Quantum Again?

The Quantum Leap, via Wikipedia.org

When I write, I often try to come up with two topics that are linked in some interesting way, and find it fun when the link is unexpected or particularly tenuous. The more unexpected the connection, the more fun it can be, particularly when I learn about something new.

So, the first time I wrote about quantum computers and encryption, I discovered the band Mammút, through finding their song “Shore” while searching for more information about Shor’s algorithm. Then, a few months later, I wrote about quantum hype and BS, through an article which connected quantum computing to a VIC-20, an abacus, and a dog.

Then, I connected bombes and bombs, to illustrate the fact that we won’t necessarily know about breakthroughs in quantum computing as soon as they happen, because governments have strong incentives to keep such breakthroughs secret for as long as possible.

And now, quantum computing is in the news again.

Sigh.

I wanted to come up with a connection, but all I could think of was the TV series Quantum Leap (1989), which I remember liking, but not much more. Or maybe the 2022 revival, which I may yet see? And, while “scraping the barrel” can be fun, I was not really “feeling” it.

And, then I found the sculpture!

It’s called The Quantum Leap, and it’s located in Shrewsbury, Shropshire, England, on the bank of the River Severn. It’s an abstract work, created to celebrate the 200^th anniversary of the birth of Charles Darwin. It looks like a blend of a spinal cord and a Slinky, and there appears to have been a major scandal around the cost of the work, which exceeded £1 million.

Aside from it being something new to learn about, it gives me a way to come back to quantum computing!

But why? What’s going on this time?

The big news is that Google has moved up their timeline for implementing post-quantum cryptography (PQC) to 2029, from a prior target of 2035. While this covers a lot of work across a great many products, it all boils down to replacing existing encryption schemes with updated ones which are considered resistant to quantum computers.

For a high-level summary, current encryption can be broken into symmetric (where the encryption and decryption keys are the same) and asymmetric (where the encryption and decryption keys are different). Quantum computers are expected to be somewhat more effective at “breaking” current symmetric encryption schemes, but the improvement is not expected to be dramatic.

On the asymmetric side, however, quantum computers will be able to use something known as Shor’s algorithm to calculate the factors of large numbers much more quickly than traditional computers. For context, when you increase the length of a password, the increase in difficulty “breaking” asymmetric encryption increases exponentially for traditional computers, but only increases linearly for quantum computers. In practice, this means that keys which are effectively “unbreakable” will become essentially useless.

And, because many actors are simply grabbing and storing data for later decryption, the risk is highly dependent on the “half-life” of the data being protected. If your data is essentially useless after a year, you just need to be “quantum-ready” a year before quantum computers are viable.

But no one actually knows when that will be, so the smart strategy is to move as soon as possible, to minimize the impact of your data exposure once quantum computers are available.

So, does Google’s news mean that quantum computers are here?

Um, no. Not really.

Instead, Google appears to be reacting to a number of news stories and studies which demonstrate that Chinese researchers are advancing quickly and have made steps which, while incremental in nature, are important ones toward practical quantum computers.

It appears that the Chinese are not only investing heavily and advancing quickly, but also appear to be taking innovative approaches which may lead to more efficient ways of addressing a number of challenges.

Is Google overreacting, then?

I would say no. Not really.

As I described before, we know that governments are investing heavily in quantum computers, and we know that they are very unlikely to inform people once viable quantum computers are available, and we know that China, in particular, is investing heavily in their development.

The safest bet is to assume that quantum computers are already in play, and that we should be focused on moving to post-quantum cryptography as quickly as is feasible, depending on the half-life of your data. So, if you are storing data which will still be relevant years from now, it may already be too late.

But that doesn’t mean you need to panic, though you should assume that quantum computers will exist for some time before we are generally aware of them. Just understand your risk, and plan accordingly.

Cheers!