Post-Quantum Crypto Standards Aren’t All About the Math

The race for developing post-quantum cryptographic standards is well underway. Already the brightest minds in cryptographic research are in the middle of duking it out to decide what the best methods will be to make sure encrypted secrets stay safe from the brute-force computing power of quantum computers.

As experts explain, quantum computers will very soon render most of today's advanced cryptographic methods obsolete. The window of when that will realistically happen is up for debate, but recent developments, such as IBM's release of its first commercial quantum computer last month, show that it's definitely on the foreseeable horizon. 

"There's a huge transition that we're facing," says Dr. Brian LaMacchia, a distinguished engineer and head of the Security and Cryptography Group at Microsoft Research. "[It's] bigger than the transition from MD5 to SHA-1 hash functions or SHA-1 to SHA-2 because we effectively need to upgrade everything that uses public key cryptography before the advent of quantum computers."

Even if quantum computers don't proliferate until 2030, that's not a whole lot of time to account for a cryptographic transition like this, he says. That is why NIST is running a competition among academics to test and prod different theoretical ways to solve the post-quantum cryptography problem. It has been going for a little over a year now, and recently it whittled down proposed methods by more than half. LaMacchia's team at Microsoft submitted four different methods, all of which are among the remaining 26 proposals.

As the competition kicks into its next phase, LaMacchia and others, including Avesta Hojjati, head of DigiCert Labs, say the industry needs to be mindful of the complete picture of how encryption is applied today as they make decisions for the post-quantum world. The math is only part of the equation, they explain. Researchers and security architects also need to be mindful of how a proposed solution is going to work within the limitations of where hardware and software stacks are going in the coming decades. 

In particular, they'll need to think about the encryption of widespread Internet of Things (IoT) devices, many of which will require researchers to consider two major factors: lifespan and compute limitations.

"IoT devices are widely used, and they have a very long life cycle after they're deployed," Hojjati says. "You can imagine a sensor that will be deployed in an ocean to collect information about climate change will probably reside in that ocean for the next 20 to 60 years, and that sensor requires some kind of security.”

Not only are IoT devices long-lived, but they're often completely integrated into expensive equipment that has physical safety implications. Take cars, for instance, which have tons of IoT devices built into their controller units. The point is that the expense will be very high for organizations to change out cryptographic methods on these kinds of devices once they're in the field. That means researchers need to get it right out of the gate.

"Of all of the quantum-resistant algorithms that are currently under consideration, none of them actually has the performance and key size characteristics combined that something like RSA does. So either it takes you longer to do the key setup or a key encryption, or the public key is significantly larger, or the amount of data you have to transfer is significantly larger than what we're used to," LaMacchia says. "You actually want to test this out now to figure out whether or not your engineering is going to be able to handle the larger key sizes or whatever the performance characteristics come of whatever eventually gets standardized. It's important to make sure you don't have an implicit limitation somewhere in your software stack."

This was the rationale behind recent testing that LaMacchia's and Hojjati's teams conducted with Utimaco to see whether one of Microsoft's algorithms would play nicely with certificates issued by DigiCert and used with Utimaco Hardware Security Modules.  

Moving forward, additional methods will be needed that generally smooth the transition to quantum safe cryptography without compromising the security or stability of existing encryption applications, LaMacchia says. This is going to take a hybrid approach, he adds, as the community proves out the quirks and limitation of these new cryptographic methods.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.