Image: © Sergey Nivens/Stock.adobe.com
Sectigo’s Tim Callan explains the current steps being taken to bring in quantum-resistant encryption, the possibility of ‘hybrid certificates’ and the ongoing threat of ‘harvest and decrypt’ tactics.
As we move forward on the path to create quantum computers, hopes and concerns have been raised about the impact these machines will have.
If certain hurdles are overcome, humanity will be able to create machines that can solve mathematical problems far faster than conventional computers, presenting enormous benefits. But a future where machines are so powerful also presents risks for how our society functions. In the digital age, encryption is used to protect vast amounts of data, from basic communications to sensitive medical records.
A major concern is that quantum computers will eventually become powerful enough to solve modern encryption quickly, essentially making all our data hackable. This is commonly known as the quantum apocalypse, because it could have a vast impact if measures aren’t taken to prevent it.
Tim Callan is the chief experience officer at Sectigo. He told SiliconRepublic.com that – unsurprisingly – the trick to avoiding this scenario is to upgrade the current standards of cryptography, many of which have been in use for decades.
“There’s no foundational mathematical rule that says the quantum computers will have to break all cryptography,” Callan said. “It’s just that they break the cryptography that we arrived at in the 70s, 80s and 90s, before we understood that a quantum computer was even a possibility.”
A hybrid encryption future
Currently, the closest example we have to a quantum-resistant cryptography standard comes from the US National Institute of Standards and Technology (NIST), which selected four key algorithms after a call for new encryption methods.
The main one of these is known as the Crystals-Kyber algorithm, which has been designed to become an alternative method for general encryption. One of the most common general encryption methods currently in use is RSA.
Callan said that more “backup” algorithm are being searched for by NIST because “if some genius at a whiteboard somewhere in the world right now is figuring out how to beat Crystals-Kyber, then we’re back where we started”.
In the meantime, Callan said standards organisations like the Internet Engineering Task Force are working on how to implement cryptography like Kyber in modern systems.
But while creating a new encryption certificate is one challenge, implementing the new encryption worldwide is a far more complicated task.
“If I gave you that certificate today, it doesn’t matter because your hardware and your software can’t use it,” Callan said.
“So at the same time, the industry itself has to catch up. Everybody has to go build this support into their products. And then we’re all going to have to upgrade our products.”
Another challenge that comes about with upgrading systems is that so many organisations are connected with each other, with servers being shared worldwide. If one system gets fully upgraded, it presents problems if it can no longer communicate properly with an older, weaker encryption.
Callan said one idea that’s being discussed to address this issue is the creation of a “hybrid certificate”.
“A hybrid certificate can speak both languages, so it can do RSA and it can also do Kyber,” Callan said. “So now what happens is if I connect to somebody who can do Kyber, I say ‘let’s do Kyber’. I connect to somebody who doesn’t know what Kyber is, I say ‘Okay, let’s do RSA’.”
Callan said this presents a “transition plan” to implement Kyber over time in a less disruptive way, with the goal being that – eventually – every system can use Kyber instead of an older encryption method.
The issue with this method, however, is that hybrid certificates can be beaten simply by connecting through RSA instead of Kyber.
But Callan says this method would ensure legacy systems keep functioning, making it “a viable strategy, as long as eventually we get rid of the legacy systems”.
Hack now, decrypt later
But while there is a potential way to avoid the doomsday fears of global unsecure systems, Callan warned about an issue in the present day that could mean data is already at risk from quantum computers.
Callan believes that “sophisticated and well-resourced actors” are storing and documenting vast amounts of data with the intention of decrypting it in the future. He said this could be conducted by state-sponsored organisations.
This threat is known as ‘harvest and decrypt’ or ‘store now, decrypt later‘. “It strikes me as extremely credible, that a very well-resourced organisation could be storing gigantic amounts of data in motion,” Callan said. “Because storage of bits in the grand scheme of things is relatively cheap.”
10 things you need to know direct to your inbox every weekday. Sign up for the Daily Brief, Silicon Republic’s digest of essential sci-tech news.
