Data SecurityBlogSecurity
Blog • • 6 minute read

A CTO'S Primer on Q-Day: Part 1 - The Post-Quantum Problem

Quantum computing's potential to break current encryption standards, known as Q-Day, poses a significant threat to cybersecurity. As experts race to develop post-quantum cryptography, balancing the risks and revolutionary potential of quantum technology is crucial for safeguarding our digital future.

The looming threat of quantum computing, often referred to as the "Quantum Apocalypse," has captured the attention of experts and policymakers worldwide. As we stand on the precipice of what is known as Q-Day, the day when quantum computers could potentially dismantle current encryption standards, the urgency to prepare becomes increasingly apparent.

Understanding the Q-Day threat

Q-Day signifies a seismic shift in digital security. It's the anticipated moment when quantum computers gain the capability to break widely used encryption algorithms like RSA and ECC. The implications are staggering: personal, corporate and governmental secrets could be exposed, disrupting everything from emails and financial transactions to national security frameworks. The security of our digital domains of work, play and leisure is at risk.

The vulnerability of current encryption

Today's digital security infrastructure relies heavily on mathematical problems that are nearly impossible for classical computers to solve. However, quantum computers, with their immense computational power, threaten to render these encryption methods obsolete almost overnight. This vulnerability highlights the critical need for immediate action to protect sensitive information. Hiding critical digital keys using hash, factorization and discrete log math will no longer be secure within 10 years. 

Evaluating the timeline and current capabilities

Experts estimate a one-in-three chance of Q-Day occurring before 2035, though some speculate it may have already occurred in secrecy. Some additional facts to dig deeper (the TL;DR part):

  • Proof-of-concept fault-tolerant quantum computation: Experts estimate less than 5 percent confidence that superconducting-based fault-tolerant systems will be demonstrated before 2026 under optimistic assumptions of sustained exponential progress.
  • RSA-2048 factorization capability: Current models suggest less than 5 percent confidence that quantum devices capable of breaking RSA-2048 encryption will exist before 2039, assuming continued exponential improvements in qubit counts and error rates.
  • Qubit requirements for cryptography: Earlier estimates indicated "many thousands to millions of qubits" would be required to crack RSA-2048, though recent algorithmic advances like Variational Quantum Factoring may reduce these thresholds.
  • Error correction milestones: The transition from noisy intermediate-scale quantum (NISQ) devices to error-corrected systems is projected to accelerate over the next 5-10 years, with small error-corrected quantum computers expected in this timeframe.
  • Practical limitations: Despite progress, quantum coherence times, gate error rates and scaling challenges remain fundamental barriers to building cryptographically relevant quantum computers (CRQCs) in the near term.

Despite these concerns, practical quantum computers (Cryptographically Relevant Quantum Computers or "CRQC") capable of breaking encryption remain out of reach due to significant technical hurdles, particularly in error correction and qubit stability. However, this does not diminish the urgency of preparing for the eventual reality.

Exciting developments within the quantum field include advancing 1-2 qubits of compute power a day, effectively doubling compute capabilities. This rapid progress surpasses the traditional notion of Moore's Law, ushering in what we might call "The Quantum Law," where the boundaries of technological advancement seem limitless. 

The race for post-quantum cryptography

In response to the looming threat, researchers and governments are fervently developing new cryptographic methods that can withstand quantum attacks. The National Institute of Standards and Technology (NIST) has made strides by releasing post-quantum cryptography (PQC) standards. The global "quantum race" is now underway, with nations and corporations striving to build quantum computing capabilities while securing systems against potential threats. The threat of quantum computing (CRQC – Cryptographically Relevant Quantum Computer) breaking legacy encryption is the imminent threat, and NIST's new PQC cipher suites are the mitigation.

Quantum computing's dual nature

While the security risks associated with quantum computing are profound, its potential for positive disruption is equally significant. Quantum technology holds the promise of revolutionizing fields such as drug discovery, materials science, energy and artificial intelligence, solving complex problems that classical computers cannot tackle. Replicating the real world within a conventional compute infrastructure is impossible. Replicating the real world within a quantum infrastructure is computely feasible due to the non-binary method of computing.

Addressing the preparedness gap

Despite the looming threat, many organizations and governments find themselves unprepared for the post-quantum era. Transitioning to new cryptographic standards presents a complex challenge that demands urgent attention. The path forward requires strategic planning and collaboration across sectors to ensure a smooth transition without disrupting critical services.

Debating the urgency

Within the expert community, there is ongoing debate about the immediacy of the quantum threat. Some question how imminent or credible the danger is, given the current state of quantum hardware. Nonetheless, the prevailing consensus underscores the real risk posed by advancing quantum technologies, making preparation an essential priority. It is not a matter of if but when.

Strategic priorities for mitigation

To mitigate the potential impact of Q-Day, several research directions and strategic priorities have been identified:

Research and development priorities

  • Scalable quantum-resistant cryptography: Developing protocols that can be feasibly deployed at internet scale, balancing security, speed and resource requirements.
  • Quantum threat timeline modeling: Creating accurate models to predict the arrival of Q-Day, incorporating advances in quantum hardware and error correction.
  • Quantum-accelerated cyber attacks and defenses: Exploring both offensive applications, such as rapid password cracking, and defensive measures, like advanced intrusion detection and automated key rotation.
  • Transition strategies for critical infrastructure: Studying best practices and developing roadmaps for migrating systems to post-quantum security without service disruptions.

Implementation and deployment priorities

  • Certificate inventory: Conduct comprehensive audits of existing digital certificates across all systems and applications to understand the scope of cryptographic assets requiring migration.
  • Criticality assessment: Evaluate and classify systems, data and infrastructure based on their sensitivity and operational importance to prioritize post-quantum cryptography implementation.
  • Post-quantum cryptography (PQC) enabled PKI solution: Establish and deploy public key infrastructure systems capable of supporting quantum-resistant algorithms and hybrid cryptographic approaches.
  • Quantum key distribution (QKD) and quantum random number generator (QRNG) strategy: Develop strategic plans for implementing quantum-based security technologies where appropriate, considering cost, feasibility and security benefits.
  • Device and certificate security assessment: Identify which devices and systems require certificates and develop security protocols specifically for protecting quantum key distribution networks.
  • Laboratory testing: Establish controlled testing environments to validate post-quantum cryptographic implementations before production deployment.
  • Phased deployment strategy: Execute systematic rollouts based on laboratory testing results and system criticality assessments to ensure smooth transitions with minimal operational disruption.

As we navigate the complexities of this technological transformation, the focus must remain on accelerating the adoption of post-quantum cryptography and monitoring for anomalies that could indicate covert quantum activity. The race against time is a coordinated effort requiring global collaboration to outpace the evolution of quantum computing and safeguard our digital future.