Post-Quantum Cryptography Strategies

Recently many of us might have hear about the risk that modern cryptography face because of quantum computers and their computational capabilities. There we have seen new guidelines being released and many people talk about the need to develop quantum ressilent algorithms. But what are they ? Let's have an overview of some of such algos, what it is and how it works. It might be a bit complicated but I will try my best to help you understand. 1. Lattice-Based Cryptography: Utilizes complex lattice structures in high dimensions. Its security is rooted in the hardness of lattice problems like the Shortest Vector Problem, which are not efficiently solvable by quantum algorithms. Used in secure key exchange and encryption schemes. 2. Hash-Based Cryptography: Employs cryptographic hash functions, which are inherently resistant to quantum attacks due to their reliance on problems like pre-image resistance. This approach is pivotal in constructing secure, quantum-resistant digital signatures. 3. Code-Based Cryptography: Centers on the difficulty of decoding randomly generated linear codes, a problem not efficiently tackled by quantum algorithms. It’s primarily applied in robust encryption systems. 4. Multivariate Quadratic Cryptography: Based on solving systems of multivariate quadratic equations, known to be NP-hard. This complexity offers a strong defense against quantum computational attacks. Key Insights: *These algorithms leverage mathematical problems that are currently intractable for quantum computers. *Their development is critical for ensuring security in the face of advancing quantum computing capabilities. *This area is rapidly evolving, necessitating ongoing research and adaptation. #QuantumResilience #AdvancedCryptography #Cybersecurity #QuantumComputing #Encryption

The Day a Bank Vanished Without a Trace It’s 2:17 AM, 2029. A top global bank wakes to a nightmare: $1.4 trillion in assets gone. No alarms. No hacks. No trace. The keys? Valid. The transactions? Legitimate. By dawn, the bank’s treasury is erased...wiped out by a quantum computer that cracked 2048-bit encryption in seconds. This isn’t sci-fi. It’s our future. The Statistic That Keeps Me Up at Night: Experts predict that in 5–7 years, quantum computers will shatter 65% of the world’s encryption protocols. AI transformed finance. But when quantum + AI collide, the rules of money, trust, and security will be rewritten overnight. What’s Coming? * Portfolio optimization in milliseconds. * Fraud detection that outsmarts today’s AI. * And, every private key you rely on? Vulnerable. This is the financial superstorm. 5 Steps to Quantum-Proof Finance 1. Switch to Quantum-Safe Encryption NOW Don’t wait for standards. Move critical systems to post-quantum algorithms today. 2. Simulate Quantum Risks Model how quantum + AI will disrupt pricing, risk, and fraud. 3. Build Regulatory Sandboxes Partner with regulators to test quantum innovations without destabilizing the system. 4. Rethink Digital Identity Keys alone won’t cut it. Blend biometrics, behavioral analytics, and decentralized IDs. 5. Unite for Defense No bank or nation can do this alone. Form alliances across finance, tech, and security. This isn’t a distant threat. It’s a countdown. When it hits zero, trillions in assets and our trust in the system are at stake. The question isn’t if a quantum breach will happen...it’s when. What’s your take? Are we sleepwalking into a crisis? Let me know below. #QuantumFinance #Cybersecurity #FutureOfMoney #Innovation

The problems that we once called “NP-complete” probably should now be rephrased “NP-complete with conventional computers” because they may no longer be NP-complete when Quantum Computers are used. As an example, the binary satisfiability problem or 3SAT can potentially be reduced, using Grover’s algorithm, to a non-NP problem. For algorithm researchers, Quantum Computing is a huge breakthrough. But for security researchers, this is a major headache. Classical cryptographic systems, such as RSA and ECC, essentially rely on the difficulty of problems like integer factorization and discrete logarithms. Quantum algorithms, particularly Shor's algorithm, can solve these problems efficiently, potentially breaking these cryptosystems.   Post-quantum cryptography focuses on developing algorithms that remain secure even in the presence of quantum computers. These algorithms are based on mathematical problems that are believed to be hard for both classical and quantum computers. Some examples include Lattice-based cryptography, based on the hardness of lattice problems; code-based cryptography that uses error-correcting codes and is based on problems like the syndrome decoding problem; more advanced hash-based cryptography that includes schemes like Merkle tree signatures; multivariate polynomial cryptography that is based on the difficulty of solving systems of multivariate polynomial equations; and Super-singular elliptic curve isogeny cryptography (SIDH) that utilizes the difficulty of finding isogenies between super-singular elliptic curves. It is a very important problem to solve and I’m so glad that Intel is actively working on it. My crypto team recently completed a POC project on it.  

We are now in the exciting early adopter phase of the post-quantum cryptography transition. The last year has seen some major developments. In November 2022, Google deployed post-quantum cryptography for internal communications (https://lnkd.in/et6g8_3S) and then by August 2023, post-quantum cryptography was being rolled out within the Chrome browser (https://lnkd.in/ek2cTrUe), marking a significant milestone in securing web traffic against the quantum threat. Concurrently, Cloudflare, which underpins a significant portion of the web, introduced PQ cryptography compatible with Chrome and announcer today that they  use it for internal communications and communication to origin servers (https://lnkd.in/e5Qb3475). This means by the end of this year, a substantial percentage of web traffic could be safeguarded by post-quantum cryptography using proposed standards by NIST (https://lnkd.in/eMb-dBqV)! The transition to post-quantum cryptography is not just a technological shift, but a critical step towards ensuring long-term data safety. As businesses, transitioning both internal and external-facing services to support post-quantum cryptography is imperative. NIST has provided insightful guidance for businesses on how to approach this transition: https://lnkd.in/eyxFAixY Having been personally involved in the realm of post-quantum cryptography for half a decade, it's been a rewarding journey to witness and contribute to the industry's evolution. My work with Cloudflare on its industry-leading transition to post-quantum cryptography has been one of the many high points in this endeavor. As the industry navigates through this transitional phase, I am open for consultations to share insights and help other organizations on this path. Feel free to connect via https://lnkd.in/ehWtWwAu. #PostQuantumCryptography #Cybersecurity #DataProtection #NIST #Google #Cloudflare #Chrome

