Latest Developments in Quantum Cryptography

We are now in the exciting early adopter phase of the post-quantum cryptography transition. The last year has seen some major developments. In November 2022, Google deployed post-quantum cryptography for internal communications (https://lnkd.in/et6g8_3S) and then by August 2023, post-quantum cryptography was being rolled out within the Chrome browser (https://lnkd.in/ek2cTrUe), marking a significant milestone in securing web traffic against the quantum threat. Concurrently, Cloudflare, which underpins a significant portion of the web, introduced PQ cryptography compatible with Chrome and announcer today that they  use it for internal communications and communication to origin servers (https://lnkd.in/e5Qb3475). This means by the end of this year, a substantial percentage of web traffic could be safeguarded by post-quantum cryptography using proposed standards by NIST (https://lnkd.in/eMb-dBqV)! The transition to post-quantum cryptography is not just a technological shift, but a critical step towards ensuring long-term data safety. As businesses, transitioning both internal and external-facing services to support post-quantum cryptography is imperative. NIST has provided insightful guidance for businesses on how to approach this transition: https://lnkd.in/eyxFAixY Having been personally involved in the realm of post-quantum cryptography for half a decade, it's been a rewarding journey to witness and contribute to the industry's evolution. My work with Cloudflare on its industry-leading transition to post-quantum cryptography has been one of the many high points in this endeavor. As the industry navigates through this transitional phase, I am open for consultations to share insights and help other organizations on this path. Feel free to connect via https://lnkd.in/ehWtWwAu. #PostQuantumCryptography #Cybersecurity #DataProtection #NIST #Google #Cloudflare #Chrome

I'm excited to share this Case Study for Quantum Entropy Injection into HSMs for Post Quantum Cryptographic (PQC) Key Generation that our amazing PQC team and I recently completed.   In cybersecurity, entropy is the measure of randomness in a string of bits. In cryptography, entropy is used to produce random numbers, which in turn are used to produce cryptographic keys. As entropy increases, randomness gets better, keys become more difficult to determine, and security improves. Entropy is also important for the generation of random numbers and other critical security parameters such as seeds, salts, and initialization vectors for cryptographic algorithms.   Financial institutions must deal with the constant risk of cyber-attacks, underlining the responsibility to maintain and strengthen digital security for customers’ trust and integrity. A foundational step for addressing these issues is generating stronger cryptographic keys with better entropy (as part of a broader Defense in Depth PQC strategy). Using random bits (from quantum sourced entropy) that are proven for improved randomness and unpredictability is pivotal for both today’s classical cryptography and tomorrow’s quantum resistant cryptography.   Wells Fargo, Thales, and Quantinuum, working in collaboration, demonstrated the ability to generate strong cryptographic keys within the cryptographic boundary of a Thales Luna HSM, a FIPS 140-2 level 3 cryptographic module with external entropy. The keys were generated using random bits with verified quantum entropy acquired from the Quantinuum Origin trapped ion-based quantum computer and validated using the Bell Test to prove it met the threshold for quantum entropy. This cryptographic solution gives Wells Fargo a proven quantum entropy source to generate ultra-secure keys that can be designed and deployed at scale.

The German Federal Office for Information Security (BSI) very recently published a 171 pages long study with a comprehensive analysis of potential implementation attacks on Quantum Key Distribution (QKD) systems. Why is this relevant? Post-Quantum Cryptography (PQC) and Quantum Key Distribution (QKD) are both approaches to ensuring quantum-safe key agreement: PQC based on mathematical problems that are believed to be secure against both classical and quantum computers. The security assumption here is that these problems are so complex that even quantum computers would take an impractical amount of time to solve them. PQC can be implemented on classical computer systems. It doesn't require any specialized quantum hardware, making it more accessible and easier to integrate into existing digital infrastructures. E.g.: Lattice-based cryptography, hash-based cryptography, and multivariate polynomial cryptography. QKD’s security model is fundamentally different. It relies on the principles of quantum physics, particularly the behavior of quantum particles like photons. It leverages phenomena such as quantum entanglement and the "no-cloning theorem" to ensure security. QKD requires specialized quantum hardware, like photon detectors and quantum channels. This makes it more challenging to deploy broadly as it requires building new infrastructure. * * * This particular study is about QKD. Practical QKD has advanced quickly in the last 20 years. QKD is used for creating and sharing a key between authorized parties, with the ability to detect any third-party interference. Examples according to article by QuantLR (https://lnkd.in/ggEm8HhY): - SK Telecom, with Samsung, incorporated quantum cryptography technology in the Galaxy Quantum2 smartphone. The company also successfully applied QKD to IP equipment and developed quantum VPN technology. - Hyundai shipyard has implemented quantum cryptography to protect its defense technology, highlighting its importance in securing critical information in the 5G era. - In the U.S., Verizon conducted a successful QKD trial in Washington D.C., positioning itself as a pioneer in this field, following similar tests by Telefónica and Huawei. This document focuses on protecting against attacks that target flaws in real-world implementation of QKD systems. Most attacks must occur during the communication phase of the QKD process, because once keys are established using QKD, their security cannot be compromised retroactively. For more details on quantum threats, post-quantum cryptography, and QKD, the BSI published “Quantum-safe cryptography” in Oct. 2021: https://lnkd.in/g5Cv_ffs. Authors: Christoph Marquardt Ulrich Seyfarth Sven Bettendorf Martin Bohmann Alexander Buchner Marcos Curty Dominique Elser Silas Eul Tand others

