The Quantum Threat

The emergence of a large-scale quantum computer in the not-so-distant future could have an immediate impact on the security of our most sensitive data. Encrypted long-life secrets that are collected and stored today, such as medical records, could be decrypted once the quantum computer is available. It’s a time bomb.

Risk Management

“The quantum computing risk cannot be ignored. Without cryptography, we will need to “unplug” from the ICT infrastructure and stop using ‘untrusted parties’ and media. This is simply not practical for the majority of applications, including those that involve a financial transaction in real time (credit-card purchases, money transfers, online banking, etc.) and those used for online communications (email, texting, social media, etc.) online advertising, e-health, and more.” (M.Mosca).

Transition Time To Q-Day or Y2K

The time window to drive the transition to quantum resistant infrastructure before Q-Day (when the Quantum Computer will break RSA-2048 keys) has been forecast between 2025 and 2030, according to a report by the BCG in March 2021and most other prospective reports. 

To anticipate Q-Day, a product cycle lifetime of 5 to 30 years + after deployment is required, as well as he ability to update cryptography. These challenges were underlined by Infineon at the July 2021 conference.

Post Quantum Cryptography

Current public-key cryptographic standards (RSA - ECC) are based on mathematical problems that are difficult for classic computers to solve, but easy for a quantum computer. New, more difficult, quantum-safe mathematical problems are needed to build a new quantum-resistant cryptography or post-quantum cryptography (PQC). Lattice-based, code-based, multivariate-based or hash-based, mathematics are at the core of new PQC algorithms, and at the origin of CryptoNext’s know-how and prestigious awards.

Quantum Transition Plan

Enterprises will have to rise to multiple challenges to achieve their quantum transition action plan, and it will take years. The migration process should be considered as an integral part of company’s ongoing and sustainable cybersecurity plan and be implemented in four phases.