Post-quantum cryptography and the quantum future of cybersecurity

Abstract

We review the current status of efforts to develop and deploy post-quantum cryptography on the Internet. Then we suggest specific ways in which quantum technologies might be used to enhance cybersecurity in the near future and beyond. We focus on two goals: protecting the secret keys that are used in classical cryptography, and ensuring the trustworthiness of quantum computations. These goals may soon be within reach, thanks to recent progress in both theory and experiment. This progress includes interactive protocols for testing quantumness as well as for performing uncloneable cryptographic computations; and experimental demonstrations of device-independent random number generators, device-independent quantum key distribution, quantum memories, and analog quantum simulators.

I. INTRODUCTION

The Internet relies heavily on both public-key encryption schemes and digital signatures to ensure the confidentiality and authenticity of digital communications. However, many of these widely used cryptosystems could be broken by quantum algorithms, running on large-scale fault-tolerant quantum computers. Such machines do not yet exist, but could conceivably be built in the not-too-distant future.

To mitigate this potential threat, a large community of researchers is working to develop so-called post-quantum cryptosystems, to provide security against adversaries who have quantum computers. These post-quantum cryptosystems will be deployed on the Internet and in a wide range of devices. For some applications, this deployment needs to occur soon, well before the development of truly large-scale quantum computers, due to the concern that encrypted communications could be recorded today, and broken in the future.

A recent milestone in this process was the selection by the National Institute of Standards and Technology (NIST) of several schemes for public-key encryption and digital signatures, which will become US Government standards, and are expected to be widely adopted [1]. This marks the beginning of one of the most complex transitions in the history of the Internet, as these post-quantum cryptosystems are deployed in a myriad of different communications protocols, software applications, and hardware devices.

This transition to post-quantum cryptography will address most of the cybersecurity concerns that arise in a world where quantum technologies are widespread. However, there are a number of cybersecurity problems that are not solved by post-quantum cryptography. In this perspective, we will discuss some of these problems. We will then suggest some ways that quantum technologies may help to solve these problems, in the near future and beyond.

II. STRENGTHS AND WEAKNESSES OF POST-QUANTUM CRYPTOGRAPHY

We begin by describing the functionalities provided by post-quantum cryptosystems, how they are used on the Internet, and what are the weaknesses of these schemes, which quantum technologies might be able to address.

A. Securing the Internet

At the most basic level, the Internet requires some means to enable users to communicate privately, to protect their communications from being altered by unauthorized parties, and to enable users to verify all others’ identities. These are provided by a combination of several cryptographic tools: public-key encryption schemes and block ciphers (which ensure privacy), and digital signatures and hash functions (which protect the authenticity and integrity of data).

Public-key encryption schemes and digital signatures play a special role on the Internet, because they can be used by parties that share only public information, i.e., parties that do not already possess a shared, private key. This feature is crucial for supporting communications among a large number of users. In these schemes, every user has two different keys, a public key and a secret key, which perform different functions, such as encryption and decryption, or signing and verifying. As their names would suggest, the public key can be known by everyone, while the secret key should only be known by a single user.

Public-key encryption is often used for key establishment, that is, to set up encrypted communications sessions between users on the Internet. This is done in the following way: First, two users use each other’s public keys to send encrypted messages to each other. By combining the contents of these messages, they can generate a shared secret key. They then use this shared secret key to encrypt their subsequent messages, using a block cipher. Here, public-key encryption is needed for the first step, but block ciphers are used to encrypt the subsequent messages, as block ciphers are much more efficient. This whole process is usually managed by a higher-level protocol, such as the Transport Layer Security (TLS) protocol.

A common use of digital signatures is to protect electronic files and software from being altered by an adversary. In addition, digital signatures are used to construct certificates, which are used to distribute public keys on the Internet in a trustworthy manner. Essentially, a certificate is a way of linking a public key pk to some entity E in the “real world,” such as a person or a business with a physical address. The certificate is signed by a certificate authority (CA) – some organization that is able to verify that the public key pk indeed belongs to the entity E. Hence, a certificate provides a way for E to distribute its public key, which can be verified by anyone who already has the CA’s public key.

