Risk management and the quantum threat

Quantum computers are supposed to be of great value for research in the field of medicine, material science, energy, transport and logistics. However several standardization institutes like NIST report that the quantum computer poses a threat to cyber security. The impact of quantum computing on broadly deployed crypto-systems is clear. Shor’s algorithm will break public-keycryptography systems and Grover’s algorithm will weaken symmetric-key-cryptography systems. However, the time of arrival of a quantum computer that can run these algorithms is not as clear as the impact. This thesis investigated the requirements for running Shor’s algorithm to break RSA-2048 and uses the obtained information to propose tools that support risk-management regarding the quantum threat. We conclude that the gap between the requirements to run Shor’s algorithm to break RSA-2048 and the available physical resources is significant. This gap can be closed by progress on the supply side and by progress on the demand side. On the demand side, progress in fault-tolerant architectures and/or reducing the required number of T-gates will significantly reduce the gap. On the supply side, progress in the number of physical controllable qubits and an increase in the fidelity of quantum gates will significantly reduce the gap. Also should be noted that breaking other algorithms requires a different set of physical resources, which results in other gaps. This information is used to define the topics to monitor the quantum threat regarding its impact on cyber security. Monitoring is necessary because our society depends heavily on ICT. The vulnerable crypto-systems are used in various types of security protocols, which facilitate services like online shopping and banking, online access to your health-care test results, online registration for social funds for citizens, providing citizens online trusted information about calamities. Not being able to trust these technologies supporting these and other online services cripples society. The government has its responsibilities regarding cyber security as well as businesses and organizations as described in the second national cyber security strategy. The national cyber security center can use its role as expert authority on cyber security to provide public and private parties with information derived from monitoring the quantum threat. For this purpose, the proposed monitoring framework can be used. Businesses and organizations can use the proposed translation method to determine how the quantum threat impacts their strategic risks. Additionally a pragmatic approach is proposed. It uses the results of the proposed translation method to select one of three scenarios. Each scenario has guidelines for actions depending on the significance of the impact on strategic risks. Using the pragmatic approach creates a balance between the uncertainty about when the risk materializes and the investments required to investigate and act upon the risk. This is different compared to other approaches, which use an asset-based approach and start prioritizing after an inventory of vulnerable IT assets. The monitoring framework, the translation method and the pragmatic approach give the public and private sector tools to act on the quantum threat. This is a first step in enabling society to reduce the negative consequences of quantum computing on society and to fully benefit from positive consequences.