Industry Trends

Strong encryption is the security professional's arms race. There is no such thing—and never has been nor ever will be—as unbreakable code. The best we can strive for is code that will take a cyberthief's computers so long to break that it becomes impractical. In short, the thief will conclude that there are much easier ways to make his money, softer targets to hit.

The problem is that, thanks to Moore's Law and its various corollaries, computing power continually gets better, faster and can fit into smaller form factors. That means that encryption needs to constantly ramp up, to keep the "time to crack the code" beyond the profitable reach of thieves. Top government agencies, which are presumed to have slightly better funding than the typical cyberthief, always need to have the fastest equipment so that they can break the codes before the bad guys can (or encrypt things to such a degree that the bad guys can't).

There is one problem with this arms race. Normal systems, with their normal decryption keys, need to be able to handle the task, so eventually a ceiling will be hit.

That brings us to today's government issue. And a pesky piece of hardware called a quantum computer.

An extreme oversimplification is that a quantum computer is a computer that is many orders of magnitude faster and smarter than any existing systems today. But a more accurate description is a lot trickier. This MIT paper does a decent job. A quantum system leverages quantum-mechanical interactions, in effect using the molecules in a liquid for compute power instead of silicon chips.

Consider this delightfully nerdy explanation, courtesy of MIT:

"The advantage of quantum computers arises from the way they encode a bit, the fundamental unit of information. The state of a bit in a classical digital computer is specified by one number, 0 or 1. An n-bit binary word in a typical computer is accordingly described by a string of n zeros and ones. A quantum bit, called a qubit, might be represented by an atom in one of two different states, which can also be denoted as 0 or 1. Two qubits, like two classical bits, can attain four different well-defined states (0 and 0, 0 and 1, 1 and 0, or 1 and 1). But unlike classical bits, qubits can exist simultaneously as 0 and 1, with the probability for each state given by a numerical coefficient. Describing a twoqubit quantum computer thus requires four coefficients."

The point of all this? "A quantum computer promises to be immensely powerful because it can be in multiple states at once—a phenomenon called superposition—and because it can act on all its possible states simultaneously. Thus, a quantum computer could naturally perform myriad operations in parallel, using only a single processing unit." The explanations delve far more into physics than traditional computer technology, with a CPU in a quantum state looking more like a beaker of chemicals.

How does this play into government plans? The NSA has just updated its cryptography position. It is proposing to develop "quantum resistant algorithms" for encryption.

"Unfortunately, the growth of elliptic curve use has bumped up against the fact of continued progress in the research on quantum computing, which has made it clear that elliptic curve cryptography is not the long term solution many once hoped it would be."

The implications of this are staggering. A quantum computer will a truly different way of computing, as different from today's CPUs as a Cray supercomputer is from an abacus. To be honest, a more apt comparison would be between a tricycle and the means by which electricity flies across a body of water—or the method of a thought in the brain zapping instructions to a body part.

This truly alien means of computation will likely support an equally different type of encryption. Humans being humans, the first crypto cyphers will be little more than larger and more complicated cyphers. But when someone figures out that there's no reason to apply silicon rules to a quantum-mechnical reality, cryptography will look entirely different.

What is actually going on is that NSA wants its own quantum computers, allowing it to break encryption that is considered unbreakable—while being able to create defenses that truly are unbreakable, even for a foe with her own quantum computer. This is similar to how strict encryption done today with one supercomputer can't necessarily be easily broken by someone else with the same supercomputer.

"Since complex mathematical problems like integer factorization, discrete logarithm mod primes and elliptic curve discrete logs are essential to public key encryption systems, quantum computing puts them at risk," pointed out the International Business Times.

The NSA isn't worried about quantum computers cracking complex codes. It's worried about someone *other than the NSA *being able to do it.

There is a reason to be concerned. American engineers and technologists—and especially cryptographers—have trained for a remarkably long time how to handle encryption. How much of that training will become moot? Will our best physicists, cryptographers and programmers work well together? (OK, I think we all know the answer to that last question.)

The nightmare here is that cyberthiefs are not necessarily well trained. They tend to be young, creative, determined and well-funded. That gives the NSA and other U.S.-centric the advantage as long as the playing field is the environment in which we are experts. But quantum computing will make that experience irrelevant, very likely giving the advantage to our not-so-lawfully-minded counterparts in other parts of the world.

A change this radical allows the toppling of established leaders, who want to cling to the ways they know far longer than they should. (Of course they try to do that. It's all they know.) The NSA has every reason to be scared.

Can this get worse? Of course it can. Predictions have focused on quantum computers not being commercially viable for another 50 years. If there's one thing that the scientific community is worse at than designing in a truly new environment, that would be predicting when that new, not-well-understood environment will materialize. Fifty years? I'd be stunned, given recent quantum experiments, if the first quantum systems aren't here in ten years, especially as nation-states begin throwing serious resources into quantum computing.

Could it be that the NSA knows they'll be in a few years and are saying 50 years to try mislead our enemies? Misleading the public on matters of encryption? The NSA would never consider doing any such thing.