Of course, this still leaves another problem: How does one get a trustworthy copy of the CA’s public key? Sometimes this can come from another certificate, signed by some other “higher-level” CA. The highest-level CAs are called “root CAs,” and their public keys reside on “root certificates,” which are often built into operating systems and web browsers.

This system for managing public keys is sometimes called public-key infrastructure (PKI). It can scale up to large numbers of users, but it can also be vulnerable to attacks on certificate authorities (e.g., when an attacker gains access to a certificate authority’s secret key, and uses it to generate fraudulent certificates). Such attacks have actually occurred, despite the elaborate safeguards used by certificate authorities to protect their secret keys [2]. As a result, the Internet community has deployed additional infrastructure to identify and revoke certificates that are compromised or fraudulent. This is sometimes called “certificate transparency” [3].

B. Post-quantum cryptography

Unfortunately, essentially all of the currently deployed public-key encryption schemes and digital signatures – such as RSA (Rivest-Shamir-Adleman), Diffie-Hellman, and elliptic curve cryptosystems – will be vulnerable to quantum attacks, using Shor’s algorithm and its generalizations, if large-scale fault-tolerant quantum computers are built in the future. These attacks run in (quantum) polynomial time, and cannot be mitigated simply by using larger keys.

For comparison, quantum attacks on block ciphers and hash functions also exist, using techniques such as Grover’s algorithm. However, in almost all cases, these attacks still take exponential time, and they can be mitigated by using larger keys or longer output, or adjusting other parameters of these cryptographic constructions.

The main goal of post-quantum cryptography, then, is to develop new schemes for public-key encryption and digital signatures, which are based on different computational problems that appear to be hard for quantum computers. A wide variety of post-quantum cryptosystems have been proposed in recent years, based on problems involving high-dimensional lattices, error-correcting codes, multivariate quadratic equations over finite fields, isogenies between elliptic curves, collisions in hash functions, and others. There are many technical problems in designing these cryptosystems, assessing their security, and deploying them on the Internet. Many of these problems have been studied intensely in recent years, leading up to the selection of the first post-quantum cryptosystems to be standardized by NIST [1].

At the same time, there has also been longstanding interest in quantum key distribution (QKD) [4]. Like public-key cryptography, QKD also enables two users to exchange keys, but its security is based on properties of quantum physics, rather than computational complexity. QKD cannot replace public-key cryptography, but it might nonetheless be useful in certain scenarios.

QKD has certain strengths and weaknesses. It is information-theoretically secure (at least in principle), meaning that its security does not rely on conjectures about the hardness of solving certain problems on quantum computers. However, QKD has difficulty operating over long distances (necessitating additional infrastructure, such as trusted repeater stations or quantum networks), and it has potential vulnerabilities to side-channel attacks. For more discussion of these issues, we refer the reader to Refs. [4–7].

In this paper, we will take a broader view. Assuming that post-quantum cryptosystems work as intended, what are the outstanding problems in cybersecurity that still need to be solved?

C. Outstanding problems

There are a number of problems in cybersecurity that are not solved by post-quantum cryptography. One such problem is that real software and hardware have a variety of imperfections, which can leak partial information about the secret key to an adversary.

Some of these imperfections are caused by human error (e.g., software and hardware bugs, or discrepancies between the implementation and the theoretical specification of the cryptosystem). To some extent, this can be addressed by testing and formal verification methods (e.g., software tools such as EasyCrypt and Cryptol) [8].

Other imperfections are caused by the physical properties of the hardware, such as data-dependent variations in the time or power needed to perform a cryptographic computation, and other kinds of “side channels.” To some extent, this can be addressed by “constant-time” or “masked” implementations of cryptographic algorithms, as well as other countermeasures [9–12].

