Why PQC and QKD are complementary, not rivals

Summary

John Prisco, President and CEO of Safe Quantum, a quantum security consulting firm is interviewed by Yuval Boger. John and Yuval talk about the maturity of PQC, QKD, quantum networks, and their timing overlap, national and international testbeds for quantum security, successful case studies and more.

Read the full transcript on the Quantum Computing Report site

Transcript

Yuval Boger: Hello, John, and thanks for joining me today.

John Prisco: Hello. How are you?

Yuval: I'm doing well. Who are you and what do you do?

John: Well, I'm John Prisco. I am the president of Safe Quantum, and I consult in the areas of quantum key distribution and the quantum internet.

Yuval: There are a lot of buzzwords floating around: post-quantum cryptography, quantum key distribution, the quantum internet. Could you help me make some sense of these?

John: Yes. I think we're at a very early stage in a number of areas that are based on quantum. Obviously, quantum computers are just at the beginning of their development. They don't have very many qubits yet, but eventually they will.

And when they do, we'll have something to worry about: the encryption schemes we depend on today could be broken. However, NIST is working to develop post-quantum cryptographic algorithms that will be quantum resistant. The hope is that these mathematically based algorithms will stop quantum computers, or at least slow them down, from decrypting secret information.

On the other side of the equation is quantum key distribution, which doesn't depend on arithmetic or mathematical rigor. It relies on quantum mechanics and the principles of physics. It's a very interesting technique. It uses keys made of individual photons of light, and because of their quantum mechanical properties, you can't even observe these keys without changing their state.

Once the state has changed, the key no longer works. It no longer unlocks the secret information, and that provides the protection you want when transmitting very secure and sensitive information.

Yuval: So if I'm an enterprise and I hear about post-quantum cryptography as an interim step, then quantum key distribution as something a little better, and maybe the quantum internet as the best thing, is it feasible for me to jump right to the best thing?

John: Unfortunately, not at the moment, because there's a lot of work to be done in all three areas. Jumping ahead to the quantum internet is probably a misnomer. We should first talk about a quantum network, which doesn't reach as far as an internet.

A number of test beds around the world are working in this area today. These systems rely on building quantum repeaters and using quantum memory. But at this point of development, the repeaters are repeating one photon of information at a time. When you consider gigabit-per-second transmission rates, there's a long way to go before we have a complete quantum internet.

But there are many advances in quantum networking around the world. One company I follow closely, because it's right here in the United States, is Qunnect. What I find interesting about them is that they're trying to build a quantum network, the basis for a quantum internet, using room-temperature equipment.

That's terrific, because it's very difficult to commercialize a product that needs a dilution refrigerator. That's a room full of refrigeration equipment to cool a quantum setup down to millikelvin temperatures so you get superconducting properties.

When you need high vacuums and very low temperatures, you're a long way from commercialization. So I like following companies that are trying to do things at room temperature, because I think that approach will get us there sooner.

Yuval: Let's start with post-quantum cryptography. I understand that NIST has announced four finalists, or candidates for standards, but some of the candidates have already been cracked. How is that process going, and what do you expect will happen with it?

John: Well, it's a long-term process. It started six years ago, and I think about 88 algorithms were submitted at the start. NIST has been working diligently to test the strength of each of these algorithms, and they came up with four finalists.

In addition to those four, there were others in the finalist category. One of them was hacked a couple of months ago, I think in March, and more recently another one was broken. But that's all part of the process working. It's open to the public so that people will try to get around the protections each algorithm offers.

When you look at an arithmetic approach, which is what all of post-quantum cryptography is, you have to understand that these algorithms will have a shelf life, just as the RSA algorithms are coming to the end of their useful shelf life. Post-quantum cryptography may have a shelf life of 30-plus years, but eventually something will crack it.

