Trending Articles
Trending Topics
Trending
Last year I wrote about The Epoch Time bug and the work that has to be done to remediate this issue. You’ve got 13 years, folks. But I needed a new scare story to keep me entertained whilst working hard on a French beach over Easter, and found it in this post is from HPE: From False Alarms to Real Threats: Protecting Cryptography Against Quantum. The unexpected twist here being that it’s a surprisingly good read.
The modern world relies on cryptography for everything from proving who you are to online banking. Everyone knows that. Less well known: there are actually two types of cryptography, symmetric and asymmetric.
Symmetric is the one that everyone thinks of. It’s called Secret Key Encryption. Put simply, it uses a secret code or key to scramble something and then you use the same key to turn it back into what it was originally. In computing terms, this is a quick and easy way to encrypt and decrypt, but issues arise with how you share the key. If it falls into the wrong hands, your data is open to all.
Asymmetric cryptography to the rescue! However, this is computationally expensive and complex. It uses two very large prime numbers and allows them to be linked, so that you can encrypt if you know the resultant multiple number and one of the prime numbers. If you have the other prime, you can decrypt.
That is a very simplified way to explain, but the details don’t matter. What’s important is that this type of encryption relies on the fact that division at this scale is very slow and difficult. You can’t find the second prime if you have the first and the multiple number.
These numbers are called certificates, and they protect everything and can be used in three ways. To prove who you are, to scramble a message and to check that the message once received has not been tampered with. The final thing to know is this method is called public key encryption.
So we use public key encryption to start a computer communication to make sure that only the right computers can communicate. Using that secure connection, the computers set up a long and random shared key. A secret key that will only used for this one connection and then thrown away.
Once they both ends have the secret shared key they drop the public key encryption and reconnect using the one-time secret key encryption. So one type of encryption is used to authenticate each end and share a secret so that a second type of encryption can be used.
All very interesting, I hear you say, but what has this to do with the HP blog post?
Modern computers use binary bits with a value of 1 or 0 to work. In fact, computer circuitry is now so small that “bit flipping” has been a problem for years: for example, a nearby 1 makes the 0 on the side of it turn to a 1. There are even computer attacks that rely on this attack called Rowhammer attacks.
Quantum computers don’t use ‘bits’. Instead, they use ‘qubits’ and a qubit can be both a 1 and 0 at the same time. In effect, they’re probabilistic. And one of the effects this can have is that division of numbers becomes very easy.
This matters because almost every aspect of modern society is based on one fact: that it’s difficult to divide large numbers. And here comes this new type of computer that makes long number division simple.
Luckily, clever people who wear lab coats have seen this coming for a while. And that means new types of encryption algorithms have been invented called Post Quantum Encryption.
This is no longer theory. It’s starting to be rolled out to be used now.
In the blog post, HPE spoke to quantum computer specialists. The headline is that experts think there is a 50% chance of a quantum computer being powerful enough to break modern cryptography by 2034 and it’s almost certain by 2040.
This is a problem. Even in the fast-moving world of computing there are devices being bought now that will be working in a decade or longer. It’s even worse in the IoT space, where they haven’t even thought about this or that internet connected microwave/fridge/doorbell is never going to be quantum safe.
But I don’t have an IoT fridge I hear you cry. Why does this matter to me? Well, we know that the NSA (the US spy agency) has a number of datacentres that are recording everything on the internet. Before we knew this, almost nothing was encrypted. Once it was known, encryption was applied to most things – for example, every reputable website is using encryption permanently and by default.
However, the NSA has its own people in lab coats and they also knew what was coming down the line. Instead of closing these datacentres, they were expanded and many believe that the internet is now just recorded.
The NSA may not be able to read the content of those messages today, but once a quantum computer appears that all changes. Breaking today’s encryption will be as easy as slitting open an envelope.
Whilst we know about the US, it’s very likely that other governments around the world are doing the same. Further, if they had a working large enough quantum computer it is also likely that they would keep very quiet about it, just like the Britain did about the codebreaking computers used at Bletchley Park machines during World War 2.
All of this means that today’s traffic is going to be unencrypted in under two decades. Along with encrypted hard drives and any other password protection you may currently rely on.
This might be good for the people that have forgotten the password to their password-protected Excel and Word documents – you know how you are – but generally it is going to break everything. We need to start preparing for this yesterday and we are not.
So when I get back to the office, what will I be doing in my nominated role as grumpy IT manager?
I’ll start by making sure that all my new kit and services has a requirement that is has post quantum encryption as an option. Then I’ll use it.
I will also investigate what data is swirling around the network and how that is protected. I have to assume that data will leak onto the internet and become transparent in the future, so time for a proper risk assessment.
Finally, I’ll create a roadmap for all services and equipment to make sure it’s replaced or upgraded to allow post quantum encryption.
Still, it could be worse. I don’t have IoT devices that will never have that sort of upgrade and may still be around in a decade. Can you say the same?
