Cybersecurity and Cryptographic Transition

Introduction and Context

Quantum computing is strategically important to cybersecurity because it changes the computational assumptions underlying widely deployed cryptographic systems. Today’s public-key infrastructure relies mainly on the practical difficulty of integer factorisation and the discrete logarithm problem. A sufficiently capable, fault-tolerant quantum computer would make those assumptions unsafe for important algorithms, especially RSA, Diffie–Hellman and elliptic-curve cryptography.

The transition to quantum-resistant security is not a single technology replacement. It involves discovering where cryptography is used, classifying information by confidentiality lifetime, selecting suitable post-quantum cryptography (PQC), redesigning protocols and hardware, testing interoperability, managing larger keys and signatures, and maintaining governance throughout a long migration. Quantum key distribution (QKD) may contribute in specialised environments, but it is not a universal replacement for cryptographic engineering.

Learning Objectives

By the end of this chapter, a learner should be able to:

1. Explain why Shor’s algorithm threatens major public-key systems.
2. Explain Grover’s algorithm and its effect on symmetric cryptography and hashing.
3. Analyse the harvest-now-decrypt-later threat.
4. Construct the main elements of a cryptographic inventory.
5. Describe a practical migration to post-quantum cryptography.
6. Distinguish the capabilities and boundaries of QKD.
7. Evaluate governance, operational and strategic consequences of cryptographic transition.

1. The Cryptographic Threat Model

Cryptography provides several different security services:

• Confidentiality: preventing unauthorised disclosure.
• Integrity: detecting unauthorised modification.
• Authentication: establishing the identity of a communicating party or the origin of data.
• Non-repudiation or evidentiary assurance: supporting claims about who approved or signed data, subject to legal and operational conditions.

The quantum threat differs according to the cryptographic primitive. Public-key encryption and signatures are particularly exposed to Shor’s algorithm. Symmetric encryption and hash functions are not broken in the same way; Grover’s algorithm provides a quadratic, rather than exponential, speedup for certain search problems.

A useful distinction is between computational security and information-theoretic security. Computational security assumes that an attacker lacks sufficient resources to solve a difficult problem. Information-theoretic security remains secure even against an attacker with unlimited computational power, provided the scheme’s physical or key-management assumptions hold. Most deployed cryptography is computationally secure, including proposed PQC systems. The fact that an algorithm is post-quantum does not mean it is unconditionally secure.

2. Shor’s Algorithm and Public-Key Cryptography

2.1 Core idea

Shor’s algorithm is a quantum algorithm for finding periodicity. In its factoring application, it converts integer factorisation into a period-finding problem and uses the quantum Fourier transform to identify that period efficiently. In its discrete-logarithm application, it solves discrete logarithms efficiently in relevant finite groups.

For an integer N, classical general-purpose factoring algorithms are sub-exponential rather than known to be polynomial-time. Shor’s algorithm, in idealised complexity terms, runs in polynomial time in log N, although practical resource requirements include many logical qubits, error correction and a very large number of fault-tolerant operations.

The strategic point is not that a quantum computer currently breaks deployed RSA or elliptic-curve systems. It is that the security foundation of those systems would fail if a sufficiently capable fault-tolerant machine became available.

2.2 Consequences for RSA

RSA security depends on the difficulty of factoring a public modulus N = pq, where p and q are large secret primes. The public key contains N and a public exponent; the private key depends on the factors. Shor’s algorithm could recover the factors in principle, enabling decryption and forgery.

The equation N = pq describes key generation, not a complete security equation. Its applicability assumes suitably generated primes and a correctly implemented RSA scheme. In practice, RSA security also depends on padding, key size, randomness, implementation quality and protocol design. Quantum resistance cannot be obtained merely by increasing the RSA key size.

2.3 Consequences for Diffie–Hellman and elliptic curves

Finite-field Diffie–Hellman relies on the difficulty of the discrete logarithm problem. Elliptic-curve Diffie–Hellman and elliptic-curve digital signatures rely on analogous problems over elliptic-curve groups. Shor’s algorithm attacks both classes of problem. Consequently, increasing an elliptic-curve key from one conventional size to another does not create a post-quantum solution.

