Hopefully, I may provide you with some insights around this whole area of quantum cybersecurity.
And I've tried to pitch a few ideas at different kinds of levels, so hopefully each of you
might find something of interest.
So for those of you that are relatively new in terms of your exposure to the area of quantum
in general, you certainly, of course, would be aware of the fact that in the 50s, we had
what we call the first quantum revolution, with the invention ostensibly of the transistor
being a key point in that.
And over the last 70 years or so, well, my goodness, haven't we leveraged that technology
to the hilt?
If you look at it, each of us carry billions, maybe even trillions of transistors.
And we carry the same transistors on our body every day in cell phones and other electronic
devices.
In fact, it's become so integral to our lives, we scarcely recognize that this is part of
our lives.
Today, we sit on the cusp of a second quantum revolution, where as opposed to taking quantum
effects and passively observing and leveraging them, like we do in a transistor, like we
do in GPS, MRI, countless lasers, other applications of quantum technology, we're able to take
As you could think of, in this second quantum revolution, we are actually now engineering
quantum effects that don't exist naturally.
And as a result of this, what we're seeing is some step change in our ability in a whole
range of technologies.
Maybe I'll scoot around this side, so I'm not sort of out too much to one side.
And certainly, over the last 20 years, you've been reading quite a lot about this, and applications,
applications from sensing and meteorology.
So if you think about quantum sensing, a particular potential application that comes to mind,
for example, is satellite-based sensing, where you could surveil the seas very, very well.
They've talked about this term of making the oceans transparent.
So imagine what that would do for defense strategy and other applications.
Similarly, with metrology, being able to determine very accurately time distribution.
Computing is probably the area that you've heard the most about, dramatic advances that
have been occurring.
It's been an idea that's been promised for, well, perhaps almost 40 years now, 35 years.
But we're actually seeing some material advances that are occurring in the computing side.
I had the great privilege to be on a roundtable conversation with the CEO of IBM, Arvind Krishna,
in fact, just last week.
Yeah.
And he was extremely bullish about this.
He was talking in general about megatrends that he's seeing across the tech space.
And quantum was one that he was particularly excited about and that he talked about at
quite some length.
Now, this is somebody who really knows the space.
As you know, IBM is investing billions of dollars into quantum research.
And indeed, some of their efforts are very much at the forefront of this worldwide.
His sense was, he said, take your pick.
And given that there's still...
Well, scientific advancements occur.
It's not a linear trajectory.
As happens with most science, you'll find step change occurs periodically.
But his sense was that it will be definitely within five to 10 years, we'll have quantum
computers that will be serving useful functions over and above conventional supercomputer
capabilities that we have today.
And his sense was the risks are actually skewed to the downside, the nearer term, so potentially
closer to five years.
And if you're interested, IBM have actually...
They've published a very interesting roadmap around quantum computing, which actually sets
out definitive dates of when they expect to achieve certain milestones.
Now, computing, of course, will revolutionize many areas, kinds of problems that we consider
intractable today, computationally intractable, that just take us too long.
If you think about modeling chemistry, I think the most complex thing our best supercomputers
can model today is a caffeine molecule.
As soon as you look to get a bit more complicated than that, it's beyond the capability of
our best computational equipment today.
So it has applications there, discovering new drugs, new materials, financial optimization.
There's this well-known problem in computing called the traveling salesman problem.
We have 15 cities to visit, and you want to figure out what's the best route to take to
minimize the distance across those cities.
And as soon as you go beyond 15 cities, the complexity, the permutations that you come
up with become so large that our best supercomputers cannot solve that problem.
So that kind of problem in optimization exists across a whole range of areas.
Airbus, for example, has been experimenting with better aircraft wing designs.
Oddly, on each aircraft, a very complex problem.
Each flight is how you optimize weight distribution.
The weight distribution across in terms of the people and the cargo that you're carrying.
Non-trivial.
You could save environmental benefits if you save fuel by optimizing that weight distribution
better.
So tremendous benefits, but as we'll see, one of the impacts of that is that it will
break a lot of the cryptographic capability we use today to secure the transfer of sensitive
information.
And indeed, public key infrastructure.
So our digital economy, in fact, relies on some of those capabilities, which will be
compromised by the advent of a quantum computer.
Which then leads us on to quantum communications.
So interestingly enough, for all the challenges that quantum will provide to security, quantum
also offers some of the solutions.
In particular, there's two capabilities.
So in quantum random number generation.
So in quantum random number generation.
So true random numbers, interestingly enough, are an essential component to strong cybersecurity.
Today we've been largely doing that through software-based means.
We get what are called pseudo random numbers.
However, those have some risks exposed with them.
Plus we've got some other techniques which are coming out now in some of the latest chips.
