Fortanix Tackles Quantum Computing Threats With New Algorithms – Source: www.darkreading.com

3 Min Read

Source: adam121 via Adobe Stock Photo

Fortanix has implemented post-quantum cryptographic (PQC) standards approved by the National Institute of Standards and Technology (NIST) in its Fortanix Data Security Manager service to create post-quantum safe signatures and protect data using post-quantum safe cryptography.

“We are heading, in very short order, toward the level of computational capacity with a quantum computer that is threatening to legacy cryptography,” says Richard Searle, chief AI officer at Fortanix.

Two recent announcements of new quantum chips — Google’s Willow and Microsoft’s Majorana 1 — have advanced the timetable for stable quantum computers that could fully break asymmetric cryptography to a few years. Gartner previously suggested those systems could come in 2034.

Quantum computers — which have been under development for decades — provide more computational capabilities than conventional computers. But scientists have faced challenges breaking through theoretical layers and developing a system that behaves consistently.

“Customers of the security industry need to take note that … the days of planning and thinking about moving to post-quantum cryptography have really got to be behind us,” Searle says.

A tool called Key Insight allows customers to see where cryptographic keys are being used in the cloud environment and their condition in terms of the algorithms.

“By implementing policies against different applications, you can migrate those to post-quantum cryptographic standards,” Searle says.

Implementing Post-Quantum Cryptographic Standards

NIST approved the post-quantum cryptographic standards — FIPS 203, FIPS 204, and FIPS 205 — last August. These algorithms are still the subject of ongoing research by the security community in academia and industry, and their possible flaws could be discovered.

“There have been various papers published that have presented different types of attacks on these algorithms. They’ve all been debunked so far. But that’s not to say that something could not happen in the future,” Searle says.

The algorithms specifically protect against attacks that Searle calls “harvest now, decrypt later.” In this attack, hackers can harvest sensitive data from systems, store it, and then decrypt it when relevant quantum computers become available.

State actors like China are secretly developing quantum computers behind the scenes. The recent Salt Typhoon attack from China against telecommunications companies is just another reminder for companies to protect data, Searle says.

“China is investing huge sums of money — almost three times the rest of the world — to develop quantum technology and also looking at topological quantum computation, of which Majorana 1 is the first manifestation,” Searle says.

Concerns About Quantum Computing

The biggest concern about quantum computing is its potential ability for bad actors to use it as a battering ram or scalpel to penetrate security protections on government, defense, banking, or any other vital systems, says Dan Olds, principal analyst at Olds Research. Entities that are part of the financial system, such as banks and exchanges, are at risk. Any organization that has proprietary intellectual property, data, or communications could also be a target.

“Breaking today’s encryption schemes would open up all of these organizations,” Olds says. “That might sound overly ominous, but I don’t think it’s an overstatement.”

The prospect of threat actors harvesting data now to decrypt later is concerning, but in some cases the sensitive data could decay over time and be useless by the time a quantum computer is available to crack it, says James Sanders, an analyst at TechInsights.

“The per-key cost in both operating time and cost will remain quite high,” Sanders says. “Such a system would need to crack a single key within 24 hours to be moderately useful.”

The most likely source for data breaches will remain social engineering, but good security hygiene requires keeping up with industry standards, and NIST is addressing the concerns posed by future quantum computers, Sanders said.

“Establishing a roadmap to adopting quantum-resistant cryptographic standards is advisable, though like any infrastructure upgrade, this comes with an implementation cost,” Sanders says.

About the Author