Post-quantum security on Airbus’s radar

A great deal of investment is being made in developing quantum computers, especially by China, and once that goal has been reached, many current encryption methods could be compromised.

The ability of quantum computers to crack most encryption systems in use today has raised fears that failure to take action could leave critical infrastructure, banking and healthcare networks vulnerable, with the first practical quantum computers expected within the next five to 10 years.

Specifically, quantum computers are expected to be able to carry out integer factorisation of very large prime numbers and compute discrete logarithms very quickly, but many current algorithms are based on the assumption that these processes currently require significant time, effort and computing power.

At Infosecurity Europe 2018 in London in May, a top European chief information security officer urged the security community to prepare for quantum computing to ensure their encryption processes are ready in time, and Airbus is doing just that, according to Ian Goslin, UK managing director of Airbus cyber security.

“We are working with various national authorities as well as internally to see how we can provide cryptographic capabilities that are quantum resistant.

“It is something we are continually reviewing because there is no point in waiting until quantum computing is a reality because then it will be too late to look at taking a different approach to cryptography,” he said.

At Infosecurity Europe, Jay Baloo, CISO of KPN Telecom in the Netherlands, explained that the problem arises when it comes to asymmetric encryption. “It is all the public key cryptography that is out there because it is based on complex mathematical problems that would even take a super computer a long time to solve, but that principle breaks down with quantum computers,” she said.

Goslin believes that meeting this challenge will involve a combination of things, including changes to algorithms and the way cryptography systems are developed and architected.

“We are always looking at how we can ensure that what we provide to governments is resilient, secure and able to resist any increases in computing capability,” he said.

Until now, Goslin said technology has not been evolving at a pace that has required frequent revisions. “When I joined the military, a new cryptography system had just been introduced, and when I left 28 years later that same system was still secure,” he said.

However, in future Goslin said he does not expect cryptography systems to have a similar longevity, with the effective life of any new system being significantly shorter than similar systems in the past.

“We are likely to see a much more frequent refresh of cryptography systems in future to keep ahead of advances in computing technology,” he said. “We are going to have to put a lot more effort into looking at this problem on an on-going basis as technology continues to speed up everything.”

The good news, according to Jaya Baloo, is that all the symmetric encryption currently in use is unlikely to be affected by the arrival of quantum computing.

“As long as we keep refreshing keys and following best practices for transferring keys, we are good to go,” she said.