From a practical perspective, the migration from Data Encryption Standard (DES) to AES has taken a long time. So, steps have to be taken now to develop and establish newer security standards that can stand attacks from quantum computers.

Post Quantum Crypto

NIST has been driving the initiative to develop and standardize security algorithms for the post quantum era. New algorithms can be expected to be finalized as early as next year and certainly within the next few years. To ensure smooth migration, playbooks should be written identifying who does what and where. For example, current silicon accelerators will stop working and would need to be redesigned.

PUF Technology

Because this is a webinar on pufcafe.com, Physical Unclonable Function (or PUF) technology is also discussed. Is PUF technology itself at risk due to quantum computing? The short answer is no. Pim explains how PUFs are quantum proof. But the keys could be at risk if used with RSA and other algorithms identified earlier.

PUF Cafe

For full details, please register at pufcafe.com and watch the entire webinar panel session. I certainly learned a lot. PUF Cafe is a great virtual watering hole to quench one’s thirst for security related knowledge and to separate myths from facts. There are many interesting webinars at PUF Cafe archives. You may want to regularly visit the site as they host webinars on interesting topics on a monthly basis.

Also Read:

Webinar: How to Protect Sensitive Data with Silicon Fingerprints

CEO Interview: Pim Tuyls of Intrinsic ID

IDT Invests in IoT Security