Because of these concerns, it is common to use special-purpose hardware to perform especially sensitive cryptographic computations. There are many kinds of special-purpose cryptographic hardware, such as cryptographic coprocessors, hardware security modules, trusted platform modules, physical uncloneable functions, cryptographic ignition keys, and two-factor authentication devices [13–15]. Building such devices, and verifying their security, is a complex problem, particularly for users who require very high levels of security, such as certificate authorities.

A special case of this problem involves the handling of secret keys [16]. Here, hardware random number generators (RNGs) are often used to generate secret keys, and provide random bits for encryption and signing operations. The unpredictability of these random bits is critical for security. However, testing and certification of hardware RNGs is a difficult task, both in theory and in practice [17]. Additional complications arise when secret keys have to be backed up, transported from one physical location to another, or updated (e.g., for stateful hash-based signatures) [18].

In recent years, there has been spectacular progress in developing quantum technologies. If this progress continues, quantum hardware might someday provide novel solutions to the above problems, with theoretical guarantees of security that are not possible for hardware based on classical physics [19,20]. Instead, these theoretical guarantees rely on quantum phenomena, such as self-testing and uncloneability. We will describe these ideas in the following section.

III. QUANTUM TECHNOLOGIES FOR PROTECTING SECRET KEYS

In this section, we will describe some techniques in quantum cryptography that can be applied to the construction and verification of secure hardware for cryptography. We will briefly review some of the relevant theory literature, and then discuss the prospects for experimental realizations of these ideas.

A. Quantum mechanics, uncloneability, and verification

Here we will focus on cryptographic protocols that deal with uncloneability of quantum information, and verification of untrusted quantum devices.

The term “uncloneability” comes from the quantum no-cloning theorem, which states that it is impossible to make a perfect copy of an unknown quantum state. In the context of quantum cryptography, uncloneability refers to protocols that protect a piece of information that has a specific function – such as a secret key, a message, or a ciphertext – from being copied or forged by an adversary. Examples of such protocols include quantum key distribution, quantum money, uncloneable encryption, and quantum copy protection [4,21–33].

These protocols are useful for constructing secure hardware to store secret keys and perform cryptographic computations, because these protocols provide a mechanism for preventing the secret keys from being copied or extracted from the hardware. This behavior is an important requirement for secure cryptographic hardware, yet it is difficult to achieve in classical hardware, because there is no principle in classical physics that prevents the copying of information. But quantum hardware can achieve this kind of uncloneability, with very strong guarantees of security (at least in principle).

The precise meaning of “uncloneability” depends on the kind of cryptographic functionality that is being implemented. Recent research has expanded the range of uncloneable functionalities that can be achieved, to include secure software leasing, certified deletion, one-time programs, one-time memories, and one-time signatures [34–48]. A variety of techniques can be used to enforce uncloneability, including quantum communication with single-qubit states [23,24], storage of single-qubit states combined with secure hardware assumptions [26,40,41,47,48], and quantum computation combined with complexity-theoretic hardness assumptions [25,27, 28,32].

Next, consider the problem of “verifying” an untrusted quantum device. This problem is related to basic questions about the foundations of quantum mechanics. For instance, how does one know that a quantum superposition state really exists, if the process of measuring the state causes the superposition to collapse? In the context of cryptography, one can ask an analogous question: How can one use classical communication to test whether an untrusted quantum device is operating correctly?

These questions can be answered in a variety of ways [49]. One approach is to separate the untrusted quantum device into two components, which are entangled but nonsignaling. Then one can use Bell tests and nonlocal games to construct cryptographic protocols for device-independent random number generation and quantum self-testing [50–58]. Some of these methods are closely related to device-independent quantum key distribution [59]. Another approach uses a verifier that can prepare single-qubit states, to construct interactive protocols for blind or delegated quantum computing [60,61]. A third approach uses a completely classical verifier, and quantum algorithms that run on the untrusted quantum device (using cryptographic techniques such as trapdoor claw-free functions), to construct computationally secure protocols for testing quantumness and delegating quantum computation [62–64].