So it's very important to understand that it is a quantum-resistant approach. I lean more toward QKD, which bases its protection on the laws of physics, but I think you need both. It's important to have a defense-in-depth strategy, with two completely different approaches, so that if one fails, the other is unlikely to fail the same way, and you have more survivability.

But I do think post-quantum cryptography is going to require crypto agility, for the reasons we mentioned. You may be heading down the road with a finalist algorithm, and then a mathematician comes up with an algorithm that defeats that approach.

You have to be able to turn on a dime and adopt one of the other algorithms in your golf bag, so to speak.

Yuval: Quantum key distribution, I think, uses a side channel to send the decryption or encryption keys to both parties, outside the main channel. And I believe a previous company you were involved with offered QKD as a service. If I understand QKD, what does "as a service" mean in that context?

John: It means you're providing a transmission pathway so a customer can secure data in motion. That could be between two of the customer's locations, or from the customer to the cloud. "As a service" means that you secure the fiber rights-of-way between point A and point B.

You install the hardware that produces and shares the keys, and it's a complete service. If maintenance is required, you provide that as well. One of the most important things about this approach is that it separates the encryption key from the data.

Today we make it awfully easy for people to harvest information along with the key used to encrypt it. Even if they can't break that key today, they can cheaply and easily store the data and the key. Then in the future, when they have the means to break the key, for example with a more powerful quantum computer than we have now, suddenly all that secure, sensitive information can be read in plain text.

So there are an awful lot of things to consider. The time it takes to convert from a classical encryption approach to a quantum encryption approach is measured in decades. The last time there was a conversion like this, it took over 20 years for companies to fully convert to the RSA algorithms.

It's probably going to take more like 20 to 30 years this time, because we store and transmit so much more data. What was happening in the seventies is much, much smaller than what's happening in the 2020s. So this is not going to be an overnight, plug-and-play project.

It's going to take a long time, and you have to keep watching: are bad actors able to crack the new algorithms? Will our sensitive information soon be read by our enemies?

Yuval: So it's not a three-stage rocket where you first have PQC, then move to a second stage with key distribution, and then maybe to a quantum network. These are overlapping stages, if I understand correctly.

John: They are. You have QKD today, which is probably the best approach for preventing harvesting attacks, because it's available now and it gives you the quantum mechanical security it promises. PQC is probably two years away from having its first few algorithms standardized.

Then, of course, the conversion to PQC, which is an enormous task, will probably take at least 20 years. The quantum internet will require a fair amount of development. Today, we entangle photons and then try to swap that entanglement in a quantum repeater or a quantum memory.

As I mentioned before, each photon is transmitted individually and carries one bit of information, a one or a zero. It could be polarization, it could be phase, whatever, but it's a one or a zero. So you need billions and billions of photons to complete a simple telecommunications transaction, and the hardware and infrastructure have to be put in place for that.

Fortunately, test beds are springing up all around the world, and breakthroughs are being made on a monthly basis. So we'll get there, but it will probably be on the order of 20 to 25 years before substantial networks, covering substantial distances at substantial data rates, are common.

Yuval: You've probably consulted with a lot of companies and looked at many others. Can you give any examples of someone you felt was doing a good job preparing for this next type of risk?

John: Yes. In fact, I've had the pleasure of working with a number of companies, JPMorgan Chase for one, and what I really think they did right is hire quantum experts.

Their quantum business is run by Marco Pistoia, who came out of IBM. He's a friend of mine, and I always tell him he's a quantum rock star, and he is. When I was consulting for Toshiba, we did a project with them on securing a blockchain application. If you generalize this to what companies might do, I think it's important to have people who understand what quantum is and what quantum information science and technology are all about.

Then you have to start doing proof-of-concept tests. I've done a number of QKD proofs of concept. One of my first, again working with Toshiba, was on Verizon 5G network security. This is all public. Both of the companies I just mentioned have put out press releases.

