Only a fraction of Finland's critical infrastructure operators are prepared for the future ability of quantum computers to break the encryption of communications. This was revealed in a comprehensive study carried out by VTT for the National Emergency Supply Agency. However, the transition to quantum-safe encryption needs to be accelerated, and VTT has produced a roadmap to help.
VTT has carried out a study for the National Emergency Supply Agency on the preparedness for the quantum threat of operators critical to security of supply. One hundred organisations from different sectors, such as energy, water, finance and logistics, responded to the survey. The responses revealed starkly that preparedness is poor.
“Three out of four are aware of the quantum threat but their expectations are very optimistic. More than half of the organisations believed they could change their encryption algorithms, although only a quarter knew what and what kind of encryption technology and methods they were currently using. Only 3% had set aside resources to move to quantum-safe encryption. It's a pretty grim situation," says Visa Vallivaara, a Senior Scientist at VTT specialising in encryption methods.
Quantum computers are expected to achieve the ability to crack current encryption of communications in 5–15 years. So while there seems to be time, there is no good reason to now postpone moving to a new form of encryption. Hostile states and cybercriminals can already store the communications of organisations of interest to them, waiting for the time when the encryption can be decrypted. The development of quantum computers may also proceed faster than expected.
Almost all security-of-supply operators use encryption for data transmission – the stage where data can be easily stolen. This might be confidential documents, customer and personal data, emails and other communications. More than half the respondents to the survey have data that needs to be kept secret for more than 10 years, one third for more than 20 years.
The first standards for quantum-safe encryption algorithms will be available in 2024. The transition to their use can then be started. Certified versions and commercial applications should be available within a couple of years.
Roadmap to help with inventory and prioritisation
In order to promote the transition to quantum-safe algorithms, VTT and the National Emergency Supply Agency have developed a preparedness roadmap for critical infrastructure organisations, which shows how and in what order to proceed.
“Transition will take time, especially in a large organisation. In a ministry, for example, it may take years. That’s why it's worth chopping up the transition into sections. It’s essential to start with a comprehensive inventory of the encryption in use, as this will help prioritise the transition. The transition must start with the most critical data, which must remain encrypted for the longest period of time,” says Vallivaara.
The transition to quantum-safe encryption needs to be planned and resourced. It must also be coordinated with partners to ensure compatibility. The initial part of the roadmap includes training key staff to understand why and how to move to quantum-safe algorithms.
“An important factor is crypto-agility, i.e. the ability to switch from a classical to a quantum-safe cryptographic algorithm and from one quantum-safe algorithm to another. That's why it's now a good time to choose products with easily upgradable encryption methods. Hybrid solutions that use both algorithms at the same time can also be used in the transition phase,” continues Vallivaara.
In the US and the UK, it is recommended to switch all at once. In Europe, France and Germany want to use hybrid methods, but these will slow down operations. They are also more complex with a higher risk of errors.
Finland and Europe lag far behind the US in quantum readiness
As part of the study, VTT also mapped the level of preparedness for the quantum era internationally. Finland is well behind its neighbours in terms of preparedness.
“Very few companies in Finland have an encryption strategy, unlike in neighbouring countries, and organisations are not sufficiently prepared for encryption agility,” states Vallivaara.
Europe is lagging behind the United States and other English-speaking countries. In the US, the law already requires public authorities to have quantum-safe algorithms by 2030. If a company there wants to cooperate with the authorities, it must prove that quantum safety has been taken into account. This also applies to Finnish companies if their business is linked to a public authority.
Vallivaara is concerned that there is no regulation on encryption methods in Finland and the EU. In Germany, many companies also want regulation because it will make it easier to justify the need and cost of changing algorithms.
“If everyone waits until 2030, there could be a severe shortage of external assistance. But the problem is much bigger than, for example, the Y2K problem at the turn of the millennium," says Vallivaara.
The challenge for critical infrastructure in some places is that new quantum-safe algorithms require more memory and performance than current cryptography does. The limits of smart cards, for example, will therefore often be encountered and the transition may not be successful. However, lighter encryption algorithms are also being developed.
On 10 June 2024, the National Emergency Supply Agency will hold a webinar and workshop for critical infrastructure organisations, where it will present a roadmap for the transition to quantum-safe encryption.
