Quantum computers will redefine encryption

Like many new technologies, quantum computing offers both an opportunity and a threat—but it’s the latter that requires immediate attention. Data security is paramount to anyone handling payments, from data communications to record keeping, and quantum computers have the potential to break current encryption methods.

Companies like Google, IBM and Microsoft are in a race to build fully-fledged quantum computers. Where classical computers use millions of ‘bits’—tiny switches that can either be set to 0 or 1—to run their code, quantum computers are built using qubits. Qubits rely on a weird quirk of quantum physics: they can be 0, 1, or in a state called ‘superposition’ where they’re somewhere in between. This gives quantum computers the ability to hold vast amounts of information with a relatively small number of qubits, and to rapidly solve problems that would take the world’s best classical computers thousands of years.

It could still be decades before current quantum computing hardware reaches that level. But that doesn’t mean you can ignore the threats. Security researchers warn of ‘harvest now, decrypt later’ attacks, where encrypted data can be stockpiled in anticipation of some future machine that can break into it.

This looming threat has been present since the mid-1990s, when mathematician Peter Shor developed an eponymous algorithm to run on the quantum computers of the future. Shor’s algorithm can quickly factor large numbers, and thereby break RSA encryption, a fundamental pillar of cybersecurity.

In response, the US National Institute for Standards and Technology (NIST) has been promoting the development of post-quantum encryption algorithms—new ways of securing data that should, in theory, stand up to future attacks from quantum computers. NIST recently published details, drawing new attention to post-quantum cryptography.

The time to start learning about these emerging algorithms is today: that way, your data will be protected both now and in years to come. The level of urgency varies between industries, depending on the sensitivity of the data organizations hold and how likely it is to be relevant in the future. Clearly, companies dealing with payments data are unlikely to feel relaxed.

It will take a few years before NIST has completed its standardization work on new quantum-proof algorithms and is ready to roll them out. In the interim, organizations have a choice. Larger companies may bring in a quantum expert to spearhead proactive encryption efforts, as J.P. Morgan has done recently with Marco Pistoia. For smaller firms, ‘crypto agility’ may be enough—they might not know what the capabilities of these new machines will be, but they can forge partnerships and make procurement decisions with the future quantum threat in mind. That way, systems can be easily retro-fitted with new quantum-proof algorithms when the time is right.

The same approach can apply to the opportunities as well as the threats. Quantum computers have the potential to transform payments tech: quantum encryption and authentication should make payments even more secure, and the computational might of these machines is likely to power machine learning models and optimization algorithms that are exponentially more powerful than those we have now. That could transform the ecosystem around payments, from fraud detection to behavioral analytics, customer service or treasury management. And the investment required to enter this brave new world may prove to be small: the hardware giants will invest in building the machines and then sell time on them to clients over the cloud, as they do with today’s supercomputers. The likes of IBM and Microsoft are already offering quantum-inspired solutions to electric car manufacturers, hospitals and space programs.

There’s only one certainty when it comes to quantum: however this story shakes out, it’s just the beginning.

BY WIRED