The development of quantum computers is revolutionising digital society and will inevitably affect the effectiveness of encryption methods for data protection. VTT has studied the current state and future preparedness of quantum-safe encryption methods in Finland. It is now time for organisations to prepare plans for a secure quantum transition. The results of the study were published in the Policy Brief on 16 September 2022.
A modern digital society is heavily dependent on cryptography, or encryption methods that protect state secrets as well as citizens' banking transactions. Quantum machines are developed for useful purposes, such as assisting pharmaceutical research, but their computational power can also be used for criminal or hostile purposes. This exposes society to new risks.
Traditional encryption methods are not enough to secure data in the era of quantum machines; instead, new quantum-safe protection methods (PQC, Post-Quantum Cryptography) are needed. VTT's PQC Finland research project studied these methods and their standardisation and deployment worldwide. The project also developed Finnish cryptography expertise, networking and preparedness for the age of quantum machines.
Quantum-safe methods already exist – implementation is a huge undertaking
The first quantum-safe encryption methods are already moving towards standardisation. Lattice-based encryption and signature methods are clearly better than their competitors, and the best ones have already been selected for standardisation. So far, there is no known quantum algorithm that could solve lattice problems faster than a classic computer. The introduction of new encryption methods requires planning, and attention must be paid to their selection. These methods also require further research, and some of them have been found to have serious weaknesses.
"Upgrading old systems to quantum security is a huge undertaking that takes time. Both public and private organisations must prepare for this transition by taking care of the agility of their systems and the training of their key personnel," says Senior Scientist Visa Vallivaara from VTT, the Project Manager of the PQC Finland research project.
Another challenge is that many organisations have a duty to protect data for decades. Thus new algorithms must be introduced alongside traditional methods before the PQC algorithms are standardised. Some of the new encryption methods are better suited to hybrid solutions than others.
Finland is a forerunner in quantum security – the cryptographic products industry has a large market potential
Finland is currently at the forefront of the development of both quantum technologies and quantum-safe cryptography. In order to maintain its position, it is important for Finland to invest in competence in quantum-safe encryption methods. Well-educated experts are needed both for research and product development in the field and for the implementation of new technologies.
"Increased awareness of the importance of cyber security in protecting information systems has especially increased the interest of customers operating in security-critical industries to have PQC methods as part of their product offering," says Tatu Männistö, Senior Director of Technology of Cyber Security at Insta Advance Oy.
The Finnish cryptographic products industry has significant market potential both in the markets for EU approved government products and in the NATO market. The development of government products is a very closed and protected market, in which success requires close cooperation with the security authorities. The implementation security of cryptographic products also plays a big role, and Finland must continue to invest in its research and development.
Policy Brief was implemented as part of the PQC Finland research project 2020–2022. The project was funded by Business Finland's Digital Trust programme.