These techniques are potentially useful for the testing and validation of cryptographic hardware, as well as quantum computers. As an example, consider how quantum experiments that violate Bell’s inequality can be used to generate random numbers [51,52,56]. Here, one can view Bell’s inequality as a test of the experimental apparatus, which certifies that the output of the experiment is truly random. More precisely, if the output of the experiment violates Bell’s inequality, then it is incompatible with any “local realistic” model of the universe, and hence it contains entropy that is independent of all prior information in the universe [65].

The test described above is very strong: it holds for any experiment that consists of two nonsignaling devices, and it relies only on the input and output of the devices, and not on their internal functioning (which may be quantum, classical, or even adversarial). This is called device-independent security. Furthermore, if the output of the experiment violates Bell’s inequality to a sufficiently large degree, this uniquely determines the behavior of the two nonsignaling devices (up to a small error, and internal degrees of freedom that do not affect the input and output of the devices). This property is called rigidity, or self-testing, and it provides a powerful mechanism for controlling the devices, and performing quantum computations [50,54].

These kinds of tests have numerous applications in cryptography. They can be used to certify hardware random number generators, which are used to generate secret keys, and to encrypt and sign messages. Compared to conventional methods [17], these tests provide a much stronger guarantee on the quality of a hardware RNG. In principle, these kinds of tests can even be used to certify arbitrary quantum computations performed on untrusted hardware. The main drawback is that quantum hardware is needed to pass these tests. The complexity of this hardware varies according to the task being performed, as we will discuss in the next section.

All of these topics are the subject of ongoing research, and our discussion here only covers a sample of the work in this area. In particular, while we have focused our discussion on quantum protocols involving uncloneability and verification, some of these techniques can also be used for other purposes, such as privacy and transparency [66]. More comprehensive surveys can be found in Refs. [19,20,67].

B. Outlook: quantum secure hardware

We now discuss the prospects for using these quantum techniques in the real world. As a first step, we focus on Bell tests and device-independent random number generators. Many of these techniques have already been demonstrated, at least as a proof of principle, on research-grade experimental hardware [51,68–70]. Recent demonstrations of device-independent QKD give a sense of the current state of the art [71–73].

Here, we will suggest some possible paths toward using these techniques in commercial-grade cryptographic hardware, through a series of incremental upgrades to present-day hardware security modules (HSMs). Some of these hardware upgrades will require further advances in quantum technologies, which have yet to be demonstrated. Nonetheless, the technologies we require are a subset of the technologies needed to build large-scale fault-tolerant quantum computers and networks. We are suggesting that this subset of technologies, by itself, can have interesting applications in cybersecurity.

The first step is to augment these HSMs with commercially available systems for quantum key distribution. These systems use photon detectors based on single-photon avalanche diodes (SPADs), which are readily available and easy to operate. These detectors should be placed inside the “security perimeter” of the HSMs.

Two such HSMs can be connected to a source of entangled photons, located outside the “security perimeter” of the HSMs, in order to perform a Bell test, which is the basic ingredient for a quantum entanglement-based RNG. In particular, this can be achieved using an entangled photon source based on spontaneous parametric down-conversion, which can be fairly inexpensive.

The main technical challenge, then, is to improve the security of this scheme, by patching various vulnerabilities that could be exploited by an adversary (while keeping the cost of the quantum hardware as low as possible). These security vulnerabilities are called loopholes in the context of Bell tests, and they have been studied intensively in recent years, leading up to the first demonstrations of “loophole-free” Bell tests [74–77]. In the context of device-independent RNGs, these loopholes are ways that an adversary can cause the HSMs to “pass” the Bell test, while producing an output that is predictable to the adversary (and hence is not truly random).

