Towards a quantum-secure future using three steps
No-one knows exactly when the quantum technology will be powerful enough to do the great things expected of it. What we do know is that some of the encryption we use today will no longer offer protection. Using three clear steps, TNO is helping organisations with cyber security solutions to prepare for a quantum-secure future.
The importance of a quantum secure future
The quantum computer offers fantastic opportunities, such as being able to carry out calculations exponentially more rapidly in chemistry or for artificial intelligence. But it is also in that very processing power that the danger lurks. Once the quantum computer is powerful enough, some of the security of banks, telecom companies, the healthcare sector, government bodies, and other organisations will no longer be strong enough.
Step 1. Go for quantum proof security with a strong project team
‘We know that foreign secret services already store large amounts of data, even when it’s still encrypted’, says TNO’s Maran van Heesch. ‘They do so on the “store now, decrypt later” principle. That is something to bear in mind. Also, it takes time to update your infrastructure. 'That’s why we are helping organisations with cyber security solutions to prepare for the quantum-age.'
‘It’s important for an quantum proof future to use larger parameters as early as step two’
‘The first step is simply to get started’, Van Heesch explains. ‘The ramping up phase. Make sure that you are familiar with the threat, that you create awareness. We often see ICT departments who understand the urgency, while policymakers still regard quantum technology as an innovation. So set up a project team to tackle the issue full-on. Becoming quantum-secure really is a massive task.’
Step 2. Make an inventory of your infrastructure and set up a migration plan
The second step is to make initial no-regret moves – activities that cannot do any harm, regardless. Possible examples include making an inventory of your infrastructure and of the data that has to be protected. ‘That’s important not just in relation to quantum technology, but in general too. We also advise the setting up of a migration plan – what you have to do when you want to replace everything or make it quantum proof.’
‘Part of the second step is strengthening existing symmetric encryption’, Van Heesch continues. ‘You do that by using the most up-to-date standards and the correct key lengths. Quantum computers will weaken symmetric encryption, so you need to use larger parameters now. That is beneficial in general anyway, without any downsides.’
‘With this technological solution, you do not have to invest in major network updates’
Step 3. Advanced Security Proxy offers a rapid solution
Step 3 is about replacing the currently used asymmetric cryptography. ‘First, you select new standardised quantum-proof asymmetric algorithms that you will be using to replace the existing algorithms. You then migrate the ICT infrastructure to a hybrid system of classical and quantum safe algorithms; this provides the desired level of protection. The classical algorithms can be removed later on.’
To give older network systems cryptographic protection quickly and easily against current and future security threats, TNO has developed the Advanced Security Proxy (ASP). Van Heesch: ‘With this technological solution, we – as the man-in-the-middle proxy – can add or replace a layer of encryption, without you immediately having to invest in major network updates.’
Migrate to quantum-safe cryptography?
Would you like to learn more about preparing your organisation for a quantum-secure future? Download the position paper entitled ‘Migration to quantum-safe cryptography’ (pdf). If we can be of any further assistance – whether it’s advice on the step-by-step plan or using the ASP – we would be very pleased to hear from you.
Maran van HeeschFunctie:Senior consultant
Maran van Heesch is the portfolio manager for PMC's Quantum Safe Technologies and Practical Algorithms for Quantum Optimization. Maran van Heesch works as a scientific consultant at TNO with a strong focus on applied cryptography, including post-quantum cryptography, quantum cryptography and secure multi-party computation. She works on figuring out use cases for quantum key distribution, possible transition models to post-quantum cryptography for security products and has implemented multi-party computation protocols for various use cases in the financial and healthcare sectors.
Looking for an expert?View all experts
Quantum computer is a threat to data protection
Quantum technology offers opportunities for societal. At the same time, it is a threat to our cyber security.
Cyber security through quantum-safe crypto
The quantum computer offers both opportunities and risks. At TNO, we help companies secure quantum-safe crypto networks and solve legacy problems.
Quantum Application Lab now open to explore the advantages and business opportunities for quantum computing
Organisations that want to investigate how quantum computing can benefit their business are invited to connect to the knowledge and technical infrastructure offered by the Quantum Application Lab (QAL) now. QAL is a newly formed public-private R&D partnership that offers a unique team of scientists, researchers, engineers, application developers, software and hardware specialists in a leading platform to explore and bring to market the benefits of quantum computing. QAL will support companies to navigate this complex and changeable environment, in order to make the best possible choices for their development roadmap and their envisioned applications.
Multiple academic and research organizations sign MOU for Quantum Application Lab
Last week the Memorandum of Understanding was signed between the six partners of the Quantum Application Lab (QAL): University of Amsterdam (UvA), the Netherlands Organization for applied scientific research (TNO), the national research institute for mathematics and computer science (CWI), the Dutch collaborative ICT Organization for Dutch higher education and research (SURF), TU Delft (on behalf of QuTech and Quantum Inspire) and the Netherlands eScience Center.
Can a DDoS attack be predicted?
In the forecasting of tsunamis, buoys with sensors lie in the ocean, waiting for anomalous behaviour of the waves. The satellite to which the sensors are connected sends the signal to the weather station, after which a warning is issued. Everyone can prepare in time for what is to come. Can a similar prediction be made for DDoS attacks? The project group of the Partnership for Cyber Security Innovation (PCSI) went to investigate.