NewsCSO OnlinePublic sectorFinanceICS / OT (industrial control)

    Post-quantum cryptography adoption and the national security implications

    Quantum computers have advanced significantly in capability and compute power in the last several years and are turning theoretical vulnerabilities in modern cryptography into real-world threats. The shift to post-quantum cryptography (PQC) needs to start now, but several challenges need to be overcome. One is: How do you convince people of the urgency that this not-quite-ready new technology represents? I will argue that this technology will favor the nation-state actors over cyber criminals and ransomware gangs and therefore make it harder to convince those that aren’t already a target of nation-states of the threat. This dynamic will create gaps that governments can exploit either covertly, as part of an open conflict or through state-sponsored economic espionage. The current state of quantum compute Because quantum computers have computers in the name, many people think these systems will replace their existing traditional computers. The better way of thinking about them is as specialized devices that augment existing computers like graphics cards do today. Quantum computers are being designed to run specific algorithms that are specialized in solving specific problems, such as breaking cryptographic systems. Quantum systems, like Google’s Quantum AI , are also physically big, with supporting infrastructure usually taking up an entire room. The significant capital and know-how required to build these systems will likely make them off-limits to all but a handful of corporations and governments for the foreseeable future. Unless there is a major breakthrough in quantum computers with size and cost, there will likely remain a significant barrier to entry and gatekeepers to public access akin to the early days of computers with mainframes and terminals. We saw this play out briefly when Anthropic released Mythos and the US Government immediately put restrictions on it due to national security concerns. This is in contrast to the democratizing nature that AI has had with cyberattacks, regardless of the model. There is still a significant debate as to when quantum computers will be able to break modern asymmetric cryptographic systems like RSA or Elliptic Curve Cryptography (ECC). RSA, for example, claims we are still a ways off before this is a realistic threat, if ever. Google, on the other hand, says it may be as soon as 2029. Both of these companies have skin in the game, but even independent cryptographic experts like Filippo Valsorda are sounding the alarm. Valsorda argues convincingly, “The bet is not ‘are you 100% sure a CRQC [cryptographically relevant quantum computer] will exist in 2030?’, the bet is ‘are you 100% sure a CRQC will NOT exist in 2030?’ I simply don’t see how a non-expert can look at what the experts are saying, and decide ‘I know better, there is in fact < 1% chance.’ Assigning a risk value How do you assign risk to a future threat like quantum? Impact and likelihood are the two classical inputs to risk. The impact that quantum computers pose to existing asymmetric encryption is very high and can potentially result in uncovering significant amounts of encrypted data in motion or at rest. The impact is obvious for organizations such as banks, governments, military and anyone that deals with confidential information. This threat also opens up the door to attackers harvesting now and decrypting later when the quantum matures. This means hackers with existing access to a network or encrypted communications link can collect encrypted information with the intent of decrypting it later. This may be trivial if the information is time-sensitive and long since expired, but the damage could be severe in cases such as encrypted intellectual property. So, the impact is pretty evident, but it’s the likelihood where things get complicated. First, there is the likelihood that this won’t happen at all, as well as that it won’t happen on a time scale that matters for current investment strategies. The remaining likelihood points to an increasingly near-term threat. How do the players that will have access to the technology play into this? As mentioned, quantum will likely remain confined to governments and large companies, with the remaining public likely vetted and monitored. So, if your organization isn’t currently targeted by a nation-state actor or groups that have access to future quantum computers, is there an impact to them? If most of the time the only compromise is to confidentiality, but relatively little monetary impact, is the risk acceptable to most organizations? With the exception of North Korea, few nation-states cause financial damage as a result of their activities (beyond possible regulatory/compliance fines). Much of their activities are driven by national security concerns like intelligence collection and posturing for future cyber support to a real-world conflict, not financial. Organizations that are already targets of nation-state actors, such as governments, tech companies, large financial companies and nuclear facilities, will be the first to adopt PQC technology, while thinner-margin companies will likely push it to the back burner due to lack of perceived risk and limited resources. National security risk These conditions will likely leave large numbers of organizations vital to national security unable or unwilling to upgrade and therefore open themselves up to exploitation by nation-state actors. The gap between individual organizations’ desire to pay and the cost of collective defense needs to be covered somehow. This will also amplify the already existing cybersecurity issues with critical infrastructure, creating even more vulnerable networks. Sectors like municipal utilities, small hospitals, critical manufacturing and local government emergency services will likely struggle to upgrade systems to PQC. This vulnerability will further enable nation-state actors to leverage existing access to critical infrastructure, as seen in attacks like Salt Typhoon , to gain access to new networks and data. This could enable collecting sensitive information such as classified materials or corporate intellectual property. It can also enable access to networks to position for effects during a time of conflict. Things like disrupting communications, destroying data or gaining access to control systems for physical equipment. Nation-state actors could also enable state-aligned hacking groups to conduct operations that they themselves don’t want attribution towards. All of this happens now, but access to quantum computers will blow the doors off previously inaccessible systems and sensitive data. Possible solutions Solutions are already widely available, with NIST publishing PQS standards (FIPS 203-205) and multiple commercial companies offering PQC solutions. But adoption will be slow due to the large amounts of critical software and hardware that will have to be upgraded. Five things can help with the transition. The new solutions will also need to be agile in case vulnerabilities in the new systems arise, known as crypto agility . First, government mandates can require adoption. The recent Executive Order EO 14412 establishes a more rapid adoption of PQC systems within the Federal government. Governments should further look to incentivize critical infrastructure companies to adopt PQC systems by either further mandates or potentially tax incentives. Further regulations and compliance standards can force PQC adoption; for example, PCI DSS or ISO 27001 could explicitly require PQC. A second method for wider adoption is having cloud service providers, network stacks (TLS) and software libraries switch to PQC algorithms by default. In many cases, this will transparently migrate many users to the new standards. Organizations can potentially use the quantum threat to push for greater cloud integration where PQC systems are already offered (i.e. Google , AWS ). If costs and complexity are too great, a third option would be to prioritize the most critical network elements and storage systems. Then upgrade these systems to either newer PQC systems or if even that is too difficult, update the existing keys to larger keys, for example, RSA 2048 to RSA 4096 or AES-128 to AES-256 to buy some more time. Fourth, awareness of the need for PQC among cybersecurity professionals narrowly and business executives broadly. Corporate boards and senior executives will be the ones making the call on whether to upgrade vulnerable systems and need to understand the risks of this technology. Lastly, in line with the fourth, universities and colleges should expand class offerings to include quantum computing as well as specific cybersecurity solutions in order to build a workforce capable of both harvesting the power of quantum as well as guarding against the ramifications of this new technology.

    More on Post-quantum

    Other advisories

    Other news entries

    Source: https://www.csoonline.com/article/4219777/post-quantum-cryptography-adoption-and-the-national-security-implications.html

    ID