There are two main loopholes. One is the “signaling loophole,” where an adversary causes the HSMs to communicate with each other, in order to generate correlations that can “cheat” the Bell test. In practice, this is prevented by electromagnetic shielding on the HSMs.

The other is the “detection loophole,” where an adversary exploits the fact that a significant fraction of the entangled photons are not registered by the single-photon detectors in the HSMs. By causing the single-photon detectors to fail in a biased way, the adversary can “cheat” the Bell test.

The detection loophole can be closed by using matter qubits, such as trapped ions, nitrogen vacancy centers, or trapped neutral atoms [51,74,77], or by using high-efficiency superconducting nanowire single-photon detectors (SNSPDs) [68,69]. In most situations, the latter approach is the least costly. However, SNSPDs are still significantly more expensive than commonly available SPAD detectors. Is there any way to reduce this cost further?

One intriguing possibility is to implement device-independent RNG using an asymmetric or hybrid Bell test [78,79], which allows one HSM to have lower detection efficiency, provided that the other HSM has near-perfect detection efficiency. This approach has been studied in the context of loophole-free Bell tests [80,81], and would be easier to implement in our setting, where we are concerned only with the detection loophole, and not with the signaling loophole. In concrete terms, this scheme might be implemented using atom-photon entanglement, i.e., using one HSM that contains a matter qubit (which is expensive), and another HSM that uses an inexpensive SPAD detector combined with continuous-variable homodyne measurement (which is also inexpensive).

Using atom-photon entanglement has certain drawbacks, as one must deal with two sets of technical difficulties: those related to entangling atoms (e.g., needing to cool and stabilize an atom, and needing to collect the single photon emitted by the atom); and those related to working with photons (e.g., the problems of photon loss, and low photon detection efficiency). In addition, some of the techniques that are useful for entangling atoms, such as heralding and postselection, are no longer feasible when working with atom-photon entanglement. Thus, realizing these hybrid Bell tests will require improvements on the current state of the art [82].

However, these hybrid Bell tests may have an important practical advantage: they may allow one party to use a low-cost HSM that is outfitted with equipment that resembles present-day QKD hardware. Thus, one can deploy a large fleet of these low-cost HSMs now, and use them for QKD. At a future date, one may be able to upgrade these low-cost HSMs to perform device-independent random number generation (or device-independent QKD), by augmenting them with a few more-expensive HSMs that are equipped with matter qubits capable of generating matter-photon entanglement.

This scenario is reminiscent of the public-key infrastructure of the Internet, where a few root CAs generate certificates for a larger number of lower-level CAs, who generate certificates for an even larger number of users. This is an example of a familiar trick in systems engineering: amortizing the cost of the most expensive part of a system over many uses of the system.

The ideas described above could provide a highly secure way to generate secret keys within (a pair of) HSMs. What might be the next step along this path?

A plausible next step would be to equip an HSM with unentangled quantum memories, which are not capable of performing entangling operations, but can nonetheless be used to implement certain “uncloneable” cryptographic functionalities, such as quantum money, one-time signatures, or one-time programs. This takes advantage of the fact that, while many of these cryptographic protocols require the ability to perform quantum computation, there exist simple versions of these protocols that only require unentangled quantum memories or isolated qubits, and can be highly noise-tolerant [26,40,41,43,44,47,48].

These single-qubit quantum memories would require significant improvements on existing quantum technologies. But they would avoid the even greater technical challenges of building a true quantum computer.

In particular, these kinds of primitive quantum memories can be built using a variety of physical systems, including solid-state systems [83]. Some of these systems have the potential to achieve hour-long coherence times, even at room temperature [84–87]. Finally, these systems are relatively easy to scale up, compared to true quantum computing hardware [88], because they do not require two-qubit couplings or interactions, and they can tolerate substantial variability in the physical properties of the individual qubits.

