Quantum Attacks on Modern Cryptography and Post-Quantum Cryptosystems

Cryptography is a critical technology in the modern computing industry, but the security of many cryptosystems relies on the difficulty of mathematical problems such as integer factorization and discrete logarithms. Large quantum computers can solve these problems efficiently, enabling the effective cryptanalysis of many common cryptosystems using such algorithms as Shor’s and Grover’s. If data integrity and security are to be preserved in the future, the algorithms that are vulnerable to quantum cryptanalytic techniques must be phased out in favor of quantum-proof cryptosystems. While quantum computer technology is still developing and is not yet capable of breaking commercial encryption, these steps can be taken immediately to ensure that the impending development of large quantum computers does not compromise sensitive data. QUANTUM ATTACKS ON MODERN CRYPTO 4 Quantum Attacks on Modern Cryptography and Post-Quantum Cryptosystems Encryption is a vital technology to our modern world. In an economy and society that thrives from and depends on the proliferation of free and secure access to information by means of the Internet, encryption is a fundamental part of the stack of computer technologies that enables private information to be exchanged securely over public channels. Additionally, encryption safeguards national security by protecting sensitive information and enables private citizens to maintain the integrity and privacy of their own data. Acknowledged or not, encryption is fundamental to modern life. However, encryption is only as useful as it is secure, and many previously secure encryption technologies may soon become vulnerable to attack by new, advanced quantum computing systems. Quantum computers manipulate and store data in a manner that leverages the quantum-mechanical structure of the small-scale Universe – this property allows quantum computers to perform calculations that have never been possible with any other type of computer system. While these abilities will certainly lead to massive breakthroughs in the data processing and data analytics industries, the development of quantum computers has an unfortunate side effect. Many of the underlying cryptographic primitives that make modern encryption possible will be rendered insecure in view of the massive calculation power of a quantum computer of appropriate size and design. However, quantum computers do not spell the doom of cryptography as a whole. Many existing cryptosystems are known to be resistant to the threat posed by quantum QUANTUM ATTACKS ON MODERN CRYPTO 5 computing technology. While they are not commonly used in practice, quantum computers are becoming increasingly well-studied and thus these algorithms will be vital to the survival of cryptography in the post-quantum-computer age. A full understanding of the vulnerabilities of modern encryption technology, as well as the necessary solutions, is critical in order for our information-based civilization and economy to continue to grow and thrive in spite of the threats posed by this new technology. Basics of Modern Cryptography Although cryptography applications are endless and their effects on the computing industry are profound, cryptography's foundation is nothing more than simple mathematics. Although the theoretical background behind some specialized forms of cryptography and the various attack classes that exist for various cryptosystems may require a more thorough education in mathematics, the basics of the most commonly used forms of cryptography are more substantially accessible. Most cryptosystems can be broadly categorized into one of two groups – symmetric-key cryptosystems and asymmetric-key cryptosystems (Schneier, 1996). These categories differ in construction and in application, and as a result they present different attack surfaces. Commonly-used asymmetric-key cryptosystems such as RSA (Rivest, Shamir, & Adleman, 1978) and Diffie-Hellman (1976) tend to have mathematical structures that are prone to attack by quantum computers (Shor, 1996). Symmetric-key cryptosystems are generally able to compensate for the potential of quantum attacks by utilizing higher key sizes – in most cases, this achieves an equivalent level of security to that which would be available with a lower key size if the threat of a quantum attack was QUANTUM ATTACKS ON MODERN CRYPTO 6 not considered (Augot et al., 2015). However, the quantum-specific vulnerabilities found in the most commonly used asymmetric-key cryptosystems are typically fundamental in the design of the cryptosystem (Shor, 1997), and thus cannot be offset by an increase in key size or by a change in some parameter of the cryptosystem. Symmetric-Key Cryptosystems Symmetric-key cryptosystems are named for the fact that the same encryption key is used to perform the encryption and decryption operations of the cryptosystem – in other words, the operations are symmetric with respect to the key