In a significant development for global cybersecurity, Europe’s foremost law enforcement agency, Europol, along with the U.S. Government Accountability Office (GAO), have both issued reports this week calling for urgent action on the adoption of post-quantum cryptography (PQC). As advancements in quantum computing technology progress, the potential threat posed by cryptographically relevant quantum computers (CRQCs) to existing encryption systems is now a pressing concern. Experts from various quarters, including notable tech companies like Google, predict that the day when quantum computers can effectively compromise current encryption—dubbed “Q-day”—might arrive as soon as 2029.
The report from the GAO, released on October 6, puts a spotlight on the glaring gaps in the preparedness of U.S. federal agencies against the looming threat posed by quantum computing. This redacted version of a document sent to these agencies in September outlines 89 recommendations distributed among 23 agencies, focusing on three critical areas: the creation of prioritized inventories of vulnerable cryptographic frameworks, clarifying funding needs for the implementation of PQC, and instigating rigorous testing protocols for these new solutions. Alarmingly, none of the 24 agencies referenced in the report have fully met all three requirements, revealing a stark inadequacy in their readiness to confront the potential dangers posed by CRQCs.
The GAO underscores that the incomplete responses from agencies are rooted in three main factors. First, there is a significant lack of expertise in cryptography across the federal landscape. This absence impedes the development of robust inventories and the identification of appropriate funding sources. Second, federal agencies appear to have no established processes to systematically assess and address these vulnerabilities. Lastly, the absence of actionable plans to guide testing and implementation of PQC solutions underscores a systemic failure to prepare adequately against the quantum threat. Until these agencies rectify these shortcomings, they will remain at considerable risk of vulnerabilities that could compromise the protection of sensitive information.
Adding to the urgency of this situation, Europol’s two reports released on October 7 delve into various aspects of the quantum threat. The first report analyzes how already encrypted communications and stored files are susceptible to various types of attacks, particularly the “harvest now, decrypt later” (HNDL) strategies feared to be deployed by certain governments. This technique essentially allows the capture of encrypted data now, with the understanding that future quantum capabilities might allow for decryption at a later date.
The second report specifically examines the world of cryptocurrency wallets. It indicates that while the overall cryptocurrency ecosystem is not at immediate risk of collapse due to quantum advancements, its long-term security framework still requires proactive measures. This includes a gradual transition towards adopting quantum-resistant cryptographic systems to safeguard these digital assets.
Both Europol and the GAO advocate for organizations to take immediate corrective actions. Among the recommended strategies from Europol are upgrading encryption protocols to more secure versions like TLS 1.3 and SSH2, discontinuing outdated legacy protocols, enforcing forward secrecy in communications, and systematically deleting unnecessary sensitive data to reduce long-term storage risks.
Furthermore, organizations are encouraged to actively explore options for adopting post-quantum cryptography, which may include hybrid strategies that integrate both current and quantum-resistant algorithms. In the domain of cryptocurrencies, blockchain projects are urged to prioritize the incorporation of post-quantum algorithms within their fundamental protocols to bolster their defenses. Additionally, wallet providers have been advised to test and deploy PQC-enabled solutions and educate their users about the risks associated with CRQCs.
As time progresses and the capabilities of quantum computing continue to advance, organizations must remain vigilant. The recommendations set forth by Europol and the GAO could serve as foundational steps in fortifying cybersecurity measures that safeguard sensitive information against the unprecedented threat posed by the rise of quantum technology. The urgency and significance of addressing these challenges cannot be overstated, as the landscape of digital security evolves with every technological advancement.