The first quantum computer was created almost three decades ago, in 1998. Yet the topic still seems to illicit images of “Back to the Future” for most. While its applications are still unknown to many, this advanced field combines computer science, physics, and mathematics to deliver solutions the world has been trying to find for eons – and those it doesn’t yet know it needs.

Rivalling classical computers and coming out on top, quantum computing uses quantum mechanics to find fast and complete answers to complex problems. According to Carrie Peter, Managing Director at Impression Signatures and Advocacy Committee Vice-Chair at the Cloud Signature Consortium, “although it sounds futuristic, quantum computing is advancing at a rapid rate—certainly faster than expected. Today, many countries are already in possession of their own quantum computers, with quantum computing even being available as a SaaS solution." 

As is the case with most technological developments, however, the opportunities offered by quantum computing are equalled by the threats this advanced computer science introduces. “The evolution of quantum computing puts the security of any data available in the digital space in jeopardy,” warns Peter.

IBM recently published an article about quantum computing, noting that “quantum technology will soon be able to solve complex problems that supercomputers can’t solve, or can’t solve fast enough.” But what if the problem it’s trying to solve is breaking through security firewalls or encryptions?

“This poses a massive threat to encryption, as a quantum computer could decrypt traditional encryption in a fraction of the time. While this surely won’t halt the evolution of the quantum computer, it does mean that security must be bolstered," adds Peter. Thankfully, global standards and security bodies have been hard at work developing and testing a new set of post-quantum encryption algorithms, with the first three standards being released on 13 August 2024. 

As published by the National Institute of Standards and Technology (NIST), these new standards include: the Federal Information Processing Standard (FIPS) 203, intended as the primary standard for general encryption; FIPS 204, intended as the primary standard for protecting digital signatures; and FIPS 205, also designed for digital signatures and employing the Sphincs+ algorithm.

In parallel, as standards and security measures are fortified against the threats of quantum computing, it is essential that organisations begin paying attention to post-quantum cryptography (PQC). “Somewhat shortsightedly, many business leaders are countering the argument for PQC with the misguided belief that we are ‘years’ away from commercially available quantum computers,” says Peter. “The reality is that these computers are already being miniaturised and will likely come to market much sooner than expected.”

Additionally, putting PQC measures in place now will protect data from nefarious strategies such as Store-Now Decrypt-Later (SNDL). “This cyber threat entails the storing of large amounts of encrypted data now, in an effort to decode and use it later, once quantum computers become more widely available.”

In a recent blog entry, HP put it like this: “A sufficiently powerful quantum computer will break the cryptography we rely on in our digital lives. An attacker can intercept and store encrypted data today, and when quantum computers become feasible, the attacker could decrypt the stored data.”

Lastly, Peter motivated that companies need to start thinking about PQC now because some devices (such as cars) that are being produced today will most certainly be on the road when quantum computing is proliferated. “In 2023, the US government already put out a mandate that companies must transition onto PQC as soon as possible. Now, with the release of the new standards, it is critical to take the need to transition to PQC seriously.”

Of course, with many global standards being incorporated into these algorithms, any standards-based organisation or solution (such as digital signature providers) will be forced to adopt and comply with PQC. This means for users of these solutions, the switch to the more secure standard will be seamless.

However, it is important for companies to note that encryption is only as good as the authentication they apply while using encryption. “For organisations to guarantee that they are, in fact, secure, they must ensure appropriate access management, authentication, and zero trust within their organisations.”