This affects:

• RSA encryption and signatures;
• finite-field Diffie–Hellman key exchange;
• elliptic-curve Diffie–Hellman and related key agreement;
• DSA and elliptic-curve digital signatures;
• certificates and public-key infrastructures using these algorithms;
• long-lived signed software, documents and firmware.

The risk includes both disclosure and impersonation. A captured public-key ciphertext may become decryptable later, while a compromised signing key may permit forged software updates or fraudulent certificates.

3. Grover’s Algorithm, Symmetric Cryptography and Hashing

Grover’s algorithm accelerates unstructured search. If a classical brute-force search over a space of size 2^k requires approximately 2^k trials in the worst case, an ideal quantum search requires approximately 2^k/2 oracle evaluations, ignoring implementation overhead and error correction.

Here k is the key length in bits, and the expressions describe idealised query complexity, not guaranteed wall-clock time. The oracle must be implemented as a reversible quantum circuit, and a practical attack would require substantial resources. The result is nevertheless important for security planning.

For a block cipher with an ideal k-bit key, Grover’s algorithm can reduce the idealised brute-force security level from approximately k bits to approximately k/2 bits. Thus, a 128-bit key is often discussed as offering roughly 64 bits of idealised quantum search security, whereas a 256-bit key offers roughly 128 bits. This comparison does not mean that every real attack achieves exactly those values.

Hash functions require more careful analysis. Generic quantum attacks can reduce the cost of preimage search, but collision search has a different structure and may have a different quantum speedup. Therefore, one should not apply a single “halve the hash length” rule to every hash security property. Security assessments must identify whether the relevant property is preimage resistance, second-preimage resistance or collision resistance.

Practical responses include using adequately sized symmetric keys, selecting approved hash functions and reviewing protocol-specific security margins. Symmetric cryptography therefore generally requires strengthening or parameter selection, not wholesale abandonment.

4. Harvest Now, Decrypt Later

Harvest now, decrypt later (HNDL) describes an adversary collecting encrypted traffic today and attempting to decrypt it after obtaining a sufficiently capable quantum computer. The attack is especially serious where:

1. data can be recorded without immediate detection;
2. the data remains sensitive for many years; and
3. the encryption uses a quantum-vulnerable public-key mechanism.

Examples include diplomatic communications, defence information, health records, industrial research, strategic business plans and personal data subject to long retention periods. The threat exists even if no cryptographically relevant quantum computer is available today.

A simplified risk model is useful for prioritisation:

This is a governance heuristic, not a probability law. Each factor should be assessed using an organisation’s defined scales. “Exposure” may include internet accessibility, adversary interest, data volume and the ease of recording traffic. The model helps compare systems; it does not produce a universally valid numerical risk probability.

HNDL changes the timing of the security decision. A system with a five-year confidentiality requirement may already be at risk if migration, procurement and validation take several years. Data protected only by a vulnerable key exchange may be exposed even when the bulk data uses a strong symmetric cipher.

Mitigations include deploying hybrid key establishment, reducing unnecessary retention, protecting archives with quantum-resistant mechanisms, separating high-value data, and ensuring that future decryption does not depend on a vulnerable historical key exchange. Organisations should avoid assuming that deleting visible application data removes all copies; backups, logs, network captures and third-party archives may remain.

5. Building a Cryptographic Inventory

A cryptographic inventory is a maintained record of where cryptography is used, what security service it provides, which algorithms and parameters are selected, who owns the system, and how it can be changed.

A useful inventory record contains:

Inventory work should combine several methods: configuration analysis, software composition analysis, certificate discovery, network observation, interviews with system owners, procurement records and supplier questionnaires. Static discovery alone is insufficient because cryptographic operations may be hidden in libraries, hardware modules, operating systems, cloud services or embedded devices.

The inventory should distinguish direct use from inherited use. An application may not call RSA explicitly while relying on a TLS library, cloud identity service or certificate authority that does. It should also record cryptographic agility: whether algorithms, key sizes and certificates can be changed through configuration or require code, firmware or hardware redesign.