But those give you random numbers at a lower rate.
So quantum gives you the promise of being able to generate true random numbers at a
very high speed.
In fact, not just a promise, but where actually it's been realized into products which are
deployed today.
So interestingly enough, if you look at the time spectrum across which you'll see some
of these technologies, cybersecurity and communications are the earliest areas where
you will see the impact of quantum on our everyday lives.
So how will quantum actually impact cybersecurity?
So here's a few examples.
So if you think about it.
Think about key exchange and digital signatures.
And typically we'll use tools that are used at asymmetric algorithms.
Some examples of those are up here.
So if we look at RSA, Diffie-Hellman, elliptic curve, all of these are likely to be impacted.
In fact, not just impacted, but broken by a quantum attack called Shor's algorithm.
So Peter Shor was a guy that worked at Bell Labs in the 1990s.
And he, interestingly enough, discovered.
That you could actually implement efficient attacks on these class of algorithms using
a quantum algorithm, and which he developed and is now well understood.
The issue we don't have yet is a quantum computer at the right scale, which will be
able to run that algorithm and impact today's RSA, Diffie-Hellman, elliptic curve implementations.
You also see some applications.
Implications of this on symmetric algorithms like DES and AES.
The good news there is by doubling the length of those algorithms, we believe, or tripling,
that you will be able to successfully, as best as we know today, mitigate against quantum
attack.
Although I saw some interesting literature I think it was just yesterday.
And unfortunately I just scanned it.
So please don't quote me.
We talked about quantum variational algorithms, which may have some implications for these,
and particularly the new ones.
We talked about the new class of algorithms that NIST is developing called lattice-based
algorithms.
And equally on authentication.
So if you look at Mac AAD modes through something called Simon's algorithm, these will also
be broken.
So certainly something to think about and something we need to think about now.
Well, you might well say, look, I don't need to worry about this.
You know, quantum computer, it's like 5, 7, 10 years or beyond, depending on what your
assumption is.
And I'll get to it when the problem occurs.
But I would offer you that that's probably not a very wise strategy if you are responsible
for managing sensitive information.
Why?
Two reasons.
The first is that it takes you time to assess, roadmap, implement, and integrate cybersecurity
technologies.
If we look at PKI, arguably it took us 10 years from the time we started to get to
an adoption rate of about 50%.
10 years.
So that's a decade, which is well within the window for most people where you would expect
a quantum computer to be in existence at the right scale, what we call a cryptographically
relevant scale.
The second is we've got these attacks which are going on now, which we call handle attacks.
Harvest now, decrypt later.
These are rife.
There's a report out actually from Booz Allen, which came out about, I think it was three
years ago.
And in that particular report, they talk about nation states.
And potentially criminals that actively are listening in on purportedly sensitive communications
today and storing them away.
Storage is cheap, right?
Cents in a terabyte.
So massive snooping, if you will, on sensitive information, storing it away.
Why?
The idea is I can't break the encryptions that are used today, but I will potentially
have the opportunity to have the compute capability, which will reverse out today's encryptions.
And be able to derive the plain text of those sensitive informations.
And now if this is long lived data, that may well be within the valid lifetime of that
information, because we've got two real problems we need to think about actively today.
And going back to IBM's CEO, Arvind Krishna, his recommendation was, this is just last
week, that organizations to start off small.
That's impossible.
My sense is we have time and if we start acting now we can implement quite a safe
without panic strategy to being quantum safe. However, we should begin now and
Irvin's suggestion was that if we start off with teams of three to five people
that's probably quite adequate so you don't need to you know all of a sudden
pivot all of your IT organizations saying how the heck am I going to deal
with this this quantum challenge. We can do so in quite a measured way by
starting to explore well what are the solutions that are available out there
start to think about a strategy and at the end of this I'll show you a few
points of what we think some key elements of that strategy could look
like. So the the first problem is that it takes you time to transition across so
as we're saying for PKI it took about 10 years just to get to 50 percent.
Sure.
So just to give you an example of some of the things we talked about is a really
trivial example. So if we think about RSA it's reliant on the fact that I
have two very large prime numbers and multiply them together and then I use
the product of that as my encryption key. So here if I gave you two
numbers like 165,181 and I said multiply that by 417,953.
So you
don't you pull out your calculator and in two seconds you'd give me the answer
and for the mathematicians around amongst us probably 10 seconds and
you'd scribble out and I'd get 69 billion 37 million etc. Pretty quick
pretty easy. However if I gave you the 69 billion 37 million number and said
tell me what are the two numbers I multiplied in the first instance to get
this this semi prime as it's called that'd be a pretty tough problem. It would
take you quite a long time.