IBM in Davos: Cybersecurity Armageddon is coming! Well, maybe not. IBM is known for its serious roadmaps about its technical developments and has also adhered to its #Quantum Development Roadmap very well so far. The progress is great, and also the extensions and improvements to the Open Source Framework #Qiskit, which aims to make it easier for the widest possible audience to start programming and using Quantum Computers (#QC), are exemplary - and necessary, because it is still unclear what future QCs will be able to do and the limitations are greater than the many hype reports sometimes lead us to believe or hope; further and increasing research in this area is therefore very important. The announcement of a "Cybersecurity Armageddon" caused by upcoming QCs at the World Economic Forum in #Davos was therefore unusual. While some expectations cannot be fulfilled by QCs, the danger of breaking today's Public Key Cryptography using Shor's Algorithm is certainly present. But so are the possibilities to protect oneself: the National Institute of Standards and Technology (NIST) published the drafts for the first Post-Quantum Cryptography (#PQC) standards, which should appear this year, a few months ago. Also, for almost half a year now, #X25519Kyber768 Hybrid PQC can be activated and used experimentally in Google's #Chrome #browser. This by far does not mean that the #crypto is perfect and cannot be attacked and rendered obsolete tomorrow, but merely shows how easy an adaptation can be – at least in some areas. Where computing power is limited and legacy systems that cannot be updated are used (and banks are just one example, albeit a very important one), a changeover is, of course, more complex and costly - and against the backdrop of new requirements, for example regarding energy efficiency for data centers in the #EU (the associated additional computing requirements for PQC algorithms can be quite considerable), there are a variety of challenges. But it's not as if we're sliding towards Armageddon without alternatives and protection options. The extent to which QCs will be able to realistically crack today's 2048-bit #RSA #encryption in 2030 remains to be seen: even the #Starling Quantum Processor with 100M gates and 200 qubits predicted in the IBM Roadmap for 2029 might not be enough for this job.

The National Cyber Security Centre (NCSC) has recently published new guidance on migrating to post-quantum cryptography (PQC) to address the potential threat posed by future quantum computers to our current public-key cryptography (PKC) systems. Key takeaways: 1. PQC is resistant to attacks by both quantum and classical computers, offering similar functionality to PKC. 2. The migration to PQC is a complex undertaking, requiring re-engineering protocols and services. 3. NIST has published draft standards for PQC algorithms, marking the beginning of a global IT migration project. 4. Upgrading internet services and apps will likely be easier than transitioning legacy and sector-specific protocols, including those in critical national infrastructure. 5. For many use cases, PQC transition will happen through software updates issued by service providers. Organizations must start planning their migration to PQC, experimenting with implementations, and assessing performance in essential use cases. The NCSC's guidance on algorithm choices and protocol considerations will be invaluable in this process. #cybersecurity #quantumcomputing #postquantumcryptography

AI is not the greatest risk to humanity—it’s quantum computing. The recent discovery of backdoors implanted by Chinese government-backed hackers is a precursor to a growing threat - quantum risk. A notable concern is the Harvest Now, Decrypt Later strategy, where malicious entities collect and store encrypted data. They may be unable to decrypt it now, but with advanced computing technology, they can shatter encryption norms in the future. Harvest Now, Decrypt Later is serious because big data is big business: • 5.2 billion internet users worldwide • 2.5 quintillion bytes of data generated daily • 44 zettabytes live in the digital universe Since you started reading this, humans generated 3.2GB of new data. Quantum computing is 158M times faster than today’s most sophisticated supercomputer (a fighter jet is only 50k times faster than a snail). In four minutes, a quantum computer could do what it would take a traditional supercomputer 10,000 years to accomplish. Quantum computing requires frigid temperatures, as sub-atomic particles must be as close as possible to a stationary state to be measured. The cores of D-Wave quantum computers operate at -460 degrees f, or -273 degrees c, which is 0.02 degrees away from absolute zero. At a quantum level, science fiction is reality. Particles travel backward or forward in time and teleport between two positions. It has been theorized that qubits can exist in two states simultaneously because we observe them in multiple universes simultaneously. From high-value assets like DNA sequences, weapons data, and intellectual property to seemingly trivial data, all are in jeopardy. The entity breaking the cryptographic barriers can reap an unprecedented transfer of intellectual capital and wealth. Data harvesting typically occurs at points of high data concentration, such as data centers and server hubs. The ease of tapping into data streams has grown exponentially due to the reduction in data storage costs and low-cost interception methods. Geopolitics further heightens the risks. The expansion of Huawei's 5G network hardware could facilitate data interception on a massive scale. To counter these looming threats, a thorough understanding of quantum security is crucial. While some may view AES as quantum-safe, its security relies on the RSA mechanism used for key distribution, which isn't quantum-resistant. Once RSA encryption is broken, all corresponding AES keys are exposed, unveiling the nature of quantum risk. Together, we can reduce quantum risk in 3 steps: 1. Understand encryption key management and identify quantum-vulnerable algorithms. 2. Align key transmissions with NIST PQC standards. 3. Transition to NIST PQC standards for quantum-resistant cryptography. The clouds of quantum risks are on the horizon. By acting today, we can navigate evolving threats and secure a safer digital future.