The National Cyber Security Centre (NCSC) has recently published new guidance on migrating to post-quantum cryptography (PQC) to address the potential threat posed by future quantum computers to our current public-key cryptography (PKC) systems. Key takeaways: 1. PQC is resistant to attacks by both quantum and classical computers, offering similar functionality to PKC. 2. The migration to PQC is a complex undertaking, requiring re-engineering protocols and services. 3. NIST has published draft standards for PQC algorithms, marking the beginning of a global IT migration project. 4. Upgrading internet services and apps will likely be easier than transitioning legacy and sector-specific protocols, including those in critical national infrastructure. 5. For many use cases, PQC transition will happen through software updates issued by service providers. Organizations must start planning their migration to PQC, experimenting with implementations, and assessing performance in essential use cases. The NCSC's guidance on algorithm choices and protocol considerations will be invaluable in this process. #cybersecurity #quantumcomputing #postquantumcryptography

Scientists from Russia and China have allegedly achieved quantum communication encryption using secure keys transmitted by China's quantum satellite Mozi. Quantum communication encryption uses the principles of quantum mechanics to establish secure communication channels. It aims to create unbreakable encryption, making it highly attractive for applications where the highest level of security is essential, such as in transmitting sensitive information in fields like finance, government, and defense. This breakthrough demonstrates the technical feasibility of establishing a BRICS (Brazil, Russia, India, China, South Africa) quantum communication network. The researchers managed to cover a distance of 3,800 kilometers between a ground station near Moscow and another close to Urumqi in China's Xinjiang region, transmitting two encoded images secured by quantum keys, reported the South China Morning Post. The first full-cycle quantum communication test between the two countries took place in March 2022, according to Alexey Fedorov from Russia’s National University of Science and Technology and the Russian Quantum Centre. A secret key was passed on during this experiment, transferring two coded messages decrypted using keys based on a quote from Chinese philosopher Mozi and an equation from Soviet physicist Lev Landau. The collaboration utilized China’s quantum satellite, Mozi, which has paved the way for the development of both national and international quantum communication networks. Quantum communication provides a secure way to transfer information, making it resistant to eavesdropping by hackers. The encrypted data is transferred as ones and zeros along with a quantum key, ensuring that unauthorized individuals cannot access the information. However, limitations in ground-based quantum key distribution arise due to the loss of photons over long distances, capping optical fiber cable transfers at around 1,000 kilometers. China’s Mozi, the world's first quantum communication satellite launched in 2016, overcomes this. It allows for long-distance quantum transmission. The satellite enables the establishment of a national quantum network in China, spanning thousands of kilometers. Full Article: https://lnkd.in/gSji8E3j #Mozi #Encryption #QuantumComms China’s quantum satellite Mozi has opened pathways to develop national and international quantum communication networks. (CAS)

