Withstanding the PQC temptation
The year is 2026 BC. The entire world is implementing PQC to resist quantum computers… Well not entirely. One small company with indomitable cryptographers and risk analysts refuse to blindingly implement PQC (Post-Quantum Cryptography) for everything.
Consider being like Asterix’s small Gaul village, withstanding the quantum threat, while saving money and refusing to waste resources. (I’m not talking about the blatant resource use of blockchain and AI!)
It may sound crazy, but at the end of this article I’ll show you a company that indeed does this: not implement PQC right away, but use a risk based approach. And I expect other companies to follow soon.
The Quantum threat
By now almost everybody knows that some companies are spending huge amounts of money on quantum computers. The researchers are using super advanced technology to build devices that in theory could break “almost all cryptography”. That is not really true, but that’s what some people want you to believe.
The most pressing threat from quantum computers is the “harvest now, decrypt later” attack, in which an adversary intercepts and stores encrypted traffic, waiting for the day when decryption becomes computationally feasible. This is not merely a theoretical danger: we know our communication is being intercepted today. Other, less immediate threats, such as the forgery of digital signatures, pose a different kind of risk. While these do not require updating our cryptography today, they will become critical the moment a relevant quantum computer becomes available. And since changing takes time, you still need to be prepared to redesign your systems soon.
The official recommendation
Many governance organizations now give official recommendations about how to deal with the quantum threat. I wrote about this earlier; I wholeheartedly subscribe to their recommendations.
An alternative approach
But what I see happening around me is that many companies are starting to implement PQC solutions to all their cryptography, without considering the balance between cost and risk. There is a better way: it is called Risk Management. Simply put, risk management is about looking at your options and comparing them in a systematic way. This includes the option of taking no action at all: if the measures are costly, the probability of adverse effects is low, and the damage limited, this could be the best option.
Another important factor to take into account is compliancy that is imposed by regulating bodies. Because of the intimidatingly large fees involved, companies concentrate on being compliant. They tend to forget that proper security is best controlled by a risk management process, optimizing cost by concentrating on the important things. (I wrote about this earlier.) This becomes even more true for PQC: the new proposed algorithms are expensive to implement, on top of the implementation process itself.
All this is happening while there are no working quantum computers. In fact it could be the case that building useful quantum computers is impossible to build. This is argued here by Sabine Hossenfelder. Also, Gil Kalai, M.I. Dyakonov and Leonid A. Levin each have their own arguments putting the quantum computer in question. Finally, Hoefler, Häner and Troyer showed in their research that the promised short term applications turn of quantum computers are no better than simulations on regular computers.
It is surprising how successful the quantum marketing machine is. There are more direct threats to our lives that need action, like climate change or drought, but the hype goes on. Publication that promise “quantum supremacy” or “break RSA” occur regularly; each publication turns out to be, at best, an overly optimistic view on future development. (I wrote about one of these “RSA is broken” claims.)
Example risk analysis
To give you an idea, I’ll make up an imaginary example that shows how to realistically mitigate quantum threats in a (more or less) realistic situation.
Let’s say you run a social media platform, that uses smart cards to log into the platform. If done properly, this would be a pretty secure (albeit complicated) way to protect accounts.
Your CEO just heard about quantum computers. Alas, he heard the story as it is hyped, from a one of these company that built their own quantum computer. He got scared by their optimism. He decides that from today, everything needs to be protected with PQC cryptography, whatever the cost. Since your smart cards are RSA based, this would mean replacing all smart cards with new smart cards that can do PQC computations. Such cards do already exist, but they aren’t cheap!
Fortunately, you know how to do risk management. You tell your CEO that you understand his worry, but that implementation PQC just like that would be the end of the company. You do a risk analysis specific for quantum computer risks. Simply put, you ask yourself these four questions:
Question 1: What are you afraid of? In other words, what do you want to protect? For example, the risk of theft of a smart card is irrelevant, because it doesn’t change. But reputation loss needs to be considered, if a rumour would start that “your system is breakable” because of the quantum computer attack. Specifically you have to look at cryptographic attacks with a “Cryptographically Relevant Quantum Computer” (CRQC).
Question 2: How much damage could occur? In other words, how much damage can an attacker do? Specifically, we are interested in attacks that are possible with a CRQC that weren’t possible before. This means that asymmetric algorithms like RSA and ECC are in danger.
Question 3: How likely is that this is going to happen? In our specific case this depends on two factors. First, when is this CRQC expected to be there? Second, if an attacker has a CRQC, are they going to use it against us? This latter factor is often ignored!
Question 4: What measures can you take to prevent or mitigate this risk, and how much do they cost?
Let’s have a good look at the questions, one by one.
Question 1: scope
Because you have a social media platform, privacy of user data is most important. The risk is that user data gets stolen. Second, you also don’t want to lose data because then the platform wouldn’t work anymore because of an attack.
Get Jurjen Bos’s stories in your inbox
Join Medium for free to get updates from this writer.