That's really what you have to do. You have to get started and make an investment, and an equal investment goes into understanding the PQC algorithms. The first thing you have to do is take an inventory of your data. What data do you have? What's the shelf life of that data?

How sensitive is the data? You work from the most sensitive data with the longest shelf life down to the least sensitive data with the shortest shelf life. Just finding that out is going to take a long time in a large corporation, so getting started now is important. The federal government is in a totally different situation, because its information is always very sensitive.

Look at some of the executive orders that came out last month about when government agencies should convert to quantum encryption. They talked about 2032 to 2035. What worries me about that is harvesting attacks. That's ten to thirteen years of people sniffing cables.

Even the submarine cables crossing the ocean have been tapped. It's very difficult to know when an optical fiber is being tapped, because you simply bend it, light leaks out of the core, and you detect that light. With conventional, classical telecommunications, when you detect that light, you also get all the information being sent over that fiber.

So imagine an optical fiber carrying tremendous amounts of data, all of it recorded cheaply and kept somewhere. Eventually, when that encryption can be broken, all of that very sensitive data is revealed. So I don't think we have as much time as people think when they say, "Well, we can do this over twenty years, twenty-five years."

Sure, it may take that long, but I think you have to take measures before then, especially if your information has a long shelf life and is extremely sensitive. And QKD is actually the only thing that can really protect you at the moment.

Yuval: You mentioned governments, and security is obviously not just a corporate issue but also a national one. Which countries, in your opinion, are ahead in quantum security, and which are perhaps behind?

John: I think the United States has caught up with China. We do some things better than they do, and they do other things better than we do. In terms of quantum computing, I think the US leads.

I actually think some of the QKD deployments in China are ahead of the US, but there's a lot going on in Europe as well. British Telecom is now building a metro-scale network using Toshiba QKD. That's a very large project, and it's very interesting to see a large telecommunications company make that bet.

In the Netherlands, the group at Delft is doing a wonderful job on quantum networking. There are just a lot of things going on. Barcelona and Germany are all doing a lot in the field of quantum networking. But in the United States, this is going to be a public-private partnership, just as the moon launch was in the '60s, and that's the way to really win this race.

A few years ago, people had that Sputnik moment where they said, "Wow, look, China just invested ten billion dollars in quantum. We'd better do something about that." And I think we have. The NSF has been funding universities and a lot of basic research, and the venture community has been funding startups.

I think that's a winning combination. It won once before in the '60s with the space race, and I think it'll win again.

Yuval: As we get close to the end of our conversation today: you mentioned a couple of test beds in Europe, and I think there's a big one in the US, in Chicago. Are there others people could get involved with or should pay attention to?

John: Mm-hmm. The Chicago Quantum Exchange is the one you're referring to. Of course, that has Department of Energy laboratories working with very fine universities and terrific researchers.

Recently, NIST announced that it's going to build a DC-QNet quantum network, which will first deploy quantum networking on the NIST campus but will then bring in several other agencies, like NASA, NSA, and CIA. That will be an interesting one to watch. And there are all sorts of rumors about a network coming to Boston, another one coming to New York, and probably another on the West Coast.

None of that has been publicly announced yet, so we'll see which of those happen. But I think it's really important that we have these partnerships: test beds that involve universities, venture capital, and government. The government is looking to the private sector to come up with ideas.

Many of these companies have been working on networking for two or three years, and they can bring a lot of experience to bear.

Yuval: Excellent. John, how can people get in touch with you to learn more about your work?

John: You can go to my website, safequantum.com. All my information is there.

I lead the use cases TAC, the Technical Advisory Committee, at QED-C. If you're a company that wants to join QED-C, I'd recommend it. There's a tremendous amount of knowledge in the group, and it's a very good place to learn. You can also find me on the Forbes Technology Council.

I try to publish one article a month there, so that's how you can find me, and on LinkedIn.

Yuval: That's perfect. Well, thank you so much for joining me today.

John: Well, thank you.