Britain’s cyber security watchdog has warned businesses and governments to prepare for the arrival of quantum computer hacking by 2035 and switch to stronger encryption methods that the new technology cannot compromise.
In guidelines published on Thursday, the National Cyber Security Centre, a branch of signals intelligence agency GCHQ, said the risks posed by the rapid development of quantum computers were not being taken seriously enough and called for organisations to begin preparing now.
“The threat to cryptography from future large-scale, fault-tolerant quantum computers is now well understood,” the NCSC said.
Quantum computing, which exploits the physics of subatomic particles to perform functions that existing computers cannot, remains largely in its infancy.
But given the pace of recent advances and huge investments in the technology, the watchdog’s guidelines point to “Q-day” — when a robust quantum computer will be able to crack the most common encryption method used to secure our digital data — occurring by the middle of next decade.
However, an NCSC spokesperson cautioned that the 2035 deadline did not amount to a prediction of when a quantum computer capable of hacking would be viable.
“We want the migration to post-quantum cryptography to be driven by the availability of mature technical solutions to counter the threat, and believe that 10 years is a sufficient time for these solutions to evolve,” they said. “There is less inherent uncertainty in this approach than in predicting the development of quantum computing.”
Quantum computers will eventually be able to crunch numbers exponentially faster than standard computers that use binary bits to make calculations. Using quantum “qubits”, instead of “bits” in classical computing, they will be able to efficiently solve the hard mathematical problems that secure the public key cryptography protecting most networks today.
Last year the US National Institute of Standards and Technology, a government agency, published three approved security algorithms that states and companies can use to safeguard information from quantum hacking.
The NCSC recommended a timetable for migrating networks to use post-quantum cryptography, saying adjustments would have to start as early as 2028 in order to avoid a rush when the first quantum computers arrive.
The agency advised organisations to carry out a “full discovery exercise” and build a migration plan by 2028 in order to guard sensitive data. The ambition was to avoid a potential “big panic” caused by a badly executed switch, it said, calling for improved awareness of the threat.
“Various countries have carried out industry surveys on PQC readiness and the numbers come out pretty low,” the watchdog’s spokesperson said.
Europol, the EU’s police agency, warned in a report on Tuesday that quantum computing, along with artificial intelligence and blockchain, had become a “catalyst” for crime, driving “criminal operations’ efficiency by amplifying their speed, reach and sophistication”.
