Q-Day is the notion that there will come a time where a sufficiently powerful quantum computer can break widely used public-key cryptographic systems such as RSA and ECC. Mohan Veloo, Chief Technology Officer,
Asia Pacific, China and Japan at F5, draws comparisons between
Q-Day and the turn of the millennium, outlining steps for building crypto agility and planning ahead.
Q-DAY IS THE NEW Y2K AND WE’ RE NOT READY
hose of us old enough to
T remember the turn of the millennium will remember the concern around Y2K. Organisations spent years finding systems that might fail when the clock rolled over to 2000 and billions were spent fixing the problem. Then midnight came and, for the most part, nothing happened.
It is tempting to look back and conclude that Y2K was overhyped. I think the opposite is true. Nothing happened because organisations did the work before the deadline.
We now face another technology transition that is eerily similar – Q-Day, when a sufficiently powerful quantum computer could break much of today’ s public key cryptography.
The big difference is that Y2K had a date. Q-Day doesn’ t and that makes it much easier for organisations to treat it as tomorrow’ s problem.
The risk begins before Q-Day
One of the mistakes made is assuming the risk commences when a cryptographically relevant quantum computer arrives. For some organisations, the risk has already started.
Attackers can collect encrypted data today and decrypt it later; a tactic known as‘ harvest now, decrypt later’.
So, the question isn’ t when quantum computers will be powerful enough, it’ s how long your data needs to remain secret.
If you are protecting government information, financial data, intellectual property, health records or anything else that needs to remain confidential for another 10 or 20 years, your quantum timeline may already have started. The migration itself will also take years because cryptography is deeply embedded across applications, APIs, certificates, PKI, identity
24
INTELLIGENT CIO APAC www. intelligentcio. com