Cryptography: how to protect critical systems in the quantum era

The advent of quan­tum com­put­ing rep­re­sents a major tech­no­log­i­cal rev­o­lu­tion, but also an unprece­dent­ed threat to dig­i­tal secu­ri­ty. First of all, quan­tum com­put­ing holds great poten­tial in terms of data stor­age and com­put­ing pow­er, as well as mul­ti­ple appli­ca­tions in the fields of sim­u­la­tion and opti­mi­sa­tion, with rev­o­lu­tion­ary prospects in the chem­i­cal, phar­ma­ceu­ti­cal and dig­i­tal indus­tries for exam­ple¹. It there­fore rep­re­sents a tech­no­log­i­cal break­through that could bring many ben­e­fits to a soci­ety cur­rent­ly fac­ing major eco­nom­ic and soci­etal chal­lenges².

Asym­met­ric encryp­tion algo­rithms, com­mon­ly used to secure elec­tron­ic com­mu­ni­ca­tions, are par­tic­u­lar­ly vul­ner­a­ble. While con­ven­tion­al com­put­ers take thou­sands of years to solve these prob­lems, a quan­tum com­put­er could do so in just a few hours, as illus­trat­ed by Shor’s algo­rithm described in 1994³, which is capa­ble of fac­tor­ing large num­bers expo­nen­tial­ly faster than con­ven­tion­al meth­ods. In fact, the fac­tori­sa­tion prob­lem posed by cer­tain encryp­tion algo­rithms (in par­tic­u­lar RSA) can be trans­formed into a prob­lem of find­ing a peri­od in a func­tion; solv­ing this sec­ond prob­lem is accel­er­at­ed by the super­po­si­tion of quan­tum states⁴. Sim­i­lar­ly, Grover’s algo­rithm⁵ threat­ens sym­met­ric encryp­tion mech­a­nisms (AES) and hash func­tions (SHA).

The devel­op­ment of machines capa­ble of exploit­ing this vul­ner­a­bil­i­ty could have dis­as­trous con­se­quences for gov­ern­ments. These could include acts of indus­tri­al espi­onage, sab­o­tage of crit­i­cal sys­tems, iden­ti­ty theft and even manip­u­la­tion of elec­tions, with sig­nif­i­cant reper­cus­sions for nation­al secu­ri­ty and social sta­bil­i­ty. How­ev­er, in 2025, quan­tum com­put­ers are still at the exper­i­men­tal stage. Only organ­i­sa­tions with con­sid­er­able resources and advanced tech­no­log­i­cal skills are capa­ble of imple­ment­ing these actions⁶. To put it sim­ply, gov­ern­ments need to pro­tect them­selves against pow­ers capa­ble of devel­op­ing “nuclear weapons”.

To deal with this threat, it is imper­a­tive that gov­ern­ments antic­i­pate and imple­ment a strat­e­gy for the tran­si­tion to post-quan­tum cryp­tog­ra­phy. This approach involves devel­op­ing encryp­tion algo­rithms that are resis­tant to quan­tum attacks, there­by guar­an­tee­ing the secu­ri­ty of com­mu­ni­ca­tions in the era of quan­tum com­put­ing. These algo­rithms must not be based on dis­crete fac­tori­sa­tion or log­a­rithm prob­lems, which are vul­ner­a­ble to quan­tum technology.

The US Nation­al Insti­tute of Stan­dards and Tech­nol­o­gy (NIST) has select­ed three of the most secure and effi­cient post-quan­tum algo­rithms fol­low­ing a rig­or­ous selec­tion process⁷:

• ML-KEM (orig­i­nal­ly known as Crys­tals-Kyber), designed to secure access to sites via a pub­lic channel.
• ML-DSA (for­mer­ly Crys­tals-Dilithi­um), which gen­er­ates elec­tron­ic sig­na­ture keys for secure doc­u­ment exchanges and communications.
• SLH-DSA (for­mer­ly Sphincs+), which gen­er­ates small­er pub­lic elec­tron­ic sig­na­ture keys.

The ML-KEM and ML-DSA algo­rithms are based on the dif­fi­cul­ty of find­ing short vec­tors in a struc­tured Euclid­ean net­work. Fur­ther­more, as explained in an ANSSI (Agence nationale de la sécu­rité des sys­tèmes d’in­for­ma­tion) analy­sis note⁸, there is a pos­si­bil­i­ty that a weak­ness will be dis­cov­ered, enabling a rapid res­o­lu­tion of the cryp­to­graph­ic prob­lem posed. The SLH-DSA algo­rithm is based on the secu­ri­ty of hash functions.

In addi­tion, ANSSI rec­om­mends the use of hybridi­s­a­tion, which con­sists of com­bin­ing post-quan­tum asym­met­ric algo­rithms, still under devel­op­ment, with well-estab­lished and proven tra­di­tion­al asym­met­ric encryp­tion meth­ods. This com­bi­na­tion offers dou­ble pro­tec­tion until post-quan­tum algo­rithms reach a suf­fi­cient lev­el of matu­ri­ty to guar­an­tee long-term secu­ri­ty on their own.