And once those numbers get big it goes beyond the sensible lifetime as a
sensible time frame within which you could do something. So this was done at
some time ago and it suggested that for a 1024 bit semi prime it would take our
best computers of the order of a you know thousand plus plus years. So
basically more than likely the information has no value by that point
in time. That's what we rely on today. Perfectly good makes complete sense and
easy to implement. However with the advent of quantum computer which Shor's
algorithm as we said that could be reversed in seconds so this is where the
problem arises.
So that goes into actually even a skill set beyond mine as I'm not an expert in
in quantum computing.
I'm just thinking of the best way to help
help guide that.
I'm so sorry?
How Shor's algorithm works.
Oh, how Shor's algorithm works.
So with my sort of non-quantum computing expert assessment of
it, basically it's of mapping the problem of factorization
into an optimization problem, and then putting that onto a
quantum computer and using that to find the optimal
solution to that, which actually then represents the
two primes that were there.
There are, I think, quite a few papers that have been written
about that, which you could consult.
And they actually do go a little bit into the nitty
gritty of it.
But hopefully that's a good enough 50,000 foot explanation
of that indeed.
So the bottom line of this is that public key exchange, as
we use it today, will no longer be safe.
The heart of our digital commerce
will be broken.
And you want to go down to the corner store and buy a
gallon of milk and pay for it with some electronic card, you
won't be able to do so with security.
You won't be able to establish that online authenticity of
the parties that you're dealing with.
So some very significant ramifications to this.
Actually, and probably just on that back, so recognizing all
the issues that we've just talked about, NIST has
actually launched a competition.
Actually, it's seven years in progress now, where they've asked globally for solutions
using capabilities or techniques, I should say, that are thought to be
quantum resistant.
So I think they started off in their first round with near on about 100 solutions,
100 candidates, which over the years have been whittled down.
And today, I believe we're at about eight or so.
Candidates which have made it through.
But interestingly enough, after five or six years of very detailed scrutiny, I think there
were about a set of 10.
But just in the last two months, in spite of seven years of scrutiny, two of them were
broken.
It really goes to show you the complexity of building something that really is very
robust and foolproof as a cryptographic algorithm.
One of them was called Rainbow.
There's a couple of four.
The folks at IBM broke it over a weekend on a laptop.
And the other was one of the shortlisted candidates called Psyc.
And that was, I think, maybe just last week or two weeks ago, also broken.
So it really suggests that, yes, we should continue to explore algorithmic methods to
this because they're easy to implement.
However, be aware of the risk.
And we don't believe that just an algorithmic solution is the only way to go.
We need to have a plan B.
In the event that those algorithms that we now use are broken, because typically algorithms
take 10 years or more.
And even then, you find that mathematical advances or computational advances do break
those.
Back to the question of thinking about time frame.
And here's a very interesting example that's given to us by Michele Mosca.
He's from a company called Evolution Q. And he's also at the University of Waterloo.
And I think it's a great graphic.
It gives you a very simple way of thinking about the time frame issue.
So he puts out three variables here.
So how long does the encryption need to be secure?
X up there.
Y is how long it actually will take you to retool your existing crypto.
And Z is how long we think till a cryptographically relevant quantum computer will become available.
And if X plus Y is less than Z, you're good.
If it's not.
If it's not, that little gap there that you see, which actually the only option you have
is to modify Y, then we've got a problem.
And arguably, for some classes of data, X is already bigger than Z.
So we need to be acting today.
The data that's out there that's already been eavesdropped, well, unfortunately, that's
gone.
And we just hope that that remains secure within its longevity period.
However, what we can certainly do is be proactive and start thinking about this today and start
to protect, actively move towards protecting our systems.
This is a polling.
Indeed, ma'am.
Thank you.
Great question.
So the question was that we talked about we shouldn't rely specifically on a particular
cryptographic algorithm.
What are alternative solutions?
So basically there are two.
One is cryptographic agility.
And in fact, I think I have the pleasure tomorrow to be talking about the importance of cryptographic
agility.
So that basically talks about the fact that if we're using a particular algorithm today,
we should as easily as possible be able to roll to a new cipher rapidly and with as little
pain as possible.
Most of us that may work with ciphers recognize that moving from one cipher suite to another
is a world of pain.
It's really difficult to do.
And we don't think it's going to be a one-shot transition.
It's more than likely that maybe five years you need to do it again and again and again.
So to have a posture which is cryptographically agile is absolutely important to change ciphers.
The second part of it is quantum key distribution, which completely, which we'll talk about in
a moment.
Which completely changes the paradigm instead of using complex mathematics to secure the
transfer encryption keys between myself and yourself.
And we hope that nobody can crack that math.
Quantum key distribution changes the paradigm.
