Quantum-Safe Cryptography: A Call for National Action

For years, I have emphasized the strategic significance of expanding Europe’s and Italy’s presence in the global microchip supply chain exploiting the ongoing restructuring due to the U.S.-China tensions. However, there is another technological challenge involving national supply chains on the horizon that demands attention: the management of risks in the realm of cryptography, driven by the advent of quantum computers.

Without delving into technicalities, quantum computing operates on qubits, which can simultaneously represent two pieces of information. In contrast, classical computers use bits valued at either 1 or 0. As the number of qubits increases, so does the potential for exponentially greater computing power in quantum computers. This is not the case with traditional computers. IBM’s recent achievement of Osprey, boasting 433 qubits, is a notable milestone. When quantum computers with several thousand qubits become a reality, problems that currently require centuries of computation could be solved in a short time. One example of such a problem is prime number factorization, the foundation of the RSA asymmetric cryptosystem, among other applications. Fujitsu researchers contend that a minimum of 10,000 qubits is needed to crack RSA encryption. Undoubtedly, the country that successfully deploys this level of quantum capability will attain a decisive strategic advantage in military, intelligence, and commercial domains, because a significant portion of the data encrypted with current ciphers will effectively be exposed in plaintext. These ciphers currently safeguard much of the Internet protocols as well as credit card data during online transactions. Research, development, and substantial public and private investment in the United States, China, Japan, and, to a lesser extent, Europe, have created an environment where experts anticipate a technological breakthrough in the medium term.

To prevent any technological surprises, President Biden recently issued an executive order mandating the transition of all federal government information assets to encryption protocols, namely quantum-safe protocols, that are resistant to quantum computer attacks by 2035. While 2035 may seem distant, the process that must be initiated is lengthy, intricate, and involves multiple stakeholders. Federal agencies and local governments must identify software and computer systems requiring replacement. Given the scale of this endeavor, clear priorities must be established, with strategic systems and data taking precedence in adopting the new encryption systems. The industrial supply chains involved in manufacturing encryption and decryption software packages and devices will also be affected. Unlike microchip supply chains, encryption supply chains have historically been domestic, primarily to protect strategic and critical communications and data, including military information. The scientific community must develop quantum-safe cryptographic algorithms. In 2016, the U.S. National Institute for Standards and Technology initiated an international scientific competition to evaluate algorithms for industrial use. After years of rigorous evaluation for correctness, security, and efficiency, four proposals have emerged as survivors and are now entering the phase of assessing industrialization costs. As these top quantum-safe algorithms become standard, national industrial supply chains will implement them, eventually replacing existing cryptographic systems. This magnitude of change will also impact commercial communications and data, creating a substantial civilian market.

Each allied country must promptly undertake a nationwide effort to upgrade their cryptographic systems; failure to do so will impede the sharing of sensitive information among allies. The country that acts swiftly will seize a significant share of the civilian quantum-safe encryption market. Hence, it is crucial for each nation to have technology solutions that can competitively meet these requirements, safeguarding both national communications and commercially sensitive sectors like banking. This necessitates a long-term systemic approach. A nation caught unprepared will be compelled to seek these technologies abroad, which carries its own disadvantages, even solely from a commercial standpoint. Given Italy’s reputable presence in the encryption industry, it is incumbent upon us to accept this challenge and to be in the heading nations’ group leading this change.
.