Quantum computers are expected to break today's encryption far faster than classical machines, so current algorithms may no longer protect your data. The "Guidelines for Post-Quantum Readiness" were published by NCSA's Cyber Security Research Center with Quantum Technology Foundation (Thailand) Co., Ltd. They set out three defensive approaches:
- Post-quantum cryptography (PQC): drawing on NIST's standardisation work.
- Quantum key distribution (QKD).
- Hybrid solutions: classical cryptography combined with PQC, which ANSSI, BSI and IETF consider the most cost-effective option.
Assess risk with the Mosca model: let x be your migration time, y the security shelf life of your data, and z the time until a large-scale quantum computer arrives. If x + y > z, that data is at risk. The guidelines note that migrating a whole organisation may take more than ten years. Long-lived data such as personal, financial and health records should therefore come first.
Seven readiness steps
- 01Build a roadmap.
- 02Raise awareness, including in procurement.
- 03Assign responsibilities.
- 04Inventory the IT assets that use cryptography. This is the most important and most complex step.
- 05Evaluate PQC, QKD or hybrid options.
- 06Experiment and test.
- 07Track progress and reassess risk regularly.
Source: Cyber Security Research Center, NCSA (Thailand), December 2023. Copyright belongs to the publisher. Shared by InfraLab for educational purposes.