By: Jonathan Verkuil
Quantum computing is a topic many are aware of but that is often misunderstood. This article will unravel the importance of quantum science for our digitalised society. It emphasises how breakthroughs in the sector will have massive implications for digital security as it will be possible to decode confidential data rather easily, leading to unprecedented digital risks. UNESCO has named 2025 the “international year of Quantum Science and Technology”, highlighting the importance of the technology in a global context. Growing attention towards the topic indicates a renewed interest in quantum, propelling the quantum market to never-before-seen investments. Hundred years after the first breakthroughs in quantum science, scientists are accelerating discoveries in the field in such a manner that this can be called a new “Quantum Revolution”.
Quantum science fundamentally differs from our conventional understanding of how computers work. Whereas a classical computer bit can have the value of either 0 or 1, a so-called qubit can have a value of 0, 1, or any values in between at the same time. Only when the qubit is examined, the bit takes either value. This is called superposition. Another cornerstone of quantum computing is entanglement, which means that measuring one qubit affects other entangled qubits. Computers built with qubits will be able to perform difficult computations much faster and more efficiently than classical computers. This creates numerous possibilities, especially for scientific or medicinal applications. Its revolutionary nature presses the urgency of quantum computing, even without it being available for commercial or strategic use yet. The possible threats stemming from its widespread use endanger the integrity of data and reliability of the internet. This leads to the classification of quantum computing as a key technology.
Cryptography as a cornerstone
Digital systems become increasingly intertwined with the non-digital world. The digital ecosystem is built upon the CIA-triad: ensuring confidentiality, integrity, and availability of data. Cybersecurity is a fundamental part of such a society, since without security, digital systems will not be reliable. Cryptographic methods safeguard the confidentiality and integrity of digital information, making it a “foundation of society”. Current cryptography is based on mathematical problems which cannot be solved by classical computers. However, due to the unprecedented mathematical prowess of quantum computers, experts predict they will be able to break the majority of currently used cryptography. Take, for example, the RSA cryptosystem, which is used in popular services like online banking and mail. In 1994, mathematician Peter Shor proved that a powerful enough computer can break these algorithms in seconds. Back then, this was all speculation, but the recent developments in quantum computing show the risk is no longer unthinkable.
Just as quantum computers are classified as a critical risk to digital security, they can be used as an offensive cyber weapon for one’s own benefit as well. In line with rising geopolitical tensions, key enabling technologies became part of the global power race, too. When confidential data can be hacked and exposed, citizens can lose their trust in the digital realm, leading to unprecedented risks to economic security, digital stability, and society itself. In particular, the ‘Store Now, Decrypt Later’-type attacks can have significant implications for one’s national security. Adversaries can store confidential data and decrypt it later when quantum computers are available for cracking the encryption. This type of attack forms the most urgent threat to sensitive data. No one is certain when ‘Q-Day’ – the day when quantum computers will be able to break current cryptographic standards – will arrive, but experts predict as early as 2028, 2029, or 2035. In line with such estimates, Europe identified quantum technology as “key”, and the American security services aim to be fully quantum-proof by 2035 as well.
Protections against data theft
To protect society against an unreliable digital ecosystem, protective measures against quantum computing threats are being developed. The two most prominent measures are Quantum Key Distribution [QKD] and Post-Quantum Cryptography [PQC]. QKD is a technique in which quantum mechanics itself is used for the secure distribution of an encryption key between communicating parties. This is in contrast to classical cryptography, which relies on mathematics. QKD’s non-cloning theorem entails that no information from a qubit can be copied without having the integrity of the data changed. Interference with the qubit, for example through eavesdropping, will become visible immediately since the qubit will change accordingly. While this sounds highly promising in theory, the technique faces some challenges in practice. High cost of implementation and the lack of standardisation are some of the main reasons why Western governments deem it too unstable to promote. Yet, development of the technique is viewed as a key strategic investment into digital security.
PQC can be explained as an ‘upgrade’ of current encryption methods, because the basis for PQC is still a mathematical issue. As it builds upon existing hardware, the implementation is relatively easy in comparison to QKD. The National Institute of Standards and Technology [NIST] has published three standards for quantum-safe cryptography in the summer of 2024 after a lengthy international expert-led process which started in 2016. However, the main critique regarding these standards is that they are still based upon mathematics and, therefore, breakable in theory by very advanced computers in the future as well. However, the risk of future vulnerabilities is a risk for every system developed in the past and not necessarily a valid reason to specifically discredit PQC. There is broad consensus by experts that updating cryptography towards quantum-proof standards will be needed in any case.
Current state of affairs
Updating digital systems towards PQC or QKD is not a simple process. The migration to a quantum-safe cyberworld will take numerous years due to the magnitude of the task and the dependencies that exist in chain relationships in the digital realm. Due to the dynamic nature of digital security which includes a lot of attention-intense subjects and the highly technical nature of quantum mechanics, senior management roles often do not understand the importance of the post-quantum migration. Organisations who outsourced a lot of their IT systems often do not know when and how to start their journey to quantum-safety. For example, estimates are that it will take around ten years to create a fully quantum-safe Dutch digital ecosystem in which every digital chain-organisation that is vital for the functioning of society has adopted post-quantum safety measures. Given that the most pressing threat at the moment is the ‘Store Now, Decrypt Later’-attack, and quantum computers are expected to be available before 2030, organisations need to start sooner rather than later with migrating.
The first step companies and organisations should take is to map out their cryptography. While digital security engineers will generally speaking be aware of the encryption used in one’s digital systems, many management staff will not. They have the power to set agendas and allocate resources, and should therefore be convinced of the importance of secure cryptography for the functioning of their business. Mapping out the cryptography used in the organisation’s systems and the systems of other companies in the chain as well is therefore considered a ‘no-regret move’. A key insight stemming from the problems related to the advent of quantum computers is the need for cryptographic agility in the future. It is not unthinkable that new developments will create new threats to cryptography. Being crypto-agile as a society means being dynamic and able to bounce back after a digital disaster struck.
Over the last years, quantum computers came to be viewed as a cyber weapon with massive powers, able to disturb society through breaking the trust in the security of confidential data. Governments try to mitigate the possible impact by pushing for post-quantum measures and spreading awareness. However, legislation tends to lag behind. A pro-active attitude of government, companies, and citizens is needed to steer the digital society towards a quantum-safe future, since the magnitude of the risk is one that should concern everyone. Though it is still unclear when current encryption will be broken, we certainly know it will happen some day in the future.
No panic needed
While quantum computing is indeed developing rapidly, societal panic is not needed. While some sources suggest that Q-Day will be an “apocalypse”, evoking images of widespread chaos and uprisings, others suggest that the advent of quantum computers will be much more gradual. Many companies such as Signal, Apple, Microsoft, and Google are already adapting to the new reality and updating their cryptography methods. Big internet companies like Cloudflare state that around 50% of their internet traffic is protected against quantum computing-related threats. For ‘ordinary’ citizens, the best thing they can do is to invest in digital security measures and adhere, at minimum, to basic cyber security rules. If your data can be hacked by a conventional hacker, you will have more pressing issues to worry about than Q-Day.
Edited by: Janthe van Schaik, Karolína Hajná
Image Source: Quantum Physics – Waves And Particles, Gerd Altmann from Public Domain Pictures