QSC Activity Report 2015

Chairman: Mark Pecen, Approach Infinity, Inc.

Established to make recommendations on core cryptographic primitives and develop specifications for quantum-safe Information and Communications Technologies (ICT) applications. This includes practical advice and guidance to industry on real-world deployment issues such as transition timescales, generic requirements from operators or vendors and the assessment of threats and risks

Recent advances in quantum computing and quantum information theory mean that the emergence of the quantum computer is imminent. This will present a serious challenge to current cryptographic techniques. Cryptography relies upon the premise that certain types of problems are impossible for computers to solve efficiently, so private information protected by cryptographic techniques remains secure. Quantum computing challenges our notion of what may be ‘impossible’ because certain types of difficult problems become trivial for a quantum computer. These include integer factorisation and discrete logarithm problems, both of which are used in some of the most widely-deployed public-key cryptosystems in security products today. Such cryptosystems will be broken by quantum computers. Previously secure encrypted information will then be subject to discovery by those with access to quantum computing platforms. This could lead, for example, to the misuse of bank account numbers, identity information, items relating to military security and other sensitive information.

Current cryptographic principles have proved reliable for more than 20 years, but they were not designed to resist quantum attacks. New cryptographic techniques have emerged in recent years that do provide protection against quantum threats. Such ‘quantum-safe’ techniques may be based either on quantum properties of light that prevent the interception of messages, or on classic computational techniques which were designed so that they are difficult or impossible for a quantum computer to attack.

Our Industry Specification Group (ISG) on Quantum-Safe Cryptography (QSC) is assessing the current situation with regard to QSC and will develop specifications for the transition to quantum-safe ICT applications. Our focus is on the practical implementation of quantum-safe primitives that already exist today, including performance considerations, implementation capabilities, benchmarking and practical architectural considerations. 

In 2015, ISG QSC began work on five Group Specifications (GSs). One GS will specify a quantum-safe algorithmic framework. This involves identifying proposals from industry and academia for quantum-safe cryptographic primitives for building key establishment, authentication and encryption schemes, and then developing a framework for the assessment of quantum-safe algorithms. This specification will also include an estimate of the amount of time needed to achieve the necessary security levels. 

A second GS will provide a quantum-safe threat and risk assessment for real-world use cases. This will take into account when a large-scale quantum computer is expected to be realised and any new threat this may pose, as well as expected use cases (for example, by certificate authorities and in public key infrastructures, in the protocol stack and in banking and eCommerce). The specification will also address the potential costs and timescales involved for industry to migrate to QSC, and the requirements for extensible architectures to support the selection and deployment of the appropriate choice of cryptography, where both classic and quantum-safe options are available. 

Two other GSs are concerned with the characterisation of cryptographic primitives, benchmarking their performance and their suitability to a variety of applications.

All this work is expected to be completed by the end of 2016 or early 2017. 

The ISG will then assess the current state of quantum-safe standardisation and identify where new standards and security architectures are needed, which will be presented in a fifth GS by the end of 2017.

The third QSC workshop organised jointly by ETSI and the Institute for Quantum Computing of the University of Waterloo, Canada, was held in October in Seoul, Korea. The event offered an opportunity to discuss the requirements from industry and administrations, along with possible solutions based on the latest research. 

Throughout 2015, ISG QSC attracted considerable interest from industry, governments and institutions which recognise the ground-breaking work being undertaken. As a result, the group expects to introduce additional work in 2016 in areas such as preferred architectures, message protocols and key management.