I estimate the biggest risk is reputation loss because of a cyberattack where data is stolen (i.e. copied) by someone breaking the cryptography. This could lead to clients changing into a service of the competition.
The risk of pure data loss isn’t significant for the risk analysis, because quantum computers are not a threat here.
Question 2: damage
The amount of damage depends on the way our system is attacked. If the attacker breaks into a single account, only that user’s data could be stolen. If the attacker somehow manages to get into the entire database, all data is at risk. From the viewpoint of reputation risk, stolen data from a single account is almost as big a risk as stolen data from the main database.
Specifically, I can imagine a few attacks:
- Somehow breaking the smart card cryptography and logging into the account of a customer, reading her data. This would require getting access to a smart card in order to steal the keys. Once the keys are stolen, they can be used to log in.
- Somehow accessing the account without the card (for example by eavesdropping on the login conversation) and then decrypting the encrypted data by breaking the cryptography.
- Breaking into the database directly (by breaking into the system account) using a cryptographic attack. The damage would be very big in this case.
- There are a few other attacks that aren’t relevant because they are out of scope (such as stealing smart cards, or asking for a replacement card and stealing it in the mail): they do not depend on quantum computers. Also, the common threat of the database being attacked using some kind of weakness in the web site is irrelevant: this risk was already there (and it is probably quite big).
Question 3: likelihood
In order to estimate the likelihood of these attacks, we should have a good look what a CRQC can do. All over the internet there are claims on what amazing things a CRQC can do. Most of these are exaggerated. Instead, let’s turn it around and show you what a quantum computer cannot do. A quantum computer can not:
- Break AES, even AES-128, in the near future. According to NIST’s PQC FAQ, AES-128 “will stay secure for decades to come”.
- Break RSA, even 2048 bits RSA, anytime soon. Quoting “EMVCo Position Statement Quantum Computing and EMV® Chip Cryptography”, a current quantum computer “[…] performs 20–30 gate operations before descending to useless noise, whereas over 2 billion sequential and error free gate operations are required to execute Shor’s algorithm [3] to break RSA-2048”. That same paper estimates the moment RSA-2048 is going to be broken somewhere between 2040 and “never”.
- Break keys for little cost. Although the published estimates for quantum computers breaking RSA-2048 claim “10,000 qubits” or “8 hours”, you don’t get both at the same time: the 10,000 qubits computation would take 27 years, and the 8 hours computation costs 20 million qubits. In either case, you would have to spend a fortune on electricity, several million $ at least. Most current so called “quantum computers” rely on Helium-3, an element that is so rare and expensive they are considering mining it from the moon to cover the demand for future quantum computers.
What remains is that an attacker with a CRQC can break a few of your keys, one by one, for considerable cost, far in the future. That would be quite useless. The real threat is the system account, where a single attack could cause a lot of damage.
Question 4: mitigation
So now we can go into details that depend on the cryptographic design of our social media platform.
First, since we found that the risk of breaking into the system account is the biggest, we must make sure the access to this account cannot be attacked using a quantum computer. There are many ways to do this with current technology, and there are good PQC algorithms for this. This is just a single account, the costs are going to be relatively low.
It if very unlikely that the threat of attacking user’s smart cards are going to make any difference, regardless of the technology used. Most smart cards for access control using a basic symmetric algorithm such as AES or HMAC. Such cards are already PQC compliant, and do not need to change. If RSA is used, and it is long enough, the cost of attacking is going to be very high, not worth it for access a single user’s data. The only exception would be an Advance Persistent Threat such as a state level adversary targeting a single user that has data that is very important to them. But to be honest, they aren’t going to wait for a quantum computer, they have enough other ways to get to the user’s data (like breaking into their house or kidnapping).
Conclusion
You report to your CEO that you analyzed the situation. You tell him that you are going to strengthen the access control to the systems account, which will increase the security of the entire application, and that this is going to be useful, regardless of PQC threats. And you can tell him that thanks to this risk analysis, you found out there’s nothing to do.
You just saved yourself an enormous amount of money and time, just by being reasonable. And you even have a report to show to others (auditors!) that you know what you’re doing.
This story isn’t completely fictional. For example, EMVco already published a report that carefully estimates the PQC risk instead of wasting money trying to make every credit card in the world PQC compliant. Also EP2 gave out a limited statement explaining why they think the risk to their systems isn’t immediate.
For the future, I expect more companies showing that “quantum computer risk” doesn’t necessarily require direct action. Instead, they’ll publish a risk analysis that shows where they will make measures where needed, possibly even choosing to persist in using “weak” algorithms like RSA in cases where is just isn’t worth the trouble to break them. Remember, even RSA-1024, which is already considered “too weak” by almost every organization I’ve seen, is still unbroken (with or without quantum computers), and I expect this to stay unbroken for the next decade!
Such a risk analysis will not only save you a lot of money, but it will give you valuable insight in the security measures you need to stay secure.
