ACSC says to stay ahead of the quantum threat

The Australian Cyber Security Centre (ACSC) is reminding agencies and businesses that cryptographically relevant quantum computers (CRQC), when they become available, will threaten the security of current systems that rely on traditional asymmetric cryptographic algorithms, and that organisations need to be taking steps now to protect their ICT systems.

Even though a CRQC may not exist for some time, the ACSC says that early action is crucial because:

• deploying protections against a CRQC may take longer than expected;
• estimating the timeline to achieve a CRQC is uncertain as quantum computing is an active area of research;
• storing highly sensitive or classified data using classical encryption methods may be vulnerable to ‘harvest now, decrypt later’ attacks.
   

Post-quantum cryptography (PQC) involves the creation and use of quantum-resistant cryptographic algorithms. In principle, these algorithms offer a low-cost and practical path to maintaining the security of data in the presence of a quantum computer.

ASD provides detailed advice in the Information security manual (ISM) on ASD-approved cryptographic algorithms, key sizes and parameters. The ISM recommends ceasing the use of traditional asymmetric cryptography by the end of 2030. This includes cryptographic algorithms such as the Rivest-Shamir-Adleman (RSA), Diffie-Hellman (DH), Elliptic Curve Diffie-Hellman (ECDH) and Elliptic Curve Digital Signature Algorithm (ECDSA) cryptography.

Instead, ASD recommends using post-quantum ASD-approved cryptographic algorithms as described in the ISM’s Guidelines for cryptography.

ASD is currently recommending the following high-level milestones:

• End of 2026: Organisations should have a refined plan for their transition to PQC.
• End of 2028: Organisations should have commenced their transition to PQC, starting with their critical systems and data.
• End of 2030: Organisations should have completed their PQC transition.
   

Updated advice for preparing for post-quantum cryptographic algorithms can be found here.

Image credit: iStock.com/narvo vexar