Recently many of us might have hear about the risk that modern cryptography face because of quantum computers and their computational capabilities. There we have seen new guidelines being released and many people talk about the need to develop quantum ressilent algorithms. But what are they ? Let's have an overview of some of such algos, what it is and how it works. It might be a bit complicated but I will try my best to help you understand. 1. Lattice-Based Cryptography: Utilizes complex lattice structures in high dimensions. Its security is rooted in the hardness of lattice problems like the Shortest Vector Problem, which are not efficiently solvable by quantum algorithms. Used in secure key exchange and encryption schemes. 2. Hash-Based Cryptography: Employs cryptographic hash functions, which are inherently resistant to quantum attacks due to their reliance on problems like pre-image resistance. This approach is pivotal in constructing secure, quantum-resistant digital signatures. 3. Code-Based Cryptography: Centers on the difficulty of decoding randomly generated linear codes, a problem not efficiently tackled by quantum algorithms. It’s primarily applied in robust encryption systems. 4. Multivariate Quadratic Cryptography: Based on solving systems of multivariate quadratic equations, known to be NP-hard. This complexity offers a strong defense against quantum computational attacks. Key Insights: *These algorithms leverage mathematical problems that are currently intractable for quantum computers. *Their development is critical for ensuring security in the face of advancing quantum computing capabilities. *This area is rapidly evolving, necessitating ongoing research and adaptation. #QuantumResilience #AdvancedCryptography #Cybersecurity #QuantumComputing #Encryption

Headline: EU Raises Alarm Over Quantum Cybersecurity Risks as Quantum Tech Accelerates ⸻ Introduction: As the quantum computing race intensifies, the European Union has unveiled a new strategy to harness the transformative potential of quantum technologies. However, this leap forward also triggers a dire warning: current encryption systems face collapse in the wake of quantum advances. Cybersecurity experts are calling it a “quantum security doomsday” — a point at which quantum computers could easily decrypt today’s most trusted digital protections. ⸻ Key Details and Strategic Developments: 1. The EU’s Quantum Strategy and Lag Behind Rivals • The European Commission introduced a new quantum strategy to stimulate investment, convert academic knowledge into economic value, and catch up with the U.S. and China, who lead in quantum research and deployment. • Quantum tech is seen as essential for breakthroughs in drug discovery, battery development, satellite navigation, space defense, and secure communications. 2. The Looming Cybersecurity Crisis • The greatest concern lies in quantum computing’s ability to break public key cryptography, which currently secures: • Online banking • Government and military communications • Personal data on the internet • Once scalable quantum computers arrive, they could instantly defeat RSA and ECC-based encryption, making most digital infrastructure vulnerable to breaches. 3. Urgency of Post-Quantum Security (PQS) • The EU has set a target for critical infrastructure to migrate to post-quantum cryptography by 2030. • This echoes similar moves in the U.S., where NIST has begun formalizing quantum-safe algorithms. • Experts warn of a “harvest now, decrypt later” threat, in which sensitive encrypted data is already being collected for future quantum decryption. 4. Investment and Preparedness Gap • Despite its robust academic research, Europe trails in commercialization and industrial adoption of quantum systems. • The European Commission’s quantum initiative aims to unify efforts across member states, enhance public-private collaboration, and promote quantum-resilient cybersecurity policies. ⸻ Why This Matters: The rise of quantum computing represents both a generational opportunity and an existential cybersecurity threat. While the EU’s strategy signals a proactive stance, the clock is ticking for governments and businesses worldwide to adopt quantum-safe encryption. A delayed response could lead to catastrophic breaches of data, communications, and national security systems. The race to quantum supremacy is not just about speed — it’s about security, resilience, and the ability to future-proof global infrastructure. https://lnkd.in/gEmHdXZy

Shor’s Algorithm Breaks 5-Bit Cryptographic Key. The experiment successfully broke a 5-bit elliptic curve cryptographic key using a quantum attack based on Shor’s algorithm, executed on IBM’s 133-qubit IBM_Torino processor. A key innovation lies in the method’s ability to extract the secret key without directly encoding it into the quantum circuit, enhancing security against certain attacks. The approach focuses on interfering over a specific subgroup of the elliptic curve, allowing researchers to reveal key information through quantum measurement, which manifests as a distinct pattern in the quantum data. https://lnkd.in/ePfJrv5r

"Experts have warned for years that the development of quantum computers could undermine the encryption that currently secures everything from our private messages to our banking details... ...Now Google has put some of that work into practice, in Chrome. The new technology includes new cryptography that should be resistant to attempts to break it with future quantum computers. It does so by integrating a technology known as X25519Kyber768, a long name for what is actually a hybrid of two cryptographic algorithms. Tying the two together means that data is protected both by an existing secure algorithm and one that is protected against quantum computers."