It relies on the laws of physics and quantum physics in particular, whereby when you get
to the nitty gritty of it, strange things happen.
But we can actually leverage those and we'll talk about those in a minute to get that very
secure key exchange going.
Between us.
And as I said, I'll come to that very, very shortly.
This is a very interesting matrix because we don't know exactly when somebody will have
a quantum computer to break today's encryption.
We think a good framework to think about is from a risk weighted profile and see where
the risk threshold crosses something that you might be comfortable with.
And what you might be comfortable with depends on the type of data that you manage and the
type of organization that you're in.
So there's no exact answer for any one or for all organizations.
But for each organization, you can form an assessment through this heat map of when the
risk gets beyond in a timeframe fashion, beyond where you're comfortable.
And it's quite helpful.
He updates this list, Michele Mosca and Piani, on an annual basis by polling industry and
academic experts on their best guess.
Given that there's a lot of risk.
There's a lot of development that have occurred in the preceding year of when the threat might
actually materialize.
And if I'm not mistaken, he actually asked them a very specific problem, which you can
go back and check.
But it's something like, when do you think a quantum computer that will break 2048 RSA
in a day be available?
That may not be exactly the problem, but it's something like that is a very, very specific
question that is actually asked.
So this brings us to quantum key distribution.
Thank you.
So here, when you look, think about the quantum level of nature.
So you think about astronomy, we're talking about laws of the very large.
Quantum are the laws that apply at the scale of the very small.
So once you get down to the level of atoms and photons, things behave very differently.
Bizarrely differently, something that has no analog at the human scale.
And you have these things that, of course, it's all governed by uncertainty.
So you cannot measure quantum values, particularly two quantum values simultaneously, with absolute
precision.
You just can't.
A way to think about it is nature is shy.
And at a very fundamental level, she won't reveal everything.
So there is a limit.
Heisenberg, if you remember from high school physics, told us what this limit can look
like.
Other things that happen is entanglement.
So if you think about a photon of a certain energy value.
And that photon is a certain energy value.
If a photon splits into two half energy photons, and they go tracking on their own directions,
even opposite ends of the universe, what you'll find is if you do something to one, you almost
instantaneously will affect the other one.
Very strange.
How does that happen?
We know it happens, but don't have a good explanation of why particularly that happens.
So these kinds of capabilities can, oh, of course, and superposition.
So where something can be multiple values.
So quantum computing, in fact, relies on exactly these kinds of ideas, whereby if you
think about a conventional computer, you have a bit.
And a bit at any point is a zero or one.
On a quantum computer, the basic operation of a basic unit of operation is something
called qubit, quantum bit.
And that can be a zero and a one simultaneously.
I think, well, okay, well, how does that work?
So if you think about three bits.
And on a conventional computer, you have a zero and a one simultaneously.
On a quantum computer, I could have zero, zero, zero, zero, zero, one, one, one, one,
and all the permutations between eight combinations.
On a quantum computer, and so if I want to go through this and try and span all the space
of the different kinds of permutations of bits, I would need eight cycles or more on
a conventional computer to flip through all of this.
On a quantum computer, I can have all those values simultaneously and do it potentially
near one cycle.
There's overheads, but more or less.
So you say, well, that's not particularly exciting, three bits, eight times speedup,
so what?
The important thing to remember or to understand here is that you've got exponential speedup.
Every time I add a new qubit, I am doubling capacity.
And it's suggested that once we get to something of the order of 50, 60 qubits, it'll be greater
compute capacity on that quantum computer than our best supercomputer today.
And apparently, if you get to 200 qubits, it'll be more than the compute power on the
planet.
So that's the incredible advances that we will see.
Now to be clear, a quantum computer, we don't see a pathway today to solving all problems,
a general purpose quantum computer.
But certain types of problems, like the ones we just talked about earlier on, you will
see incredible, incredible advances.
So coming up.
Going back to quantum key distribution, which we talked about.
The idea, as we said before, is not to use math, but to use some of the properties of
physics to change how I get a potential encryption key from point A to point B, between our famous
protagonists Alice and Bob.
And the idea is very much at a 50,000 foot level captured here.
So where we have Alice on the left-hand side.
All this.
Generates a sequence of random numbers, hopefully through a true random number source, such as quantum, and then looks to transfer that across to Bob, who then receives that key, validates the key, and then the two have a common shared symmetric key, which could be used either for ultimately one-time pad encryption or even into symmetric ciphers.
And there's actually a couple of approaches how to use quantum to achieve this.
So the interesting thing is, when you get down to the quantum level, any act of observation of a quantum state changes it.
Again, going back to our friend Heisenberg, if you look at something at the quantum level, it will change.
