5 min read

Crypto-Agility in the Advent of Post Quantum Computing

Cryptomathic : 24. February 2022

Crypto-Agility Quantum Computing
Crypto-Agility in the Advent of Post Quantum Computing

There is no question that quantum computing is coming. However, organizations need to question themselves as to whether they will be vulnerable to threats it will present once it arrives. Best practices always dictate that it is better to act proactively instead of reactively; therefore, the time is now to prepare for the advent of post-quantum computing. NIST guidelines state that in order to prepare for the era of quantum computing, it is imperative to maintain crypto-agility.

The threat of What is to Come with PQC

No single method of encryption is unbreakable. Recent vulnerabilities discovered in major algorithms show that organizations must be ready to transition between standards quickly. NIST recommends that organizations immediately adopt crypto-agility because there is a potential for quantum computers to break all current public-key cryptosystems. This was demonstrated way back in 1994 by Peter W. Shor of Bell Laboratories when he demonstrated that quantum computers could potentially speed up the process of factoring primes and break the RSA algorithm.

According to McKinsey & Company’s recent report “The Next Tech Revolution: Quantum Computing,” quantum computing is still in its infancy. However, it is anticipated that industries, such as finance could begin to benefit from its use by 2025 and other industries will soon follow as it becomes more accessible on its own or in the cloud. A more realistic estimate of time before quantum computing is adopted is about 10 years. It is expected that there could be between 2,000 to 5,000 quantum computers around the world by 2030.

In a perfect world, quantum computers would be used for good. However, there is great potential for them to be used for nefarious purposes too. Eventually, quantum computers will be able to factor prime numbers, which are the basis of current data security systems that use public-key cryptography, thus requiring a need for organizations to upgrade their cryptographic systems. While there are no quantum computers currently capable of managing the massive number of qubits required to perform the factoring needed to crack current cryptography, this is likely to change 10 to 20 years from now. Hence, the reason why there are efforts to develop quantum cryptography to address the threats to come in the PQC world.

What Does Crypto-Agility Mean?

Modern information systems, payment systems, and the global communications infrastructure rely on public-key encryption, digital signatures, and key exchange. Crypto-agility is the capacity for an information security system to adopt an alternative to its original encryption method or cryptographic primitive without notable change to system infrastructure. Organizations will need to be crypto-agile to face the threats facing them in a post-quantum world.

The surge of cyberattacks, including ransomware during the past few years serves as evidence of the need to immediately adopt new frameworks and technologies to rapidly and proactively respond to risks as they occur. In order to achieve crypto-agility, organizations need the ability to quickly update their cryptographic methods without needing to make significant changes to their information systems in order to mitigate security risks and retain their regulatory compliance. 

Organizational Agility in the Age of Post-Quantum Computing

Being crypto-agile enables proactive changes to cybersecurity policies (such as preparing for PQC) and rapid reactive response times as soon as new vulnerabilities or risks are discovered. Gartner, Inc., one of the world’s top technology experts, recommends that organizational change be facilitated through a collaboration of security and incident response leadership. This also includes the following three-part framework to transition to crypto-agility:

  1. Enhance the existing application development and procurement workflows to reflect crypto-agility
  2. Perform a comprehensive inventory of information systems that use cryptography and identify and evaluate currently used algorithms
  3. Include cryptographic alternatives and methods for updating existing methods of encryption to current incident response plans

Technology Agility Relies on Strong Cryptography

In the past, response methods to discovering cryptographic vulnerabilities required time-consuming:

New Call-to-action
  • Algorithm replacement
  • Updates to code bases
  • Application rebuilding
  • Patching
  • Testing

The main problem with the traditional method of making hard code changes to encryption policies or algorithms is that it can be very time-consuming (i.e. it's very slow) and complex to get right.

Technological ability is best achieved by adopting new development frameworks and service software for applications that rely on strong cryptography.

Crypto-agility development methods can include adopting object-oriented frameworks, such as, NET and Java Development Kit (JDK). These frameworks do allow algorithms to be represented as classes derived from abstract classes. This allows the loading of new algorithms from a database or configuration file post-implementation.

Yes, adopting new development frameworks could protect future applications. However, conducting a complete overhaul of legacy IT systems for intrinsic crypto-agility is not pragmatic.

New Call-to-actionCryptomathic’s approach to crypto-agility is facilitated by adopting a service software layer or gateway application between hardware security modules and applications.

Adopting such a solution for cryptography as a middleware service enables agility in:

  • Algorithm updates
  • Key management
  • Policy enforcement
  • Usability
  • Monitoring [details]

Being Post-Quantum-Prepared and Standardized

NIST has already begun its process of soliciting, evaluating, and standardizing potential quantum-resistant, public-key algorithms. Current FIPS 186-4 Digital Signature Standard public-key cryptographic algorithms are not expected to withstand attacks from large-scale quantum computers. The new standards need to be capable of protecting sensitive government information in the PQC world. These standards will specify one or more unclassified public-key encryption, publicly disclosed digital signature, and key-establishment algorithms to be made globally available.

It is best for organizations to become post-quantum-prepared now instead of waiting until NIST issues its standard. The best place to start is to determine what data is most attractive to cybercriminals. Remember, because quantum computers are expected to be expensive to initially maintain and operate, they should be relegated to protecting the organization’s most vital information and any additional vulnerable data.

Remaining mindful of the quantity of data to be protected, a strategy should be developed that addresses the organization’s priorities for using quantum-resistant encryption. Priorities need to be developed for such quantum-resistant encryption while setting a plan to upgrade the organization’s infrastructure for the next several years. The plan should ensure that:

  • The PQCryptography candidate provides an enhanced level of post-quantum robustness.
  • A compliant algorithm will assure legal compliance and assertion.

It is understood that typical investments in the banking sector have a 10-year investment horizon. This is during the period that PQC is expected to arrive and changes in standards and algorithms, based on gained additional knowledge and reformulated standards, as well as triggers from zero-day leaks, will impose an architecture that will need to embrace modifications as quickly as possible, hence the need for being crypto-agile.

Adopting new methods of application development can facilitate crypto-agility. However, the complete re-engineering of existing information systems is unrealistic in terms of time, resources and money for many organizations. Solutions, such as Cryptomathic’s Crypto-Service-Gateway, facilitate crypto-agility for both legacy and new IT systems automatically. It gives organizations the ability to rapidly replace algorithms and policies without the need for code updates within the applications.

 

Read White Paper

References<