3 challenges agencies need to overcome ahead of Q-Day

Q-day is coming. That’s the day when computers are powerful enough to break the current cybersecurity public-key encryption standards. Some say Q-day will happen in the late 2020s or early 2030s.

But some private sector companies are preparing for 2029 as the timeframe that current encryption is at risk. The Office of Management and Budget has given agencies a series of deadlines over the next several years.

OMB’s June memo told agencies to name a post-quantum cryptography lead by July and then submit migration plans by the end of October.

Over the next two years, agencies are expected to pilot how they will migrate system to PQC standards with a specific focus on high value systems.

Aside from naming a PQC lead, agencies are struggling with the migration plans and already are facing an uphill climb to begin pilots.

Rick Muller, the senior vice president and chief scientist at IonQ Federal, said agencies will need to overcome several obstacles to be ready for post-quantum cryptography.

“One is challenged further by the fact that you don’t know everywhere that encryption is used, and so just finding all the places where we’re using encryption in these codes is something very, very challenging. Then replacing it with something safer and rock hard is also challenging,” Muller said on the discussion Innovation in Government sponsored by Carahsoft. “If you look at most or many cryptographic breaches, they are made because of a good standard that was improperly implemented, rather than a bad standard. There is only one way to get these things right, and there are a million ways to get them wrong, and it’s just very, very hard.”

A third big challenge is the fact that cryptographic standards are much longer than the current RSA or elliptic curve cryptography (ECC) keys.

DARPA to verify, validate

Muller said the current standards are based on a short key structure to encrypt information, which work well with most of the current technologies in use across the public and private sectors.

“I think all of the all of the post-quantum cryptographic standards are significantly longer than RSA and ECC keys, and that just means that it that there’s a greater overhead, and it’s computationally just harder to implement safely in a communications systems,” he said. “IonQ is also optimistic about basing cryptographic encryptions rather than just on math problems but on the quantum physics itself. There’s another standard called quantum key distribution that uses quantum properties of photons to transmit keys in a way that uses physics rather than mathematics, and we think is completely secure if it’s implemented correctly.”

In many ways, the move to quantum has been ongoing for many years. Muller said the use of these technologies in clocks and sensors isn’t new. But the question now is can quantum computers become affordable and provide value than cost.

The Defense Advanced Research Projects Agency (DARPA) is asking that exact question through its Quantum Benchmarking Initiative. The agency says QBI is designed to rigorously verify and validate whether any quantum computing approach can achieve utility-scale operation.

Muller said IonQ is one of several companies participating in QBI and have entered the third stage, called C, of the effort.

“The first phase was just you know proving that you were credible to DARPA that you had some foundationally correct computing that took I think about six months to a year. The second stage, B, involved working with DARPA teams to define a roadmap that would test and prove that you could actually do that,” he said. “Stage C is now where we execute and actually prove that we can build that that quantum computer. Think of it as a set of go/no-go conditions where you know by a certain date you have to demonstrate a certain capability, and the end of this in 2031 will result in proving that that you can demonstrate value.”

Roadmap to build a quantum computer

IonQ has a roadmap to get through Stage C to prove its capabilities to DARPA.

Muller said the company’s three-year timeline starts with initially demonstrating the hardware.

“We have a roadmap where we’re going to build a 256 ion machine at the end of this year, and that’s going to be followed by a by a 10,000 ion machine,” he said. “We have detailed plans for what those machines are going to look like, how fast they’re going to run, how much power they’re going to have and how much power they’re going to take. This is a long process where we’re going through each step of that, demonstrating that, at the end of the day, we can build something that’s going to work.”

Muller said the QBI demonstration as well as other efforts are going to even more critical as Q-day gets closer.

“We need to be concerned about disruptive technologies that are going to change the way we do business and the way we do national security. Quantum is here today — the clocks we use and the sensors we use are already being disrupted by having much more accurate versions that take advantage of quantum effects. We think within a couple years we’re going to see a similar disruption to computing,” he said. “We were all somewhat taken by surprise by artificial intelligence. We had been hearing about AI for 30 or 40 years, and it didn’t seem to be progressing. And in reality, it was progressing substantially. We just didn’t notice anything, and then all of a sudden, in 2017 or 2018, we all had this ChatGPT moment where we’re like, ‘Oh my, it works now!’ So we want to be prepared when quantum has the same transformative effect on our economy and on our national security. That’s why it pays to pay attention to it now. It’s also just fascinating work done by really great people and great companies, and so personally, I find it a lot of fun to keep track of and work in this field.”