Download quantum computers vs. computers security

QUANTUM COMPUTERS VS.
COMPUTERS SECURITY
QUANTUM COMPUTERS VS.
COMPUTERS SECURITY
This is a summary of the talk “Quantum Computers vs.
Computers Security”, given at the DEF CON 23 Hacking
Conference in Las Vegas in August 2015 by Kudelski Security
Principal Cryptographer, Jean-Philippe Aumasson.
Increasing numbers of cybersecurity experts and stakeholders
are watching developments closely in the field of quantum
computing. A quantum computer is a model of a computer that
works completely differently from a classical one. It’s based on
phenomena of quantum mechanics that facilitate the resolution
of certain problems that classical computers cannot solve, e.g.
breaking the crypto used for e-commerce transactions.
How does a quantum computer work? Although it leverages
complex quantum mechanical phenomena, the core concepts
are pretty simple:
•
•
•
Whereas a classical computer works on bits that are
either 0 or 1, a quantum computer works on qubits, which
can be 0 and 1 simultaneously. In quantum physics, this
is called superposition.
Superposition is characterized by some probabilities,
but not the usual ones: a quantum computer relies on
negative probabilities, which are called amplitudes.
The actual computation is not performed with usual
computer operations such as addition or bitwise logic,
but uses basic linear algebra transformations, similar
to operations between vectors and matrices like in high
school physics.
The good (or bad) news is that quantum computers don’t exist
yet. Building a quantum computer is a gigantic and fascinating
engineering challenge, and we don’t know for sure if it’s even
doable. There’s been some progress over the last decade, and
some large companies are investing in quantum computing
research - but don’t expect a useful quantum computer within
the next decade!
Cryptographers obviously pay special attention to quantum
computing research. A large enough quantum computer
could totally break the RSA and Diffie-Hellman cryptographic
algorithms, and more generally, all cryptography based on the
mathematical problems of factoring integers (such as RSA)
and of solving discrete logarithms (such as Diffie-Hellman and
elliptic curve cryptography). In short, if a quantum computer is
created today, we’re doomed!
But there’s hope: the field of post-quantum cryptography is
about creating cryptographic systems that can resist quantum
computers. These experimental systems are based on different
mathematical problems that are expected to be hard for both
classical and quantum computers to solve. One such family of
hard problems is that of NP-complete problems, which occurs
in many contexts. For example, the problem of finding the
optimal scheduling of a group of events is NP-complete. And
quantum computers cannot solve NP-complete problems.
Quantum physics has more potential applications to
cybersecurity than of just breaking crypto:
•
•
•
Quantum key distribution establishes a secure link
between two systems, leveraging quantum physics laws
to prevent eavesdropping. Such systems are practical and
are being deployed, though their actual added value in
terms of security is sometimes disputed.
Quantum money uses the physical “no-cloning” principle
to prevent counterfeiting. Quantum money is only a
theoretical idea, and seems difficult to put in practice.
Quantum machine learning is an emerging field that
attempts to leverage quantum computers to improve the
efficiency of machine learning algorithms.
Quantum computing is an exciting field of research that involves
knowledge from theoretical and applied physics, but also
complexity theory, information theory, and cryptography. Quantum
computers may give us new insights into physics and nature, even
though they may never be built!
Jean-Philippe (JP) Aumasson is Principal Cryptographer at
Kudelski Security. He is known for designing the cryptographic
functions BLAKE, BLAKE2, SipHash, and NORX. He has spoken at
conferences such as Black Hat, RSA, and CCC, and initiated the
Crypto Coding Standard and the Password Hashing Competition
projects. He co-wrote the 2015 book “The Hash Function BLAKE”.
He is a member of the technical advisory board of the Open
Crypto Audit Project and of the Underhanded Crypto Contest.
JP tweets as @veorq.
ABOUT KUDELSKI SECURITY
Kudelski Security is a premier cybersecurity solutions provider, working with the most security-conscious organizations in Europe
and across the United States. Our long-term approach to client partnerships enables us to continuously evaluate their security
posture to design and deliver solutions to reduce business risk, maintain compliance and increase overall security effectiveness.
For more information about capabilities including consulting, technology, managed security services or custom innovation,
visit: www.kudelskisecurity.com
www.kudelskisecurity.com
[email protected]