Preparing for post-quantum computing will be more difficult than the millennium bug
The job of getting the UK ready for post-quantum computing will be at least as difficult as the Y2K problem, says National Cyber Security Centre CTO Ollie Whitehouse
The transformation needed for organisations in the UK to be ready for the threat of post-quantum computing will make preparations for the millennium bug, which threatened computer systems in 2000, “look easy”, cyber chiefs said today.
Ollie Whitehouse, chief technology officer (CTO) at the National Cyber Security Centre (NCSC), said preparing for post-quantum cryptography (PQC) will take “a complex change programme” and will be a “colossal task”.
The 10-year, UK-wide PQC programme will require organisations to identify every instance of cryptographic code, to understand whether it is vulnerable to attack by a quantum computer, and put plans in place to mitigate the risk.
It mirrors the massive effort that the UK government and companies undertook to fix software throughout their estate when it threatened to malfunction on the first day of the year 2000 because of the way programmers calculated dates.
The risk today is that the development of a large-scale quantum computer in the future will compromise widely used cryptographic authentication techniques used to secure banking and other transactions, and to verify the authenticity of people online.
Nation states are also concerned about the potential for hostile nations to intercept, collect and store sensitive communications with the anticipation that they will later be able to develop a quantum computer capable of breaking their encryption.
Predicting when the first quantum computers capable of breaking today’s encryption algorithms will be developed is difficult, but technology suppliers are coming to a consensus that usable quantum computers could be available by the 2030s at the earliest.
“Over the last 30 years, cryptography has pervasively been adopted in all manner of software. And we've got far more software than we ever had 25 years ago,” said Whitehouse. “By virtue of that, the discovery activity, let alone the migration activity, is at least as complex, if not more so, than the original Y2K challenge”.
UK government departments involved in sensitive work have already deployed post-quantum cryptographic standards, while large companies, such as Google, have begun to deploy the technology in their cloud services.
UK government departments involved in sensitive work have already deployed post-quantum cryptographic standards, while large companies, such as Google, have begun to deploy the technology in their cloud services
A consultancy scheme, announced by the NCSC today, will offer help and expertise to organisations that want to deploy PQC in their products or networks.
The NCSC has advised organisations to identify which cryptographic services will need upgrades and to develop a migration plan by 2028.
That will be followed by executing high-priority upgrades between 2028 and 2031, and a complete migration to PQC for all cryptography by 2035.
The aim is not to cause panic, but to ensure a smooth transition to post-quantum cryptography over the decade, say security officials.
Small and medium-sized companies will be able to rely on managed service providers to provide PQC upgrades for them. But for larger organisations and those in critical sectors, PQC will require extensive planning and investment.
The NCSC introduced the guidelines partly to provide ammunition to information security chiefs in critical industries to present to company boards to help them make a case for funding the transition to post-quantum cryptography.
The guidelines also aim to put the brakes on over-enthusiastic suppliers putting pressure on organisations responsible for critical national infrastructure to upgrade to PQC products that are not fully formed or appropriate for them.
Artificial intelligence (AI) poses another challenge for companies, giving them less time to patch their systems to protect them against the discovery of new security vulnerabilities before they are potentially exploited by automated cyber attacks.
Whitehouse said organisations must better manage their “technical debt”, a measure of the cost of updating software that may have been rushed out before it was fully ready or fully secure.
At the same time, technology suppliers will need to design and maintain products and services in a way that offers resilience against cyber attacks.
Not doing so risks repeating avoidable security failures that have manifested since the rise of the internet, said Whitehouse.
“Without radical and sustained interventions, we are at real risk of repeating the last 30 years, but with far graver consequences, if we do not address the fundamental market failures which have manifested,” he added.
Read more about post-quantum cryptography
What is quantum computing? Read this guide to how it works, its features, benefits and limitations, along with examples.
NIST has launched the first three quantum-resistant encryption algorithms, and as the threat of quantum-enabled cyber attacks grows greater, organisations are encouraged to adopt them as soon as they can.
