# Evaluating the Efficiency of Physical and Cryptographic Security Solutions for Quantum Immune IoT
## 2 Security Threats in the Post-Quantum Era  
This section provides background information on post-quantum security. It explores the security threats against communication security and particularly against key exchange that are enabled by the development of quantum computers. After providing an overview of the 'quantum threat', we contribute two threat models that encompass both physical layer and cryptographic security aspects. Current quantum computers are energy inefficient as they operate at temperatures close to the absolute zero. However, for specific applications, quantum computers are more efficient than classical computers. A prominent application for quantum computers is cryptanalysis, i.e., the breaking of cryptographic protocols. In particular, the following algorithms for quantum computers are efficient and will have a major impact on security:  
* [PERSON]'s algorithm [1; 2] will break asymmetric cryptography. The algorithm can be used to solve integer factorization and (elliptic curve) discrete logarithms, which have been used in many existing public keys cryptosystems, including Rivest-Shamir-Adleman (RSA), Digital Signature Algorithm (DSA), Diffie-Hellman (DH) key exchange, as well as Elliptic Curve Cryptography (ECC). * [PERSON]'s algorithm [3] will weaken symmetric cryptography. The algorithm will speed up brute force attacks against symmetric cryptography, such as Advanced Encryption Standards (AES) and Secure Hash Algorithm versions 2 and 3 (SHA-2, SHA-3). At the moment, the quantum threat is theoretical as quantum computers that fulfill the requirements of [PERSON]'s algorithm are not available. To break an RSA algorithm with a key size of 2048, a quantum computer of 10,000 qubits [21] or 4000 qubits with 100 million gates [22] is needed. To break a 160-bit ECC key, a quantum computer of around 1000 qubits is needed [23]. The first commercial special-purpose quantum computers have reached capacities of around 2000 qubits [24] but only with high error rates and thus do not qualify for [PERSON]'s algorithm. Universal quantum computers--applicable for quantum breaking--have only recently reached a capacity of 16 qubits [25] that is far away from quantum breaking capabilities. Different opinions on the availability of quantum computers for [PERSON]'s algorithm have been proposed. According to the most optimistic views, a million qubit system (corresponding to 1000 error corrected qubits) might be conceivable within 10 years [26]. Many believe that the construction of a quantum computer for [PERSON]'s algorithm will take decades should it ever emerge at all. Nevertheless, the potential existence of even one quantum computer offers motivation to secure trillions of connections with solutions, which are not weak against quantum computers. Therefore, National Institute of Standards and Technology (NIST) is currently standardizing algorithms [4] and the first standards for post-quantum crypto are expected in 2022-2023. Figures 1 and 2 illustrate two different threat models in post-quantum scenarios. The figures combine elements that are relevant both for the physical layer security as well as for cryptographic security. In both figures, we have [PERSON] and [PERSON] communicating via a wireless channel. In the first figure, we have the passive eavesdropper [PERSON]. To prevent eavesdropping, [PERSON] and [PERSON] are trying to agree on a secret session key that can be used to protect (with some symmetric cipher) the confidentiality of any subsequent application data. The key agreement must be confidential, but it can be based on a cryptographic or physical layer scheme. Note that [PERSON] does not need to have run-time quantum breaking capabilities. If she is able to capture all the transmitted key exchange information and subsequent protected communication, she may, later when she has a quantum computer, resolve the session key using [PERSON]'s algorithm and decrypt the recorded communication.