A mature inventory is not a one-time spreadsheet. It is a controlled capability integrated with architecture repositories, vulnerability management, asset management, software bills of materials and change-management processes.

6. Post-Quantum Cryptography Migration

6.1 What PQC means

Post-quantum cryptography consists of classical algorithms designed to resist known quantum attacks. They run on conventional computers and networks; they do not require a quantum computer. Security is based on mathematical problems believed to be hard for both classical and quantum adversaries.

Important families include:

• Lattice-based cryptography: based on problems involving structured or unstructured lattices; commonly associated with key encapsulation and signatures.
• Hash-based signatures: rely primarily on hash-function security and are strong candidates for carefully controlled signing use cases, though some schemes have state-management requirements.
• Code-based cryptography: based on decoding problems for error-correcting codes; public keys can be large.
• Multivariate and other constructions: based on systems of algebraic equations or other hardness assumptions; their status must be evaluated against current standardisation evidence.

A key encapsulation mechanism (KEM) allows two parties to establish a shared secret using a public key and an encapsulation operation. A digital signature provides integrity and authentication, but not confidentiality. These functions should not be conflated during migration.

6.2 Migration phases

A practical migration can be organised as follows:

1. Governance and scope: appoint accountable leadership, define policy and identify regulated data.
2. Discovery: create and validate the cryptographic inventory.
3. Prioritisation: rank systems by data lifetime, impact, exposure, algorithm vulnerability and replacement difficulty.
4. Architecture: define approved PQC algorithms, hybrid patterns, certificate strategies and lifecycle controls.
5. Experimentation: test libraries, hardware security modules, protocol stacks, performance and interoperability.
6. Pilot deployment: begin with controlled services and representative clients.
7. Scaled transition: update infrastructure, suppliers, certificates, endpoints, firmware and operational procedures.
8. Decommissioning: remove vulnerable algorithms where feasible and close exceptions with evidence.
9. Continuous assurance: monitor standards, cryptanalysis, implementation vulnerabilities and new migration dependencies.

6.3 Hybrid deployment

A hybrid design combines a conventional mechanism with a PQC mechanism so that security is retained if at least one component remains secure, assuming the combination is designed correctly. A common conceptual pattern is to derive a session key from two independently established secrets:

Here K_session is the session key, K_classical and K_PQC are independently established shared secrets, ∥ denotes concatenation, and KDF is a specified key-derivation function. “context” binds the derivation to protocol information such as identities, roles and transcript data. The equation is a design pattern, not a complete protocol specification. Security depends on authenticated transcript binding, domain separation, correct error handling and standards-compliant composition.

Hybrid approaches may increase message size, computation, latency and implementation complexity. They should therefore be tested rather than adopted as an automatic universal answer.

6.4 Engineering concerns

PQC migration may affect:

• certificate and handshake sizes;
• maximum transmission units and fragmentation;
• memory and processing requirements;
• hardware security modules and smart cards;
• constrained devices and satellite or industrial links;
• certificate issuance and revocation systems;
• backup and disaster-recovery procedures;
• logging, monitoring and incident response;
• supplier contracts and long-lived product support.

PQC algorithms can have larger public keys, ciphertexts or signatures than conventional algorithms. Performance must be measured under realistic concurrency and failure conditions. Side-channel resistance, secure randomness, constant-time implementation where appropriate, fault handling and validation remain necessary. A mathematically sound algorithm can still be defeated by poor implementation or weak key management.

7. The Boundaries of Quantum Key Distribution

Quantum key distribution uses quantum states and authenticated classical communication to establish shared random keys. In simplified terms, an eavesdropper’s interaction with quantum signals can introduce detectable disturbance, allowing the communicating parties to estimate whether the channel is sufficiently secure. Protocols such as BB84 illustrate this principle.

QKD does not encrypt application data by itself. It produces keys that must then be used with symmetric encryption or a one-time pad. If a one-time pad is used, the key must be as long as the message, truly random, securely delivered and never reused. QKD also requires an authenticated classical channel; without authentication, a man-in-the-middle attack remains possible.

