RSA - the mother of modern encryption

Encrypting (making something unreadable) works by scrambling text according to certain rules. Decrypting requires solving a mathematical puzzle - one that is very easy to solve when you have the key and impossibly hard to solve if you don't.

For example: "21 is the product of which prime numbers - given one number is 3?" Easy: 21 = 3 x 7. Your key is a the pair 3 and 7. If you are a first-grader, solving that puzzle without the "3" hint might take you years indeed. Now, modern RSA uses pairs with up to 300 digits each.

Shor's algorithm ruins it all - enter quantum computers

We read exciting news about quantum computers and the problems they solve.

Guess what else they will solve.

A gentleman called Peter Shor proved that quantum computers can break certain puzzles like twigs - RSA, for example. The estimate is that RSA-2048 (a current recommendation) won't stand up to a quantum computer with 4,100 qubits. Google, IBM and others have 1000 qubit quantum computer planned for 2025, up from 53 in 2019. Estimates give RSA until 2030.

What is at stake

Encryption is used for securing communications (making sure nobody can intercept your emails), but also to establish trust on the internet. You don't know that you are buying from an Amazon server - you trust it, because there is a server with a valid certificate that says it is an Amazon server. All of that would come become vulnerable without encryption.

One of the worst issues are "harvest now, decrypt later" attacks. If you plan on getting a powerful quantum soon, you can collect encrypted emails and web traffic of dissidents, journalists, heads of states and competitors today. You can buy encrypted health data nobody is able to read yet. That data is almost worthless today - but it may be dangerous years down the road.

What needs to be done

In short: The mathematical puzzles need to be replaced with ones that are ill-suited for quantum computers ("quantum safe"). Data needs to be re-encrypted, new certificates issued.

This situation is being called "Y2Q", after the year 2000 problem. Although many people ridiculed the bug ("nothing happened"), that was because years of work and over $500 billion in today's money were spent remediating it.

Different than Y2K, there is no fixed deadline and data can be harvested already. Oh - and nobody has yet seen a 4,000 qubit quantum computer to test which algorithm will make it sweat.

Building and renting quantum computers

Quantum technology can theoretically make communication un-eavesdroppable, the ultimate protection. Quantum technology solves many problems and speeds up progress.

But as a side product, quantum computing makes communication insecure and creates an arms race to build faster machines.

Selling you protection

At the same time, Big Tech and consultants are stoking fear preparing you for the very real necessity of upgrading your gear and data. IBM builds quantum-safe servers. Google and Microsoft will release quantum-as-a-service, and everyone will tell you their clouds are where you should be headed.

Mostly, Big Tech is interested in having standards defined quickly (Googlers participated in 3 of the winning algorithms) so they can be implemented, as their infrastructure will be at risk, like everyone else's.