used (Schneier, 1996). To formalize this, let M be the set of all possible “encryptable” messages, let C be the set of all possible ciphertexts, and let K be the keyspace. A symmetric-key cryptosystem defines the functions E: M × K → C and D: C × K → M such that for any m ∈ M and k ∈ K, there exists c ∈ C such that E, D satisfy: E(m, k) = c D(c, k) = m Symmetric-key cryptography is highly suitable for applications involving a single party, such as encryption of files on a disk (Schneier, 1996). Since the key is known to the owner of the encrypted files, the files can be encrypted and decrypted by their owner whenever necessary. However, they cannot be read by other parties while they are encrypted. Symmetric-key cryptography is highly useful for communicating large amounts of data securely between two or more parties, as symmetric-key algorithms tend to be relatively efficient and support the fast encryption and decryption of large quantities of data. Some symmetric-key cryptosystems that are common in modern usage include QUANTUM ATTACKS ON MODERN CRYPTO 7 AES (Advanced Encryption Standard), 3DES (Triple Data Encryption Standard), Blowfish, and Serpent. However, this form of communication requires that all parties pre-establish the symmetric key to be used, and this presents a challenge when the parties are forced to communicate over an insecure channel. The key cannot simply be transmitted unprotected over the channel, as an eavesdropper could obtain the key in transit and passively decrypt all further communications between the two parties. Fortunately, asymmetric-key cryptography enables the secure exchange of data over an insecure channel without any kind of pre-established shared secret, albeit at a performance cost (as asymmetric-key algorithms tend to be dramatically slower than symmetric-key algorithms) (Schneier, 1996). Thus, a common strategy is to use an asymmetric-key encryption to agree on a symmetric key, which is then used for further communications. Asymmetric-Key Cryptosystems Asymmetric-key (or public-key) cryptosystems are named for the fact that different encryption and decryption keys are used for the encryption and decryption operations of the cryptosystem (Schneier, 1996). The encryption key is commonly referred to as the public key and the decryption key is commonly referred to as the private key. This terminology comes from asymmetric-key cryptography’s key use case – the ability to publish the encryption key, allowing third parties to encrypt data that will henceforth only be readable by the owner of the private decryption key (Schneier, 1996). Formally, if Ke is the public-key keyspace and Kd is the private-key keyspace, an QUANTUM ATTACKS ON MODERN CRYPTO 8 asymmetric-key cryptosystem defines the functions E: M × Ke → C and D: C × Kd → M such that for any m ∈ M and keypair (ke , kd) ∈ Ke × Kd, there exists c ∈ C such that: E(m, ke) = c D(c, kd) = m As mentioned previously, asymmetric-key algorithms tend to be substantially slower than their symmetric-key counterparts. This is due to the computationally expensive mathematical operations that are involved in running E, D for an asymmetric-key cryptosystem (Schneier, 1996). However, as public keys in such a scheme can be disseminated publicly without threatening the integrity of the encryption, asymmetric-key cryptography is very useful for solving the problem of an initial secure data exchange over an insecure connection (Schneier, 1996). If a possibly insecure but reliable connection exists between two parties in a communications network, an asymmetric encryption scheme can be used to negotiate and agree on a shared secret key that can then be used for high-speed symmetric-key encryption between the two parties. The connection is allowed to be insecure because the only data that needs to pass over the connection is one of the parties' public key and the corresponding response consisting of the encrypted shared secret. Neither of these allow an eavesdropper to read the content of the encrypted message, but the initial sender of the public key retains the private key needed to decipher the transmission and read the response, obtaining the shared secret (Schneier, 1996). However, reliability is critical – if an attacker can intercept and replace communications on the network between the two parties, the attacker can relay his own public key to the second party. When the second party responds, the attacker may then QUANTUM ATTACKS ON MODERN CRYPTO 9 decipher the shared secret with his own key, re-encrypting and passing along the message under the initial sender's public key. The attacker will then have the ability to read all further symmetric communications passed between the two parties. This form of attack is known as a man-in-the-middle (MITM) attack and, other than a minor amount of added latency, may be undetectable by either legitimate party (Schneier, 1996). The endpoint parties believe that they are communicating directly while their messages are, in fact, being