Preparing for post quantum computing will be more difficult than the millenium bug

The transformation needed for organisations in the UK to be ready for the threat of post-quantum computing will make preparations for the millennium bug, which threatened computer systems in 2020, “look easy," cyber chiefs said today.

Ollie Whitehouse, chief technology officer of the National Cyber Security Centre (NCSC), said that preparing for post-quantum cryptography (PQC) will take “a complex change programme” and would be a “colossal task”.

The ten-year, UK-wide PQC programme will require organisations to identify every instance of cryptographic code, to understand whether it is vulnerable to attack by a quantum computer, and to put plans in place to mitigate the risk. 

It mirrors the massive effort that the UK government and companies undertook to fix software throughout their estate when it threatened to malfunction on the first day of the year 2000 because of the way programmers calculated dates.

The risk today is that the development of a large-scale quantum computer in the future will compromise widely used cryptographic authentication techniques used to secure, banking and other transactions, and to verify the authenticity of people online.

Nation states are also concerned about the potential for hostile nations to intercept, collect and store sensitive communications with the anticipation that they will later be able to develop a quantum computer capable of breaking their encryption.

Predicting when the first quantum computers capable of breaking today’s encryption algorithms will be developed is difficult, however technology suppliers are coming to a consensus that usable quantum computers could be available by the 2030s at the earliest.

The NCSC, a part of GCHQ, issued guidance in March, setting out a staged timeline for the UK’s migration to post quantum cryptography - which uses encryption techniques that are not capable of being easily broken by quantum computers - by 2035.

UK government departments involved in sensitive work have already deployed post quantum cryptographic standards, while large companies, such as Google have begun to deploy the technology in their cloud services. 

A consultancy scheme, announced by the NCSC today, will offer help and expertise to organisations that want to deploy post quantum cryptography in their products or networks.

The NCSC has advised organisations to identify which cryptographic services will need upgrades and to develop a migration plan by 2028. 

That will be followed by executing high-priority upgrades between 2028 and 2031, and a complete migration to PQC for all cryptography by 2035.

The aim is not to cause a panic but to ensure a smooth transition to post quantum cryptography over the decade, say security officials.
Small and medium-sized companies will be able to rely on managed service providers to provide PQC upgrades for them. But for larger organisations and those in critical sectors, PQC will require extensive planning and investment.

The NCSC introduced the guidelines partly to provide ammunition to information security chiefs in critical industries to present to company boards to help them make a case for funding the transition to post quantum cryptography.

The guidelines also aimed to put the brakes on over-enthusiastic suppliers putting pressure on organisations responsible for critical national infrastructure to upgrade to post quantum cryptography products that were not fully formed or appropriate for them.

Artificial Intelligence poses another challenge for companies, giving them less time to patch their systems to protect them against the discovery of new security vulnerabilities, before they are potentially exploited by automated cyber-attacks.

Whitehouse said that organisations must better manage their “technical debt,” a measure of the cost of updating software that may have been rushed out before it was fully ready or fully secure. 

At the same time, technology suppliers will need to design and maintain products and services in a way that offers resilience against cyber-attacks.

Not doing so risks repeating avoidable security failures that have manifested since the rise of the internet, said Whitehouse.

“Without radical and sustained interventions, we are at real risk of repeating the last 30 years but with far graver consequences if we do not address the fundamental market failures which have manifested,” he added.