No, Seriously: Worry About Q-Day

I’m tired about worrying about AI (no, I’m not falling for “superintelligence"). I’m choosing to not get too concerned about the plague, for now.  But, darn it, now I have to think about Q-Day.

Q-Day may happen before we realize it. Credit: Microsoft Designer

For those of you not well versed in quantum computing, Q-Day is the long-predicted date when quantum computers will be powerful enough to render our existing encryption methods useless. Quantum computers are going to be that much better than the best supercomputers. Earlier this year Google announced that, whoops, we better be ready for a post-quantum cryptography (PQC) migration by 2029, and I’m betting it happens before then.  

What started me thinking about this is that IonQ, one of the leaders in quantum computing, announced it was buying Elisity, a major cybersecurity firm. “With Elisity and its team as part of IonQ, we will be well positioned to help customers protect critical infrastructure and enterprise networks throughout the transition to the quantum era,” said Niccolo de Masi, Chairman and CEO of IonQ. “As I said first, Q-Day is coming much faster than predicted.”

Mr. de Masi vowed:

IonQ is offering its customers a vertically integrated full-stack quantum platform across quantum computing, networking, sensing and cybersecurity….Elisity will bring proven enterprise policy enforcement scale and deployment experience to our quantum security strategy and will give IonQ a strong growth platform to serve customers and create value for our shareholders.

Or, as he told Lauren Thomas of The Wall Street Journal: “The bad guys are going to keep taking advantage of new technology. Unfortunately, we are entering the most dangerous years, vis-à-vis cybersecurity risks.” 

I.e., if AI doesn’t get you, quantum computing will.

IonQ is having a year. Earlier this year it acquired chip-maker SkyWater Technologies to beef up its ability to serve as a “quantum foundry,” and Mr. de Masi believes that with the combination: “Secure chip design, fabrication, and packaging will deliver vertical integration across our full stack of quantum applications for land, sea, air, and space.”

He told Ms. Thomas: “This is our move to make sure we are the ‘Nvidia’ of quantum.”   

Last week InoQ was also one of four companies named to the final stage of Darpa’s Quantum Benchmarking Initiative (QBI), “which seeks to determine whether any quantum computing approach can achieve utility-scale operation – meaning its computational value exceeds its cost – by the year 2033.”

Darpa may need to talk to Google about that timeline.

One of the other finalists, IBM, thinks Q-Day has already begun. IBM’s Rina Diane Caballar writes:

The good news is that Q-Day won’t be, as in some media depictions, a hacker apocalypse triggering societal collapse. It will be a years-long series of vulnerabilities, with multiple opportunities for organizations to avoid catastrophe. The bad news is that, in a way, Q-Day has already arrived.

She notes: “Attackers are playing the long game, gathering and storing encrypted data now with the intent to decipher it once quantum capabilities mature, in a tactic known as “harvest now, decrypt later.””

Indeed, Google warned:

Quantum computers will pose a significant threat to current cryptographic standards, and specifically to encryption and digital signatures. The threat to encryption is relevant today with store-now-decrypt-later attacks, while digital signatures are a future threat that require the transition to PQC prior to a Cryptographically Relevant Quantum Computer (CRQC). 

“It’s not that Q-Day is in the future. Q-Day is, in a sense, in the past,” said Shohini Ghose, a quantum physicist and professor at Wilfrid Laurier University, in an interview with IBM Think. “We have the digital equivalent of needing to change every door lock on the planet,” Zygmunt Lozinski, Senior Technical Staff Member and Quantum Ambassador at IBM, also told IBM Think.

Brandt Pasco writes in The National Interest:

When Q Day arrives, the Root of Trust (RoT) underpinning all electronic transactions—banking, power grids, defense systems, health care, supply chains, global financial markets—can be shattered at blinding speed. Everything connected to the internet becomes vulnerable without warning. If we are not prepared, the 21st-century economy goes back to the Stone Age. We do not know when Q Day will arrive. We only know it is coming, and fast.

Worried yet?

The cryptocurrency world is recognizing the threat quantum computing poses, and Europol’s European Cybercrime Centre (EC3) recently warned about the risks, although it said the more immediate risks were to cryptowallets rather than to the blockchains themselves.  Christopher Smith, CEO and co-founder of blockchain start-up Quantus Network, told Cointelegraph, that quantum attacks would be hard to detect: “the only forensic evidence would be that there was no breach.”

NGRAVE CEO Roy Blackstone pointed out to Cointelegraph that AI has changed the timeline:

Most threat models assumed we had well into the next decade before quantum technology could realistically crack the cryptography securing public keys, but it did not account for how fast AI would develop alongside it.

Speaking of Nvidia, it recently joined The Post-Quantum Communications (PQC) Consortium, led by cybersecurity and network intelligence firm Allot. “The transition to quantum-safe communications is one of the most important cybersecurity challenges facing the world today," Allot CTO Yaakov Stein noted.

Let’s all agree on that.

Earlier this year President Trump issued an executive order directing federal agencies to prepare for a post-quantum cryptography (PQC) world, with National Institute of Standards and Technology (NIST) taking the lead in defining how. Somehow I don’t think it will be that easy, or that the federal government will be as nimble as it will need to be. As Mr. Pasco said: “The problem is that NIST’s Cryptographic Module Validation Program has fallen far behind.”

Mr. Pasco adds:

Fairness requires acknowledging NIST has good people working on this problem. They have not been sitting on their hands. At the same time, Q Day has not been getting the attention it requires among politically accountable policymakers in the executive branch, Congress, or industry. The effort has been underfunded and has lacked adequate high-level attention.

He still holds out hope: “We made Y2K boring. We can make Q Day boring, too. It is not yet too late, but the window is closing and is measured now in months, not years. Building trusted post-quantum cryptography is the only thing standing between Q Day and the Stone Age.”

I know less about quantum computing than I do artificial intelligence, and I’m no expert in AI. It may well be that AI will have taken over the world before Q-Day hits, but it sure would be ironic if we survive the AI boom only to have quantum computers take us back to the Stone Age.