QKD’s practical boundaries include:

• specialised optical transmitters, receivers and detectors;
• distance and loss limitations;
• trusted nodes or repeaters in some network designs;
• key-generation-rate constraints;
• alignment, calibration and maintenance requirements;
• denial-of-service vulnerability;
• endpoint and implementation security;
• integration with identity, access control and key management;
• cost and limited compatibility with ordinary endpoints.

QKD does not automatically protect endpoints, databases, backups, software supply chains or digital signatures. It does not solve authentication unless authentication keys and protocols are separately provided. It may be appropriate for high-value fixed links with specialised infrastructure and a strong threat model, but PQC is generally more deployable across ordinary internet and enterprise systems.

QKD and PQC should be evaluated as different tools. QKD offers a physical-layer approach with demanding infrastructure assumptions. PQC offers software- and hardware-deployable computational security. In many environments, cryptographic agility, strong key management and PQC provide broader practical value than constructing a QKD network.

8. Illustrative Case: A National Health Archive

Background

Consider a fictional national health agency responsible for medical records retained for 30 years. Hospitals exchange records through APIs and secure messaging. Public-key certificates currently use elliptic-curve signatures and key agreement. The agency also operates an archive, a patient portal and a supplier-managed cloud backup service.

Problem

The agency receives intelligence indicating that hostile actors are collecting encrypted traffic. Although the attackers cannot currently decrypt the traffic, the records have a long confidentiality lifetime. The agency has no complete cryptographic inventory, and several medical devices have support lifetimes exceeding ten years.

Analysis

The highest priorities are the external key-establishment protocols, certificate infrastructure, backup channels and device-management systems. The bulk record encryption uses a strong symmetric algorithm, but its protection depends on how keys are exchanged and stored. The agency also discovers that some firmware-signing workflows use conventional public-key signatures, creating a future integrity and safety risk.

Approach

The agency establishes a cryptographic transition board and performs discovery across applications, devices, suppliers and cloud services. It classifies information by confidentiality lifetime and identifies systems that cannot be rapidly upgraded. For internet-facing services, it pilots standards-aligned PQC key establishment, initially using a hybrid design where supported. It tests handshake sizes, certificate chains, mobile clients, API gateways and hospital network equipment.

For firmware, it creates a staged signature-verification update path and requires suppliers to support approved quantum-resistant signatures in future product releases. Archived records are re-encrypted under a controlled key hierarchy, while access logs and backup copies are included in the protection plan. Exceptions are documented with owners, deadlines and compensating controls.

Outcome

The agency does not claim that one algorithm or QKD will solve all problems. Instead, it achieves visibility, reduces HNDL exposure, establishes upgrade paths and incorporates PQC requirements into procurement. Some legacy devices remain exceptions, but their data flows are isolated and monitored while replacement plans are funded.

Learning Points

The case demonstrates that transition is an enterprise programme rather than a cryptographic library upgrade. Inventory quality, data lifetime, supplier management, testing and governance are as important as algorithm selection. It also demonstrates why QKD, even if technically attractive for a particular backbone link, would not protect the entire health-data ecosystem.

9. Governance, Ethics and Regulation

Cryptographic transition affects public safety, privacy and institutional trust. Decisions should account for:

• Privacy: long-lived personal information may be exposed through HNDL.
• Safety: compromised firmware or medical-device signatures can create physical harm.
• Equity: under-resourced organisations may struggle to replace legacy systems.
• Accountability: exceptions should have named owners and review dates.
• Procurement integrity: suppliers should disclose algorithm dependencies and update support.
• Regulatory alignment: organisations must map transition activities to applicable cybersecurity, privacy, records-retention and sector requirements.
• Responsible disclosure: weaknesses in implementations should be reported and remediated without unnecessarily exposing sensitive systems.

Organisations should not make unsupported claims such as “quantum-proof” without specifying the algorithm, security level, implementation assumptions and scope. Security communication must distinguish current evidence from future projections.