So the first idea of this was a protocol called BB84, which a couple of guys called Brassard and Bennett, way back in 84,
conceived, and their idea was that why don't we take a single photon, now a single photon is a very specialized state,
because if you think about what's coming out of these lights here, we've got billions of photons per second streaming down here,
but if you take a single photon and you make it spin in a certain way, and that's called the polarization of the photon,
so you can make it spin with its axis vertical, horizontal, diagonal, or anti-diagon.
And if I randomly change the axis of polarization, and I stream them across to Bob, in this case,
if somebody tries to intercept them while in transit, half of the time they will change the spin.
And so what we do is we have an out-of-band conventional comms link, where at random we'll disclose some of the bits.
And I'll say, Alice will say, well, I actually made that vertical, I made this one diagonal,
this one was anti-diagonal, and this one was anti-diagonal.
And so on and so forth.
And at random, the two parties can then check whether that was how it's received.
If that's not how it's received for more than a certain percentage of the communications,
you can infer that somebody has been eavesdropping on the line and discard that communication.
However, if you establish that there has been no eavesdropping, you can now, guaranteed by the laws of physics,
assuming you've implemented, obviously that's a key factor, you need to implement
this properly, and that's non-trivial, but assuming you've done that, then you've now got an absolutely secure key
between Alice and Bob that you can use for symmetric ciphers and one-time pad that nobody on the planet,
nobody in the universe can have a copy of.
And now you're assured by the laws of physics, nothing to do with mathematics.
So we think, to the question before, that is a very good plan B, maybe not even a plan B, maybe a complementary, as you'll see in a moment,
I'll share with you an architecture where we think the two approaches of quantum-resistant algorithms and QKD could exist very, very synergistically
to give you a very high degree of resiliency against quantum attack.
So I mentioned that there were two approaches to quantum key distribution.
This is the first one, it's called discrete variables because it relies on single photons.
The other way to do it is what we call continuous variable, where you can take a laser in its entirety,
and I think I've got a little bit of a slide, we won't go too much into the details here,
but do something like AM and FM on the laser.
Now the nice thing about using a laser is that's very compatible with optical comms.
Gear from Cisco, Juniper, you know, other optical comms vendors all use this routinely, millions, billions of times every day today.
So what you can do on that laser, if you've got the right kind of laser, is do something analogous to AM and FM.
And the quantum equivalents to that are amplitude and phase quadratures.
But you can think of them largely like AM and FM.
So what I will do, millions of times, hundreds of millions of times per second, is make the laser,
it's a good model, just a bit brighter or a bit dimmer at the quantum level.
And at the same time, I'll do something like FM.
I'll make the laser a bit bluish or a bit reddish, very subtly.
And I send that across.
And similarly, when that reaches the laser,
when that is received at Bob, we can exchange certain data about how I actually encoded the states that I sent
on some of the states that I've sent and ask Bob what he saw.
And if it varies by more than a certain amount from what was sent,
there are ways that you can apply which will infer that there has been some eavesdropping on that optic fiber line.
Therefore, again, you can discard it.
Once you've established, though, that there's been no eavesdropping
on that optic fiber line, same principles.
You can take that key, feed it into a key manager,
and then choose whatever cipher you want to use with the same guarantee
that nobody on the planet now has a copy of the keys that you've just exchanged.
So, apologies as I've just been pulling a few slides.
I meant to clean out the product piece, but it really didn't have a chance.
But just to give you a sense of how these have actually translated
to real technologies that are deployed today.
So, it's not something in the future.
Some future-leading, future-looking organizations are protecting themselves today.
And top left there is a true random number generator.
It leverages an effect called quantum tunneling.
So, of course, you'd all be familiar with diodes, right?
Now, a diode, it's normally on or it's off.
It's a one or a zero.
But the odd thing is, if you go right down to the quantum level,
in fact, when they invented this type of diode called the tunneling diode,
it was actually invented in the 60s,
and they looked at it even when it was off,
and they found that there was this trickle of current even when it was off.
They said, what's wrong with this?
They spent millions of dollars and a couple of years trying to figure it out
as to what was wrong with the manufacturing process.
It actually took a Nobel Prize.
To discover there was nothing wrong with it.
This was a quantum effect in operation.
So, bizarrely, even when the diode is off, you have a barrier there.
Electrons will, this is a simplified version,
punch across that barrier by a quantum effect called quantum tunneling.
So, in this particular product,
we leveraged that effect and amplified it,
biasing the diode in a very particular way
to achieve, to magnify the quantum tunneling effect.
And that, for example, puts out a billion random,
a gigabit per second of true random.
For those of you that are interested,
there's a NIST standard out there called SP800-90,
which actually talks about how you build a high quality true random number generator,
and a deterministic one as well.
So, this is conformance with that particular standard.
