Quantum computing’s uncertain timetable

The quantum security deadline isn’t when the quantum computer arrives, says Tim Hudson, President, OpenSSL Corporation.

Ask when organisations need to prepare for post-quantum cryptography and it is tempting to answer with another question: when will we have a quantum computer powerful enough to break the cryptography we use today? I think that misses the point.

Nobody can give businesses a reliable date for when a cryptographically relevant quantum computer will arrive. What we do know is that changing the cryptography embedded across modern technology takes time. That makes the more useful question much simpler. If you had to change your cryptography, how long would it take? For many organisations, the answer is uncomfortable.

Cryptography is everywhere. It protects connections between systems, secures data and authenticates users. It sits inside applications, infrastructure, devices and software supplied by other organisations. Much of it works so reliably that organisations rarely need to think about it. Until they need to change it.

You can’t replace what you can’t find

The first stage of post-quantum preparation isn’t choosing a new algorithm. It is understanding what you already have.