Jeffery DelViscio: Quantum and cryptography: those are two words that might strike fear in the minds of the uninitiated. But in February’s issue of Scientific American, we have a story about how they’re colliding—double whammy.
Here to walk us through it is Kelsey Houston-Edwards. Kelsey is a mathematician and journalist. She formerly wrote and hosted the online show PBS Infinite Series. And she wrote this story, called “Tomorrow’s Quantum Computers Threaten Today’s Secrets. Here’s How to Protect Them.”
Welcome to Science, Quickly, Kelsey.
On supporting science journalism
If you're enjoying this article, consider supporting our award-winning journalism by subscribing. By purchasing a subscription you are helping to ensure the future of impactful stories about the discoveries and ideas shaping our world today.
Kelsey Houston-Edwards: Thank you. Thanks for having me.
DelViscio: Okay. Let’s jump right into this mathematical quantum tension. How is quantum computing an issue for cryptography?
Houston-Edwards: So cryptography is the art of sending messages in a way that someone in between cannot read them—that only the sender and receiver can read them. And there are essentially two different ways that this is done right now.
And the first one is: A sender and receiver have the same key, and they use that key to lock and unlock a box. And the message is securely locked in the box in between. The problem with this type of cryptography is that the sender and receiver of the secret message need to have the same key beforehand. It doesn’t work if the sender and receiver have never spoken before.
So if you want to securely send your credit card information to maybe a clothing store online that you have no prior contact with, you don’t have that secret key with them. You need to use something that’s called public-key cryptography that’s done entirely in the open. And it’s always done between two parties with no prior communication.
And that type of cryptography, at the heart of it, are very hard math problems, and quantum computers, if they were big enough, could solve these very hard math problems. If a quantum computer were to solve the very hard math problems that are at the heart of public-key cryptography, then the cryptography wouldn’t work. It wouldn’t be secure anymore. And we rely on it to send information in many, many, many contexts in the modern world.
DelViscio: I think, on that point about using it to send information, you know, there’s public-key cryptography. It’s kind of an invisible system for most people. You don’t think about it. You mentioned, you know, purchasing, making a purchase at an online clothing store.
How deeply does encryption go? Like, what kinds of systems, like what kinds—is it all data, basically?
Houston-Edwards: Public-key cryptography is all over the place. It is in many, many, many systems that you use every single day. But I think most cryptographers would tell you that if cryptography is working well, you [don’t]—you don’t know that it’s happening.
It’s happening behind the scenes. And if everything goes well, you will never know what is happening. It’s only when cryptography fails that we really hear about it.
So, for example, every time that you start an online transaction with your bank or anywhere else that’s secure, many other kinds of video messaging services, things like that ... every time you start it, they’re going to do a public-key cryptography transaction, essentially, and they’re going to exchange this private information in, in a public way.
When you log in to your bank, it’s also used to verify that information is coming from a reliable source. So when your phone updates, when it says, “Please download this new update,” you want to make sure that that is really coming from Apple or whatever other company owns your phone. And the reason you can be sure that information is coming from a reliable source is public-key cryptography.
DelViscio: So basically, it’s baked into everything we do these days.
Houston-Edwards: Yeah—public-key cryptography that you’re using many, many times a day.
DelViscio: And so the prospect of losing that security—you talked to a bunch of experts in the field about this. What does a world without this look like?
Houston-Edwards: I think most experts don’t genuinely feel that we will have a world without this cryptography because quantum computers can break this type of cryptography but only larger quantum computers than we have right now.
This is a problem about larger quantum computers in the future, and we know how to solve it. We actually have new kinds or alternative kinds—actually, many of them are not new but alternative kinds of public-key cryptography that quantum computers cannot break, or at least we don’t know how to break them with a quantum computer. So we know the solution to this problem.
We know how to change our systems so that a quantum computer is not the threat that it is. But changing systems is very, very hard. There are a lot of people and institutions working to shift everything over, but it’s a very long and slow process, and the hope is that it will happen before quantum computers can really break our cryptography.