IV. TRUSTWORTHY QUANTUM COMPUTATIONS

This brings us to a second problem in cybersecurity that is not solved by post-quantum cryptography alone: How does one ensure the trustworthiness of quantum computations? As we mentioned earlier, many theoretical solutions to this problem have been proposed [49], including quantum self-testing [54], blind or delegated quantum computing [60,61], and computationally secure interactive protocols [62–64]. Here, we suggest some ways that these ideas might be applied to the kinds of quantum computations that will be useful for science and engineering, in the near future and beyond.

A. Random samples, and analog quantum simulators

As a first example, consider the recent experimental demonstrations of “quantum computational advantage” [89,90]. In these experiments, complex quantum superposition states were prepared, and then measured, producing random samples from a complicated probability distribution. It is difficult to verify the correctness of these samples, and, in some cases, it is actually possible for a classical adversary to “spoof” the distribution, without being detected by commonly used verification tests [91]. Although there are stronger interactive protocols that can in principle prevent such spoofing [92], this remains a significant concern for these types of experiments [93].

Perhaps the next milestone in the development of these technologies will be to perform the first quantum simulations that give useful insight into condensed matter physics or quantum chemistry [94]. Here, we use the term quantum simulation to mean a simulation of the time evolution of some quantum system that appears in nature, where this simulation is performed on a quantum simulator – a quantum device that can be programmed to simulate many different quantum systems.

Different kinds of quantum simulators have different degrees of programmability. At one extreme, analog quantum simulators typically implement a many-body Hamiltonian with many quantum particles, but relatively few tuneable degrees of freedom. At the opposite extreme, highly programmable digital quantum simulations can be performed by encoding the state of a quantum system into a quantum computer, and running a quantum circuit that simulates the system’s time evolution.

Recent progress, particularly in analog quantum simulators [95], raises an interesting question: How can one verify the correctness of these simulations, as they continue to grow in complexity? This question is hard, for two reasons. First, these results will likely be difficult to reproduce using simulations performed on a classical computer, or empirical measurements of a quantum system occurring in nature. Second, analog quantum simulators have too few degrees of freedom to perform arbitrary quantum computations, and thus are unable to run many of the verification protocols described above, such as blind quantum computing, or protocols involving trapdoor claw-free functions.

One possible solution could be to construct “trapdoor Hamiltonians” that appear to have complicated dynamics, but can be simulated on classical computers if one knows some special information. We call this information a trapdoor, by analogy with trapdoor one-way functions in cryptography. For instance, a trapdoor could consist of a unitary change of basis that reveals some special structure in the Hamiltonian, such as “stoquasticity,” which may make the Hamiltonian easier to simulate [96,97]. Thus, the trapdoor could provide an efficient means of checking the correctness of analog quantum simulations that were performed without knowledge of the trapdoor. This is reminiscent of proposals for trapdoor simulation of quantum circuits [98].

B. Protecting quantum data

In the more distant future, digital quantum simulations using large, fault-tolerant quantum computers might be able to reproduce some of the complex quantum states that exist in nature, but in an artificial form (i.e., encoded into qubits) that can be measured in far greater detail than a natural quantum system. Such quantum states could be the first real example of quantum data.

These quantum states might someday be used as scientific reference materials, in the same way that classical databases of chemical and material properties are used today. In particular, these quantum states could be more useful than any classical information derived from them, such as expectation values of observables. This is because, given such a quantum state ρ, one can use a quantum computer to perform any efficiently computable measurement on ρ.

Providing access to these quantum states is an important motivation for developing quantum networks and quantum memories [99]. Perhaps, new fully quantum methods will be used to verify these quantum states, and protect their integrity. These might include “swap tests” that (nondestructively) compare one quantum state to another, via an entangled measurement [100], as well as encryption and signatures of arbitrary quantum states [101].

These ideas demonstrate the rich interaction between classical and quantum cryptography, and the needs of cybersecurity involving both classical and quantum computers. This is the quantum future of cybersecurity, and we believe that we are already on the path toward this future.