The middle bit is what we'll probably touch on a bit tomorrow,
is the agile key management.
So, the importance, as we said,
before of being able to roll in and out ciphers
as new ones get announced and as old ones need to be decommissioned.
The bottom piece is quantum key distribution.
So, the one that we've showcased here uses continuous variables.
We're about to take this out and showcase it with a number of enterprise customers
in pilot deployments.
And you may say, well, why are people doing this?
So, one of the very well-known brand name companies,
one of the hyperscalers I think I'm okay to say,
said that we don't want to stick with just reliance on quantum resistant algorithms.
It's too new, needs a lot of time to mature,
and even then it might be subject to risk.
So, we reckon something like, and I'm paraphrasing,
like double enveloping is absolutely critical.
You put in one layer, which is the quantum resistant algorithm encryption,
and then the second is on specific links, high value links,
we'll overlay that with quantum key distribution and use those keys
then to implement a second layer of protection around the sensitive data.
We think that's probably quite a clever approach,
certainly because it's a whole new area that we're entering into.
If you're really concerned about mitigating risk
and getting to a very low level of risk,
that's probably a very, very wise way to go.
So, how does this translate?
How does this translate into a potential architecture?
Now, I apologize for the busyness of this slide.
Let me just do a quick time check.
Okay.
Actually, I've gone on for a bit,
so I'll try and go through this as quickly
and see if we can leave a few minutes for questions.
So, here is an architecture that we believe is a very good model
to use for quantum resilience.
So, what I might do is actually flip through each one of the layers here,
but maybe just quickly at the top you have your endpoints on the two sides,
so your Alice application and application on the Bob side.
Below it, the critical piece to this, the glue, if you will,
that brings it all together is very efficient,
high-quality enterprise-scale key management.
And maybe just a quick word on that.
You know, today we're used to managing thousands of keys perhaps,
but as we move to 5G, 6G, IoT, massively sensorized environments,
we're going to move very rapidly to hundreds of millions or billions of keys.
To give you a very simple example, think about highly connected automobiles,
even autonomous vehicles in the future.
You think about them, you know, they probably have 10, 12 systems on board
which need to be in real-time contact through 5G and 6G with the network.
Now, if you think about for those 10, 12 systems,
you want to have one encryption key per trip
in your vehicle, there you go.
You've got 10, 12 keys per trip per vehicle,
hundreds of millions of vehicles, multiple trips per day.
It's very quickly, you've got billions of keys per day
just for the automotive sector, just the automotive sector.
So you need something that's going to cope with that,
that kind of volume and across a very large network very efficiently.
But more on that tomorrow.
And I apologize for those of you that do, if you do attend tomorrow,
there may be a little bit of duplication.
And then below that, of course, is the link encryptor.
So how you actually then get the secure information between point A and point B.
And sitting under that, this is the piece that we think can be integrated in,
but we've designed it as an optional piece.
So where you have something which we call quantum key relays,
because one of the things around quantum key distribution
is that it's a distance limitation.
Why is that?
Because if you think about the quantum,
states that we're sending, they're so subtle.
They're such low energy.
When they propagate through fiber or free space,
eventually, you know, the loss will be so high
that you just can't detect them.
So that puts a distance limitation.
So until we get a technology called quantum repeaters,
we think a nearer term solution is this idea of quantum relays,
which is set out here.
And sitting below the quantum relays are the individual quantum keys.
The distribution links.
An example of certainly that lower architecture
has been implemented in China,
where they've set up, we understand,
a four and a half thousand kilometer
quantum key distribution secured network.
And they've got optic fiber,
as well as satellite capability in that.
Certainly there's a very,
I believe it's either 2,000 miles
or 2,000 kilometers between Shanghai and Beijing
over which is one of the legs
over which this type of concept has been implemented
and has been actively used today.
So we do believe that it is prudent
at least to understand these kinds of technologies
and what capabilities they can deliver.
And there's a little bit of debate
that's unfolding at the moment
on whether we can achieve everything
through quantum resistant algorithms
or whether we should integrate in quantum key distribution or not.
But depending on the geography that you look at,
there's a difference in perspectives.
So if you look at, as we said, China, for example,
Japan, India, many of the European countries,
they do believe that QKD will be an important part.
In some of the other geographies worldwide,
I think the debate is still on this.
Given the time that we have,
I'll probably only very quickly flash through
each one of the layers
in this particular architectural model.
So the communication at the highest level,
if you look at it from the application perspective,
is secured using hybrid public key cryptography
into which we can integrate
the new quantum resistant algorithms.
Going down a level there,
so the endpoints through your key management
can use high quality, high entropy symmetric keys.
And hopefully that's being generated
through a high quality source,
such as a quantum random number generator.
