Demystifying Cybersecurity: Post-Quantum Security, Part 1

While most technologies used to secure our data were believed to be secure and “unbreakable” some years ago, they will certainly not be in the years to come. Quantum computing is accelerating things exponentially by tremendously reducing the amount of time required by some attacks to break current encryptions, thus rendering these attacks possible and feasible in real life.

Cryptography 101

Let’s review some basic concepts about cryptography first. There are mainly two types of encryption methods used to protect data, either in transit, while travelling from A to B over a network connection, or at rest, when stored locally, for example on a mobile device memory, desktop computer hard disk or on a back-end server, hosted in a datacenter locally or in the cloud.

The first method, called symmetric encryption, also known as Secret Key Encryption (SKE), relies on a single key, often referred to as “shared secret key,” both to encrypt and decrypt the data. This allows for fast encryption/decryption processing, plus the same key can be used by multiple parties to communicate with each other. For example, this is used by Advanced Encryption Standard (AES) encryption algorithm, to secure both data transmission (“data in transit”) with Transport Layer Security (TLS) security protocol or data stored on a disk (“data at rest”). However, since a unique key is used, it must be kept safe and rotated/replaced often, otherwise it could become comprised and used by a malicious third-party to read all the communications.

Secret/Private Key Encryption (Symmetric)

The second method, called asymmetric encryption, also known as Public Key Encryption (PKE), relies on different keys to encrypt and then decrypt the data exchanged between two parties; a public key, that can be shared with anyone, and a private key, only known to one party (its owner). Both keys, mathematically related, compose a key pair; any of them can be used to encrypt data, that only the other one in the pair will be able to decrypt. Unlike symmetric encryption, a unique key pair must be generated for each party so they can communicate with others securely. Authentication and verification are required and usually achieved using digital certificates, provided by Certification Authority (CA), either public or private, that must be trusted by both parties. This type of encryption is used, for example, by Rivest–Shamir–Adleman (RSA) cryptosystem to secure data transmissions.

Public Key Encryption (Asymmetric)

While both methods work very differently and are employed for different scenarios and use cases, they can also be used in combination. For example, whenever we connect to a website and sensitive information will be exchanged, like social security and/or credit card numbers, Transport Layer Security (TLS) security protocol is typically used, to first ensure the website is legit, then secure the communications to make sure all the data exchanged cannot be intercepted nor read by a malicious actor, thus preserving our privacy. For that, TLS relies on both encryption methods.

First, asymmetric encryption is used during the initial handshake, to verify the identity of the website, then have both parties generate, exchange, and agree upon an encryption key, called “session key”; afterwards, symmetric encryption will be used encrypt the data they exchange within a secured session, using that session key. Every time a new communication session is established, the handshake process will happen again, and a new session key will be generated.

Current Challenges

There are several challenges with current cryptography that need to be addressed today. The first one resides in the way encryption keys are exchanged between two parties. The most popular public-key encryption protocols used to securely exchange keys are Diffie-Hellman (DH) and Rivest-Shamir-Adleman (RSA); in both cases, encryption keys travel together with the data over the same, unsecure communication channel, for example the Internet. As a consequence, Man-in-the-Middle (MITM) attacks could be used to obtain and alter the keys when transmitted, allowing to later perform eavesdropping, also known as “sniffing,” and secretly listen to the communications between the two parties using the obtained keys to decrypt them and gather valuable information, typically user credentials, credit card information, or anything that can be extracted from unsecured data transmissions.

The second challenge resides in the fact that not only encryption keys travel over the same path as the data, but are also generated directly at the endpoints, being a mobile phone, desktop computer, hardware-based back-end server, or a virtual, cloud-based one. And all of them can only provide weak entropy, meaning that the random numbers generated and later used to create said encryption keys locally, are not “random enough,” i.e., too predictable, especially using quantum technologies – not to mention inner Random Number Generator (RNG) flaws. The exponential use of cloud computing does not help either, and can make things even worse, as many virtual machines are running on top of the exact same hardware and could end up generating random numbers that are too similar, if having a high enough number of machine and key generated. While this might be a very low percentage, any percentage over 0 is a real risk.

The third challenge deals with Pre-Shared Keys (PSKs), which are a shared secret or password previously shared between the two parties using some type of secure channel and can be used as an authentication key. They usually lack key rotation, which creates a huge security risk in case it is stolen or intercepted by a third party that could use it to decrypt all communications. An option is to replace them more often, but this is not an easy task either, as it requires re-distributing the same new key to all endpoints involved in a secure way.

Although one might think that only a tiny percentage of the current known cyberattacks are quantum attacks, and that our communications are still very secured right now, a malicious actor could still intercept and collect that encrypted data and keep it for later, when quantum computers are generally available and mature enough to break the encryption algorithms that were used to protect said data. This is known as the “harvest now, decrypt later” attack and is a real concern in the quantum cryptography community; while some information might only have value for a limited amount of time, other information does not (e.g., Intellectual Property).

In our next blog post, we will continue our discussion on post-quantum security, covering the existing technological approaches to answer these challenges, including Quantum Random Number Generator (QRNG), Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC).