MIT量子黑客威胁评估报告.pdf

Produced in collaboration withFacing tomorrows quantum hackers todayOrganizations need to strengthen their cybersecurity now before quantum computing becomes powerful enough to break todays encryptions.Preface“Facing tomorrows quantum hackers today”is an MIT Technology Review Insights report developed in collaboration with Abu Dhabis Technology Innovation Institute.The report is based on interviews with cryptography experts,mathematicians,physicists,and senior executives of quantum computing companies worldwide.The interviews were conducted in February 2022 to evaluate how a quantum computer,when one is fully developed,can threaten todays cybersecurity systems,and what enterprises and organizations canand shoulddo today to protect themselves.Poornima Apte was the writer,Kwee Chuan Yeo was the editor,and Nicola Crepaldi was the publisher.The research is editorially independent,and the views expressed are those of MIT Technology Review Insights.We would like to thank the following individuals for providing their time and insights:Najwa Aaraj,Chief Researcher,Cryptography Research Center,Technology Innovation Institute,Abu Dhabi(UAE)Jung Hee Cheon,Professor of Mathematics at Seoul National University,and Director of the Industrial and Mathematical Data Analytics Research Center,Seoul(South Korea)William Hurley,Chief Executive Officer,Strangeworks(USA)Duncan Jones,Head of Cybersecurity,Quantinuum,Cambridge(UK)Dustin Moody,Mathematician;Head,Post-quantum Cryptography Project;National Institute of Standards and Technology,NIST(USA)Jian-Wei Pan,Professor of Physics,University of Science and Technology of China(China)Grgoire Ribordy,Co-founder and Chief Executive Officer,ID Quantique,Geneva(Switzerland)Tony Uttley,President and Chief Operating Officer,Quantinuum(USA)Foreword Welcome to this MIT Technology Review Insights report.Developed in collaboration with Abu Dhabis Technology Innovation Institute,this report analyzes how post-quantum cryptography can serve as an efficient defense against hackers who can one day use quantum computerswhen they are fully developedto attack current cybersecurity systems.In an era of rapid advances in quantum technology,its only a matter of time before we see a fully operational quantum computer that can cripple todays public-key cryptography systems,which form the foundation of todays secure digital communications.With the quantum race gathering momentum as tech leaders grapple with tweaking qubits to help achieve quantum supremacy and advantage,its time to examine and prepare for the ramifications of a post-quantum age.Google and IBM,along with startups such as Rigetti,IonQ,and Xanadu,are building viable quantum-computing systems.In 2019,Google announced that its quantum computer had solved a problem faster than the best existing supercomputers,thus achieving quantum supremacy.In 2020,academic researchers in China also reported that their quantum computers had outperformed conventional computers in working with an algorithm designed for specialized optimization tasks.Clearly,when a cryptographically relevant quantum computer is operational,some forms of secure encryption will be compromised,leading to an imminent breakdown in security and confidentialitytwo hallmarks of todays critical infrastructure systems.There are compelling reasons for enterprises to think about protecting themselves today against the technology of tomorrow.Organizations must make their data and cybersecurity systems resistant to quantum-based attacks,and hybrid solutions are available for those unsure how to proceed with post-quantum cryptography.Since 2016,the National Institute of Standards and Technology in the US has been working with cryptographers worldwide to develop standardized quantum-resistant algorithms that follow stringent testing criteria.The entity is set to make its final selection public in 2022.Researchers at Technology Innovation Institutes Cryptography Research Center have developed a post-quantum cryptography library that provides multiple schemes for public-key encryption,key encapsulation,and digital signatures.In addition,these researchers have found a way to simulate the efficiency of quantum computers in breaking cryptographic codes on classical computers.As this race between quantum physicists and cryptographers reaches a tipping point,there is increasing urgency for todays enterprises to make their operations crypto-agile by adopting quantum-resistant algorithms.Its crucial to proactively plan now to meet this looming threat.We thank all those who contributed their insights to this report,and we hope you enjoy reading this introduction to post-quantum cryptography.Dr.Ray O.JohnsonChief Executive Officer,Technology Innovation InstituteCONTENTS4MIT Technology Review Insights01 Executive summary.5 Definitions.702 Fueling the quantum momentum.803 Bracing for the power of quantum.1004 The path to a cryptographically relevant quantum computer.1105 The quantum threat to public-key cryptography.1206 Developing post-quantum cryptography.14 Expected challenges.16 A hybrid transition?.1707 Conclusion.18 What governments can do.18 What the C-Suite can do.19 No better time than now.205 MIT Technology Review InsightsExecutive summaryWhen it comes to computing ability,the general rule of thumb is more is better.Quantum computers promise to feed this hunger.Their immense processing power derives from their ability to store and handle significantly larger volumes of data than classical bit-driven computers.As a result,a future quantum computer,in theory,could take minutes to solve problems that take classical computers tens of thousands of years.The possibilities of such computing power are enormous.Sifting through libraries of molecular combinations to accelerate drug discoveries,tightening logistics planning,boosting computational chemistry,fine-tuning weather forecasting accuracy,and strengthening financial modeling are just a few of the many applications waiting in the wings.However,one dark cloud lurks on the horizon.As quantum technology continues to advance,hackers can one day use this processing power to break public-key cryptography systems,which form the basis for todays secure interactions over the Internet,as well as other systems such as public-key infrastructure,code-signing systems,secure email,and key-management systems.Experts warn this is a major threat to modern digital security that needs to be tackled now.“It will completely break these crypto systems,”says Dustin Moody,a mathematician at US-based National Institute of Standards and Technology(NIST).Although a full-scale quantum computer has yet to become reality,the danger is imminent.Duncan Jones,head of cybersecurity at a Cambridge-and Colorado-based quantum computing company,Quantinuum,says hes concerned about a particular problem.“If I send you some encrypted data today and somebody records that,they can break into that later on,”says Duncan.“They dont need a quantum computer today to break into it.They can just patiently sit on that data and they can then decrypt in the future.”01As quantum technology continues to advance,hackers can one day use this processing power to break public-key cryptography systems,which form the basis for todays secure interactions over the Internet.6MIT Technology Review InsightsA hybrid transition might be a good stepping stone.Enterprises and organizations unsure how to proceed with post-quantum cryptography can opt for a hybrid solution,which layers a quantum-resistant algorithm onto a classical one.Such a test drive allows them to understand how the new crypto framework might fit into their overall processes.A note of caution:while a hybrid approach is a cautious early measure,enterprises and organizations should not rely on it as a permanent safety net.They need to have a clear plan to transition from the hybrid to the post-quantum cryptography model.It takes a village.Quantum computing involves contributions from various expertsphysicists,cryptographers,computer scientists,and mathematicians.Enterprises and organizations need to beef up their quantum expertise by either hiring in-house talent or working with consultants.Recruiting a trusted resource or two to sift through the hype might pay rich dividends in the long run.Companies and organizations need to figure out how to benefit from the riches of quantum computing while protecting their systems from its problems.Expert advice can help them walk this fine line and increase their value propositions safely and securely.To defend against such quantum attacks,post-quantum cryptography is emerging as an efficient and effective solution.It refers to a set of new cryptographic algorithms,in particular public-key algorithms,that can be implemented using todays classical computers.There is growing urgency for enterprises of all sizes and across all industries,as well as public institutions and other organizations,to make their systems crypto-agile and adopt such quantum-resistant algorithms in their security frameworks.This report explores what enterprises and public institutions can do todayand howto help protect against crippling attacks tomorrow.The key findings of this report:Enterprises and organizations need to make their data and cyber systems resistant to quantum-based attacks now.While a cryptographically relevant quantum computer might still be years away,companies and organizations cannot afford to wait and see how the quantum-computing landscape evolves.Cyber threat actors could harvest sensitive data now and decrypt it later,which means protection needs to kick in today.A quantum-based attack could cripple an enterprises bottom line.Given the high stakes,a proactive,rather than reactive,stance toward such threats becomes crucial.Cyber threat actors could harvest sensitive data now and decrypt it later,which means protection needs to kick in today.A quantum-based attack could cripple an enterprises bottom line.7MIT Technology Review InsightsQuantum computing A computing technique that harnesses the power of quantum mechanics to store data and perform computations hundreds of times faster than the worlds best supercomputer.Quantum cryptography A type of cybersecurity that bases its security operations on physics,specifically quantum mechanics,to get the job done.Quantum key distribution uses this approach,using light,or rather photonsthe particles that make up lightto securely transmit data.Post-quantum cryptography A math-based approach to cybersecurity in the quantum age.Its a set of algorithms that can run on classical devices and quantum devices to resist attacks from both classical and quantum computers.Quantum-resistant cryptography is another name for this approach.Qubit A subatomic particle like an electron or a photon that can be used to relay data.It is a basic unit in quantum computing,equivalent to a“bit”in classical computing.You can use microwaves or lasers to manipulate qubits.You also need to have sufficiently high numbers of qubits,so that they can deliver significantly more processing power than classical computers and break public-key cryptography.Superposition,entanglement,and decoherence Superposition is when a qubit can take on multiple states between just the two binary states that classical bits adopt,0 and 1.These many states mean that a qubit can simply have more information coded into its DNA.In addition,pairs of qubits can group togethera process known as entanglement.They exist in a single state,so manipulating one will affect the other in a specific way.Such a process leads to an exponential increase in processing power when manipulated.However,qubits are extremely unstable and lose their desired state with the slightest external disturbance.Quantum advantage and quantum supremacy Quantum advantage is a milestone achieved in quantum computing when a quantum computer can perform a particular computation significantly faster than the best classical computer.Quantum supremacy is achieved when a quantum computer can develop a solution to a particular problem that no classical computer is able to handlein a reasonable amount of time.NISQ and CRQC A noisy intermediate-scale quantum(NISQ)computer is one we have today and works with 50-100 qubits.It is an“intermediate-scale”quantum computer on the path to a full-fledged one.A cryptographically relevant quantum computer(CRQC)is one that poses a threat to public-key cryptographic systems and will need millions of qubits.DefinitionsYou will encounter the following terms in the report:8 MIT Technology Review Insights02Fueling the quantum momentumQuantum computers can store and process large volumes of data,making them capable of handling problems that classical computers cannot in a reasonable amount of time.The difference between a classical computer and quantum computer lies in the way they process or transmit data.A classical computer uses binary bitseither 0 or 1which can represent only one of those two values at a time.However,quantum computers use qubits that can simultaneously represent multiple possible states of 1 and 0.Qubits can also influence one another at a distance.As you entangle more and more qubits together,the ability of the system to make calculations increases exponentially,rather than in the linear fashion that characterizes a classical computer.Harnessing the power of quantum mechanics,quantum computing therefore promises to surpass even what todays fastest supercomputers can accomplish.Figure 1:Quantum-technology R&D policies by country The proportion of countries with and without coordinated quantum-technology strategies Source:The Canadian Institute for Advanced Research,April 2021130.4%Countries with quantum strategy in development26.1%Countries without national strategy,but with significant government or government-endorsed initiatives6.5%Countries without significant initiatives but are participants in international quan-tum partnerships37%Countries with coordinated national quantum strategyCOORDINATED NATIONAL QUANTUM STRATEGYAustriaChinaFrance GermanyHungaryIndiaIranIsraelJapanNetherlandsRussiaSingaporeSlovakiaSouth KoreaTaiwanUnited KingdomUnited StatesWITHOUT COORDINATED NATIONAL STRATEGY,BUT WITH SIGNIFICANT GOVERNMENT-LED OR ENDORSED INITIATIVESQUANTUM STRATEGY IN DEVELOPMENTCanadaSouth AfricaThailandAustraliaDenmarkFinlandIrelandItalyNew ZealandNorwayPortugalSpainSwedenSwitzerlandUnited Arab EmiratesBelgiumBulgariaCroatiaCyprus Czech RepublicEstoniaGreeceLatviaLithuaniaMaltaPolandRomaniaSloveniaTurkeyWITHOUT COORDINATED SIGNIFICANT INITIATIVES BUT ARE PARTICIPANTS IN INTERNATIONAL PARTNERSHIPS9MIT Technology Review InsightsGovernments and private companies around the world recognize the potential of quantum computingwhich could create a“value of$450 billion to$850 billion in the next 15 to 30 years,”according to estimates from a 2021 report from Boston Consulting Group2and are working to develop their own quantum strategies and res