The Quantum Apocalypse is coming. Sound scary?  Well it can be. If you have information, systems, and devices that need to be kept secure and private, your organization needs to prepare.

Experts estimate that within the next 6-10 years, the cryptographic algorithms that are now the bedrock of the security technologies we use to protect almost every aspect of today’s connected industrial applications could be easily defeated by next-generation quantum computers. 

The inevitable day when quantum computing renders RSA and ECC encryption algorithms obsolete could be so crippling to society, that the security sector has deemed it the “Quantum Cryptographic Apocalypse.”  The hype isn’t unfounded. RSA and ECC encryption are used to secure every data source and system across industries: factories, data farms, utilities, ecommerce and banking systems, transportation, communication networks, and much more.

Yes, quantum computers are big, large, complex, and expensive systems that, at first, will only be affordable for major international technology organizations. However, their use can then spread to various nation states, and eventually to cyber criminals and hackers.

The good news is that there are steps that the manufacturing and tech industries can take now.

Phased Migration to Quantum-Safe Cryptography

Migrating to quantum-safe crypto algorithms will require planning and updates to multiple systems.  Eventually this will include the machines used by in manufacturing and the products that are rolling out on assembly lines. They all need to be protected. In addition, the company’s internal data management and communications systems, as well as third-party applications, servers, and systems, will all need to be updated. 

Engineers and development teams must begin planning now to migrate to quantum-safe crypto. For factories and large enterprises, these measures will be a major undertaking.

Fortunately, all systems do not have to be updated simultaneously. 

By using “hybrid certificates”—security certificates with both traditional RSA or ECC keys and new quantum-safe keys—manufacturers and developers can undertake a gradual, yet safe, migration. Hybrid certificates will enable devices that do not yet support quantum-safe crypto to simultaneously work with new systems that do support quantum safe crypto. Thereby, supporting a gradual migration of critical systems to quantum-safe crypto.

To complete the migration, once all systems are upgraded to support quantum-safe crypto, the hybrid certs can be dropped in favor of pure quantum-safe certificates. However, there are multiple paths to consider for this evolution.

Some companies may instead choose to move directly from traditional crypto to quantum-safe crypto without the hybrid certificate transition period.

For industrial and enterprise environments in which all systems can be simultaneously upgraded to pure quantum-safe certificates, the transition period with hybrid certs can be skipped. However, this quicker, direct migration introduces more risk. If any system is not properly updated, it will no longer be able to communicate with other systems. 

Steps for Direct or Hybrid Migration Plans

The following six steps are required for either direct or hybrid migration plans.

(There are six steps required for an organization to successfully migrate to quantum-safe cryptography—whether upgrading directly or using hybrid certificates.)

1. Upgrade to a quantum-safe PKI security infrastructure

The first step towards migrating to quantum-safe cryptography is to upgrade the public key infrastructure (PKI), including the certificate authority, in order to utilize quantum-safe crypto algorithms. Rather than trying to upgrade internal PKI systems, this may be an ideal time for companies to migrate to a commercial Certificate Authority (CA), such as Sectigo, which can provide commercial support for quantum-safe crypto algorithms.

Whether moving to an in-house PKI system or adapting a solution from a commercial vendor, it is critical that the CA provide support for quantum-safe crypto algorithms and quantum-safe certificate issuance. If the IT security team chooses to use hybrid certificates, they must select a CA that supports both hybrid certificates and pure quantum-safe certificates. 

Once an organization upgrades their existing CA, or selects a new CA, the CA must issue a new quantum-safe root and intermediate certificate.

2. Update server applications to recognize and use new crypto algorithms

Migrating to quantum-safe crypto requires updating the crypto libraries used by server applications to support both the new crypto algorithms and the new quantum-safe certificate formats, including hybrid certs, if used. If hybrid certificates are used, server applications will need to recognize and process both traditional RSA/ECC certs and hybrid certs containing quantum-safe crypto keys. This requires the server applications to distinguish between the two different certificate types and handle each with the proper crypto algorithm for that certificate type.

3. Update the client crypto algorithms

Next, IT and development teams will also need to update a wide range of client applications to use quantum-safe crypto algorithms. Once fully and safely upgraded, administrators can discontinue use of traditional RSA/ECC keys/certificates in client applications and instead use the new quantum-safe equivalents.

The exception to this policy is a client application that communicates with multiple server applications that may not all be simultaneously upgraded to quantum-safe crypto. In this case, hybrid certificates will allow the client to work with servers supporting traditional RSA/ECC crypto, while at the same time, use quantum-safe algorithms with servers that support these newer algorithms.

4. Install quantum-safe roots on all systems

Each security system utilizing PKI has a trusted root store. This root store contains the certificates for the root and intermediate CAs that issue certificates within the PKI system. Once systems have been updated to support quantum-safe crypto algorithms, these root stores must be also updated to add the new root and intermediate certificates.

5. Issue new quantum-safe certificates to connected device and applications

After IT teams have updated all of a company’s systems to support quantum-safe crypto, they must issue new certificates and install them on all the endpoints. Once completed, each device can begin using quantum-safe crypto algorithms, as enabled by the new certificates.

6. The Final Step – Get rid of the old

The final step in migrating to quantum-safe crypto is to deprecate the traditional encryption algorithms so that they are no longer used. This can be done gradually on applications and systems as they are migrated to the new algorithms. After all systems have been migrated, the root ECC and RSA certificates should be revoked, ensuring they are not used by any system. 

A Good Time to Move to Automated Certificate Management

Migrating to new crypto algorithms and PKI systems will require issuing large numbers of new certificates as each device/application will require a new certificate. For organizations that do not already support automated certificate management, this is excellent time to consider implementing automation tools.

Today, there are easy-to-use certificate management platforms that both enable automated certificate discovery and renewal to ensure systems do not fail due to an expired certificate, as well as ease the administrative burden of installing new certificates on devices and systems. Support for automation tools should be a high priority for security teams considering a new PKI solution.

About the Author

Alan Grau has 30 years of experience in telecommunications and the embedded software marketplace. He is VP of IoT/Embedded Solutions at Sectigo, the world’s largest commercial Certificate Authority and a leading cybersecurity provider of digital identity solutions. Alan joined Sectigo in May 2019 as part of the company’s acquisition of Icon Labs, a provider of security software for IoT and embedded devices, where he was CTO and co-founder. He is a frequent industry speaker and blogger and holds multiple patents related to telecommunication and security. Prior to founding Icon Labs, Alan worked for AT&T Bell Labs and Motorola.  He has an MS in computer science from Northwestern University.