And then the communication between the endpoints
and the key management servers themselves
can also use public key cryptography
and post quantum algorithms
or quantum resistant algorithms.
The keys actually used between the endpoints
are being replicated between the key management nodes.
But those keys themselves,
now this is sort of getting a bit into the inception kind of an idea,
the keys themselves are protected
by further cryptographic materials.
So in the transport of the keys,
the keys are encrypted with another set of keys,
which are actually then transported
by the quantum relays that we talked about.
Which is this point here,
where you have the high entropy symmetric keys
that are delivered through the quantum key relays
are used in turn through the actual keys
which are the symmetric keys that Alice wants to send to Bob
to secure, to absolutely secure the transport of that.
So we'll talk about that in a little bit more detail
and I apologize for the very quick run through of this.
But I just wanted to give you a little bit of a flavor
of how this could be all very neatly put together
into a well thought out infrastructure,
a cyber security infrastructure
that can sit right at the foundations
of your IT infrastructure.
And I'll just close with a few comments
about what we think are some of the things
that you could actually do
to move towards a quantum resistant posture.
So some of them are just basic cyber hygiene,
which you should do today anyway.
But the point is in transitioning across
to quantum resilience,
it's probably a very good catalyst
for doing what you should be doing in any case.
First thing, no rocket science to that,
is map and identify the data you hold.
Many large organizations today
do not understand what information is held
across the organization and where it resides.
And not only where it resides,
but who has access to it.
Of that, prioritize.
So identify those particular ones
which are exposed to quantum risk.
And then identify and understand
the consequences of a potential breach
and a potential risk
so you can develop potential remediation strategies.
Absolutely critical.
And then evaluate potential quantum safe solutions
that are out there.
As I was mentioning,
you saw some examples of what QLabs has in market,
but there are other companies as well.
Evaluate the solutions that you see out there
and start to think about
which of those solutions could be of value to you.
How might they integrate into your infrastructure
and into your particular applications
and use that to develop
a quantum safe transition roadmap.
And indeed, you might choose to do some pilot programs.
As Arvind Krishna from IBM suggested,
have a team of three or five
that is doing some work today.
I think it will be really valuable.
If you think about most large enterprises,
it's not a very big call on your resources
to have three or five people
dedicated to doing some investigation in this area.
But the risk-reward payoff
could be very, very significant.
And then finally, implement that roadmap.
And what does that look like?
Well, as we said,
we looked at a hybrid infrastructure.
Consider deployment of some of that.
What are some of the elements?
Post-quantum algorithms.
Well, as you know,
NIST just made its first four recommendations
about two or three weeks ago.
Consider using those.
There are a range of prototype implementations
of some of the other shortlisted candidates.
Start playing with those.
At Quintessence Labs,
we ourselves have done that.
We work with a number of vendors
of these quantum-resistant algorithms
and integrated some of their capabilities today
into hybrid infrastructures.
And some of those hybrids are very interesting
because they use today's ciphers
but also the quantum-resistant ones.
And a number of organizations have found that
to be a very good way to go.
And finally, if it is of interest,
start exploring quantum key distribution as well
because that gives you,
to the question earlier, a plan B.
So I apologize.
It's gone on quite long
and it was probably a little bit
of a firehose of information.
But I hope that there was something there
for each of you.
And I'd be happy to take any questions,
although we may be a little bit short on time,
but happy to take questions if there are any.
Sir?
I'm sorry, I couldn't hear you.
Maybe I could ask you to come up here.
You mentioned that the PCIe hardware
has like a gigabit of true-end of the generation.
What are the scenarios where you actually need
that much random number generation in the first place?
Because my understanding is that, in general,
like CSPRGs already are really effective
at taking some small amount of unknown data
and really stretching it in such a way
that it's very hard to reverse engineer.
Are there mainly like quantum applications
where that's necessary
or is it useful in other scenarios that you're not aware of?
Thank you.
Great question.
So basically talking about why you would need
very high volumes of entropy
given that there are mechanisms today
which take a small amount of entropy
and use mathematical techniques to amplify.
Did I get the question more or less right?
Yeah.
So I think a couple of reasons.
So the first thing I would offer you
is that it's very easy to integrate this quantum source
into a broad application.
Some organizations will go for the quantum source
just for itself,
but what we recommend is that as you're going
for a broad deployment of post-quantum
or quantum resilient architectures,
you may as well,
because it's so simple to do.
But why?
So one is that we think,
as you said,
at the moment,
if you take a small amount of random
and then amplify it through mathematics,
probably it is good enough quality.
However, what the risk that we're supposed to,
and it might be residual risk,
is that a quantum-enabled adversary
is able to find some patternality
in the mathematical algorithm that you use
and therefore weaken the ciphers which are derived to that.