DelViscio: So on that, the sort of timeline for this—for somebody who’s sort of been around long enough, it reminds me of a thing that used to exist, which was this sort of specter of massive disruption and crash in the Y2K bug, which was a software issue in 2000 where all these old computers, which, you know, had been coded with the date as two digits, not four, in terms of the year to save space because, you know, computers were large but also not great with storage—when that was supposed to roll over to the year 2000, there was an assumption that everything would sort of fall apart.
That didn’t happen, largely. But now we have this thing called “Y2Q”. So could you tell us a little bit about what that is? Is it just kind of a fun way to talk about this new thing?
Houston-Edwards: So a information security company sort of came up with this idea of Y2Q—“years to quantum”—as an analogy with Y2K.
It’s not as precise because we don’t know when a quantum computer will come. We knew exactly when the year 2000 would come, but we don’t know when there will be a large enough quantum computer to break cryptography. But they’re trying to point out that we should be looking forward to that date, whenever it is, and we should be making all of our changes now before that.
We should be concerned, especially because there’s this uncertainty about when a large enough quantum computer will be built, and we should be making changes now.
There’s an additional reason to change cryptography now before the problem arises, and that’s because a future quantum computer could retroactively decrypt messages that are sent now using standard cryptography of today—the things that your computer is doing right now.
That’s not such a concern in many applications. For example, if you send your credit card number online..., if a quantum computer is invented or a large enough quantum computer is invented 20, 30 years from now, you probably have a different credit card number. So that’s probably not a concern. But hospitals are storing medical records or sending medical records using this kind of cryptography.
Governments are sending national security, very highly classified information, using this kind of cryptography. And that information you probably want to be secret for more than 20 or 30 years. So it’s kind of alarming that in 20 or 30 years you could decrypt anything that’s sent securely now. So we want to really change over these systems now to keep things secure for the long term.
DelViscio: Do you get a sense of where a computer like that might be built? Is it on the horizon? Are there candidates out there? Are there rogue governments building large quantum computers?
Houston-Edwards: Yes, there is of course this possibility that someone, somewhere has the quantum computer to solve these problems. But that seems very, very unlikely. I think most experts feel that we would know about such a thing.
When you ask experts in quantum computing, “What will a future quantum computer look like, and what is the time line?” their answers are quite varied and often include a lot of uncertainty. But I think that uncertainty is part of what makes cryptographers nervous. Cryptographers need to prepare for quantum computers, and even the experts in quantum computing can’t exactly tell you when it’s coming and how.
So that uncertainty makes the issue all the more important to address right now.
DelViscio: It’s a system that pretty much holds up our digital society as it exists, so probably reasonable—all caution and worry there.
Houston-Edwards: Yeah, there is movement to change these things. So right now the National Institute for Standards and Technology (NIST) is standardizing new types of public-key cryptography, which will be implemented in the future in all systems. That may take a long time, but they will be implemented, and we hope that those new types of public-key cryptography cannot be broken by a standard computer or a quantum computer.
But there’s actually never a guarantee in cryptography. No one knows for sure that those are secure. So it’s always a little bit of a cat and mouse game with cryptography.
DelViscio: Well, it’s a really fascinating subject, and it seems incredibly important in the long term, maybe, but incredibly important to everything. So thank you for reporting on it. It’s really fascinating. And if you want to learn even more about quantum cryptography in the coming issues, read Kelsey’s story in the February issue of the magazine, where you can also learn more about “Bob,” “Alice” and “secret brownies.”
I’m just going to leave that there and let you figure it out: ScientificAmerican.com.
Kelsey, thanks so much for coming on the podcast and talking to us about it.
Houston-Edwards: Yeah, thanks for talking to me.
DelViscio: Kelsey Houston Edwards is a mathematician and journalist. She formerly wrote and hosted the online show PBS’s Infinite Series. Science, Quickly is produced by me, Jeff DelViscio, and Tulika Bose.
Like and subscribe wherever you get your podcasts. And for more science news, go to ScientificAmerican.com. For Science, Quickly, this is Jeff DelViscio.