The tran­si­tion to these new algo­rithms requires a great deal of work and will there­fore be grad­ual. It will take sev­er­al years to replace all exist­ing sys­tems with secure solu­tions. To achieve this, a sig­nif­i­cant invest­ment in the cryp­to­graph­ic skills of the staff respon­si­ble for pro­tect­ing sys­tems, data and dig­i­tal exchanges must be made now, over a mul­ti-year peri­od. Indeed, a lat­er invest­ment is like­ly to gen­er­ate very high adap­ta­tion efforts in a par­tic­u­lar­ly con­strained time­frame, with high risks vis-à-vis exter­nal entities.

To guar­an­tee the secu­ri­ty of state ser­vices, a thor­ough assess­ment of the risks asso­ci­at­ed with quan­tum tech­nolo­gies must be car­ried out. This involves not only under­stand­ing the capa­bil­i­ties of quan­tum com­put­ers but also assess­ing the poten­tial impact on exist­ing secu­ri­ty sys­tems. In par­tic­u­lar, it is essen­tial to iden­ti­fy the most sen­si­tive data, process­es and exchanges, so as to focus secu­ri­ty efforts on the most crit­i­cal points. To do this, the deliv­er­ables of the EBIOS (Expres­sion des Besoins et Iden­ti­fi­ca­tion des Objec­tifs de Sécu­rité – Expres­sion of Needs and Iden­ti­fi­ca­tion of Secu­ri­ty Objec­tives) method should be used for the entire infor­ma­tion sys­tem under con­sid­er­a­tion⁹.

Post-quan­tum risk assess­ment requires a glob­al and coher­ent approach. It is vital to adapt exist­ing risk analy­ses, which are based on the EBIOS method, to incor­po­rate the new threats posed by the emer­gence of quan­tum com­put­ing. It is also essen­tial to coor­di­nate the analy­ses car­ried out in iso­la­tion for each sys­tem or appli­ca­tion. An aggre­ga­tion phase is there­fore nec­es­sary to obtain a sys­temic view of the risks and define a glob­al secu­ri­ty strat­e­gy. This approach makes it pos­si­ble to iden­ti­fy the inter­de­pen­den­cies between the var­i­ous ele­ments of the infor­ma­tion sys­tem and to put in place appro­pri­ate pro­tec­tion measures.

The EBIOS method makes it pos­si­ble to iden­ti­fy not only the risks but also the sen­si­tiv­i­ty of the data held, which is cru­cial if the infor­ma­tion sys­tem is to be pro­tect­ed. It is essen­tial to dis­tin­guish between crit­i­cal data, the loss of which could have a vital impact, and data that can be com­pro­mised with few­er con­se­quences. This assess­ment will make it pos­si­ble to pri­ori­tise pro­tec­tion efforts and ensure that secu­ri­ty mea­sures are adapt­ed to the lev­el of sen­si­tiv­i­ty of each type of data.

Con­sid­er­a­tion should also be giv­en to the pos­si­bil­i­ty of adapt­ing secu­ri­ty pro­ce­dures by revert­ing to phys­i­cal means, such as paper, if nec­es­sary. This approach can enhance the pro­tec­tion of sen­si­tive infor­ma­tion, par­tic­u­lar­ly in high-risk sit­u­a­tions. The use of sin­gle-use codes is also a promis­ing strat­e­gy. These codes, which have an expiry date of one to two months, can enhance secu­ri­ty by lim­it­ing the pos­si­bil­i­ties of unau­tho­rised access.

In con­clu­sion, the quan­tum threat rep­re­sents a major chal­lenge for the dig­i­tal secu­ri­ty of gov­ern­ments and oper­a­tors of vital impor­tance (ener­gy, com­mu­ni­ca­tions, trans­port, pow­er, etc.). To meet these threats, it is essen­tial to antic­i­pate them, invest in inno­v­a­tive solu­tions, mobilise human and finan­cial resources and pro­mote inter­na­tion­al cooperation.

Quan­tum com­put­ing will soon be capa­ble of neu­tral­is­ing cur­rent encryp­tion sys­tems in record time, which means that we need to start adapt­ing quick­ly and thor­ough­ly right now. To achieve this, the tran­si­tion to post-quan­tum cryp­tog­ra­phy will need to be cou­pled with robust secu­ri­ty mea­sures and increased aware­ness, which are nec­es­sary to guar­an­tee our dig­i­tal sovereignty.

Final­ly, it is vital to take a glob­al approach to the secu­ri­ty of dig­i­tal ser­vices, inte­grat­ing the tech­no­log­i­cal, sys­temic and human dimen­sions. The emer­gence of quan­tum tech­nolo­gies is a major chal­lenge that needs to be addressed along­side cur­rent threats.