So it's to remove that residual risk.
The other is
that when you look at many of the random numbers today,
generators,
they are quite limited.
If you look at the Linux kernel,
if you draw more than at a certain rate per second,
it will just block and say,
you've got to wait a bit.
And indeed,
when you're spinning up a lot of applications
on virtual machines and so on,
they can block.
So that's a little bit of a problem.
Also, many of those,
every time they spin up,
often they'll bring up the same sequence
every time they spin up,
which means that you could be exposed
to risk there as well.
And as I said,
as we move to massive rates of transaction
where you'll be needing to do key refresh
or key gen very rapidly,
we think that you will require
gigabits per second
to be able to support those kinds of applications.
I hope that helps.
Sir.
Sir, if I've got that right,
I think you were asking about dedicated high quality fiber
required to support QKD
and how we're moving towards implementing that.
Yeah.
So great question.
So one of the things
that's particularly advantageous,
and I am a bit biased
because I come from the continuous variable QKD approach,
as I said, the laser-based approach,
is that it runs over the existing optic fiber
that's in ground today.
Further, it has the ability to be multiplexed.
There's a technology called DWDM
where you actually have multiple colors,
if you like, of light
which are simultaneously running
over one piece of optic fiber
carrying separate conversations.
So that can actually support that.
So the beauty of QKD as it's moving now
is that you do not need dedicated
or indeed bespoke optic fiber.
The problem which arises
is some of the older optic fiber which exists
is of perhaps not such high quality
and particularly where the losses occur
are on the end points
where the optic fiber then moves
through connectors into the rest of the network.
Often you get losses there.
So some of the older networks
may be a little bit challenged in supporting QKD,
but most of the infrastructure
that's being rolled out today
will work very seamlessly with QKD.
The limitation, of course, is the distance.
And if you have lower quality fiber,
that will mean that you can only go over
a shorter period.
If you've got higher quality, less loss fiber,
you go a longer distance.
But you can actually leverage the majority
of optic fiber that's available today for QKD.
I hope that helps.
Ma'am.
I think the question was around
what resource is available to determine
whether a particular segment of fiber is good enough.
Yeah.
So I think this depends on the QKD provider
that you choose to use.
So most of their equipment will tell you
of what a tolerance threshold is
for loss for their particular equipment.
So if you think about most optic fiber
has a measure of losses called dB.
And most fiber that we have in ground today,
you get about 0.2 dB loss.
And 3 dB means the signal's halved.
So basically, if you go, what is that,
15 kilometers of fiber, roughly speaking,
the signal will be about half the strength.
And you go 30 ks, it'll be a quarter strength,
and so on and so forth.
So many providers will give you a range
that suggests 5 to 10 dB loss
should be supportable with their QKD systems.
So it kind of gives you an idea.
But I think what you'll typically find
is that for most metropolitan distances,
it should work very well.
And then maybe for some medium-haul distances as well.
So...
So the question was,
I think if you can compromise
the QKD generation system itself.
Certainly there are some new...
Well, first to come to that question,
I suppose if you can get inside of the box
and insert something nasty
as it were inside the QKD appliance itself,
potentially, yes, with the majority of systems
that are out there today.
But there's a new type of QKD that's coming out,
certainly in the theoretical domain that's been postulated,
called device-independent QKD.
So its idea is that if you like,
and I'm sort of simplifying it here,
it's got some self-check mechanisms in there.
And it makes the assumption
that bad things have happened
to the physical device
that's deploying the QKD.
And it can measure and mitigate against that.
So that device-independent QKD is just emerging now.
And perhaps over the coming years,
we will see some solutions which implement that.
Thank you.
Thank you.
Yeah, a question around intellectual property considerations.
And with algorithms like SHA and others,
they're well understood,
well publicized,
and I guess, therefore, well vetted.
How does that apply in the QKD domain?
I think that was the question.
So, again, actually, the good news there is
that the protocols that are implemented
in the variety of QKD systems that you see out there
are well published
and have had enormous peer review and scrutiny
by primarily academics worldwide.
So the secret sauce is not so much
in the protocol and the mechanism.
In fact, to your point,
it's desirable that it should be put out there
and subject to extensive scrutiny.
Where, for most companies,
secret sauce lies,
how you implement that
and you actually translate that
into physical devices.
And there are indeed some considerations.
Okay, well, how do I then evaluate that?
But just like NIST is doing
with its quantum-resistant algorithms now,
it is a process that you have to go through.
You need experts
and you need some scrutiny around it.
But the basic mechanism that is used,
the protocols that are used,
are very well publicized
and well scrutinized
by the academic community.
All right.
Well, thank you so much for joining today.
Really appreciate your time.
Thank you.