The World should be eagerly waiting for a more potentially transformative technology than Artificial Intelligence (AI), which is Quantum computing. This more transformative technology could arrive sooner than many think. But it will bring with it a monumental security challenge. Experts believe there could be up to a 34% chance of a quantum computer breaking public-key cryptography by 2034. When that happens, the foundations of global digital trust will begin to crumble.
Writing on the coming of Quantum computing, Steve Inch, the Global Senior Print Security Strategist & Product Management Lead at HP Inc, says this is no far-off threat, and there have already been numerous false alarms to date. While software can be updated quickly in the global push to quantum-resistant cryptography, hardware cannot. This leaves everything from workers’ laptops to office printers at risk. Given its extended lifespan, a printer bought today may conceivably be vulnerable to quantum-powered threats before it’s even due to be replaced.
“Enterprise security teams cannot afford to wait around any longer. It’s time to understand the threat and engage with vendors to chart a course to quantum safety,” he said.
The Quantum Threat
Quantum computers herald the prospect of incredible processing power, far outpacing today’s classical computers. Google’s Willow quantum chip“performed a standard benchmark computation in under five minutes that would take one of today’s fastest supercomputers 10 septillion (1025) years to complete”.
“To put that in perspective, this is a figure greater than the age of the universe itself. Yet chips like this are by no means the only route to achieving cryptographically relevant quantum computers (CRQCs),” Inch said.
According to him, the emergence of CRQCs will also have some problematic, disruptive effects. By being able to solve the mathematical problems on which asymmetric encryption is based, CRQCs threaten to undermine digital security, identity and trust. Consider an attacker capable of cracking the cryptographically signed digital signatures that safeguard the most privileged firmware running on PCs, printers and other devices. This would open the door to a complete compromise of the device.
That’s why some of the smartest minds on the planet have collaborated to develop quantum-resistant algorithms, which they are now working to integrate into commonly used protocols and systems. It will require a monumental effort to upgrade the digital world to these new standards. But with hardware, there’s an extra hurdle for enterprises. IT leaders must start planning now to make the hardware refreshes required to support quantum resistance.
The Time is Now
Despite the long lead times involved, it would be unwise to sit back now. It is perhaps best to follow the US federal government’s lead. By 2027, the U.S. Government has committed to only procuring devices for national security systems if firmware and software are secured with quantum-resistant cryptographic code signing. NIST has also standardised a range of algorithms, including four digital signature schemes (LMS, XMSS in SP 800-208, ML-DSA in FIPS 204 and SLH-DSA in FIPS 205) and one algorithm for confidentiality (FIPS 203), with more standards in the pipeline.
Other governments also understand the urgency of the situation. The UK’s National Cyber Security Centre (NCSC) says that the best mitigation against the threat of quantum computers to traditional public-key cryptography is quantum-resistant cryptography.
In Canada, the government advises organisations to first identify systems that need migrating, then “budget for potentially significant software and hardware updates,” and speak to vendors about their quantum resistance plans.
To Inch, planning ahead is crucial, given that enterprise printers could be deployed for as long as 20 years, and even contract sales and managed print services (MPS) agreements tend to be 3-5-year terms.
“The next purchase an enterprise makes will likely need to be one made with quantum resistance. The alternative is to play a dangerous game of “wait and see,” Inch emphasises.
An Orderly Transition
Organisations lulled into a false sense of security by the long timelines involved risk a chaotic dash for the finish line. It is vital organisations get on the front foot now to future-proof regulatory compliance programs and strengthen stakeholder trust.
Here’s how to start:
First, identify the highest priority use cases and devices, such as enterprise printers and PC hardware with long-lived, non-updatable keys, such as public keys used in code signing. Next, talk to the organisation’s main technology providers to understand their plans for quantum-resistant cryptography migration across relevant products. Finally, draw up a comprehensive plan for infrastructure, software and hardware upgrades, according to the appropriate timescales and enterprise risk appetite.
“An orderly transition to quantum resistance will put your company on a sure footing to protect data for the long term, reassuring customers, regulators and investors. This will prevent being caught blindsided once the new quantum era begins. Because when it arrives, it could be with a bang,” he said.