10. Best Practices and Contemporary Direction

Effective practice includes:

1. Start inventory and data-lifetime analysis before selecting products.
2. Prioritise vulnerable public-key uses that protect long-lived information.
3. Use recognised standards and validated implementations rather than experimental algorithms in critical production systems.
4. Design for cryptographic agility, but do not treat agility as a substitute for migration.
5. Test hybrid protocols for interoperability, performance and failure behaviour.
6. Include certificates, signatures, firmware, archives, backups and third-party services.
7. Maintain secure randomness, key management, access control and side-channel protections.
8. Track algorithm and implementation dependencies in procurement and architecture reviews.
9. Plan for algorithm deprecation and emergency replacement.
10. Reassess assumptions as quantum hardware, cryptanalysis and standards evolve.

The strategic trend is toward a layered transition: stronger symmetric protection where appropriate, standardised PQC for public-key functions, inventory-driven prioritisation and carefully bounded use of specialised technologies such as QKD. Quantum computing is therefore not only a future technical issue; it is a present governance and planning issue.

Chapter Summary

Shor’s algorithm threatens RSA, finite-field discrete-logarithm systems and elliptic-curve cryptography by efficiently solving the mathematical problems on which they rely, assuming a sufficiently capable fault-tolerant quantum computer. Grover’s algorithm provides a quadratic search advantage, reducing the idealised security of a k-bit symmetric key toward k/2 bits, although practical attacks require substantial resources. Hash-function properties must be analysed individually.

Harvest-now-decrypt-later makes transition urgent because adversaries can record vulnerable ciphertext today and attack it in the future. A cryptographic inventory identifies algorithms, parameters, owners, dependencies, data lifetimes and migration status. Post-quantum cryptography provides conventional-computer algorithms intended to resist known quantum attacks, while hybrid designs can support staged deployment when carefully composed.

QKD can establish keys under specialised physical and operational assumptions, but it does not provide complete cybersecurity, authentication, endpoint protection or universal deployability. Successful transition requires governance, supplier engagement, testing, cryptographic agility, lifecycle management and continuous review.

Key Terms

Shor’s algorithm: A quantum algorithm that can efficiently solve factoring and discrete-logarithm problems in principle.

Grover’s algorithm: A quantum search algorithm offering an idealised quadratic speedup for unstructured search.

Harvest now, decrypt later: Collection of encrypted data today for attempted decryption when future capability permits.

Post-quantum cryptography: Cryptography designed to resist known classical and quantum attacks while running on conventional systems.

Cryptographic inventory: A maintained record of cryptographic algorithms, uses, dependencies, owners and migration status.

Public-key cryptography: Cryptography using related public and private keys for encryption, key agreement or signatures.

Key encapsulation mechanism: A public-key mechanism for establishing or transporting a shared secret.

Digital signature: A cryptographic value used to support integrity and authentication of data or messages.

Hybrid key establishment: Combining conventional and post-quantum mechanisms in one protocol design.

Cryptographic agility: The capability to replace algorithms, parameters or implementations with limited disruption.

Quantum key distribution: A method using quantum communication and authenticated classical communication to establish keys.

Information-theoretic security: Security that does not depend on an attacker’s computational limitations.

Computational security: Security based on the presumed difficulty of solving a problem with available resources.

Preimage resistance: Difficulty of finding an input that produces a specified hash output.

Collision resistance: Difficulty of finding two distinct inputs with the same hash output.

Key derivation function: A function that derives cryptographic keys from shared secrets and contextual data.

Fault-tolerant quantum computer: A quantum computer using error correction to perform reliable long computations.

Certificate lifecycle: The processes for issuing, validating, renewing and revoking digital certificates.

Trusted node: An intermediate QKD network component that must be trusted to handle key material.

Review Questions

Short Answer Questions

1. Why does Shor’s algorithm threaten RSA and elliptic-curve cryptography?
2. What is meant by harvest now, decrypt later?
3. How does Grover’s algorithm affect an idealised 256-bit symmetric key?
4. Name four fields that should appear in a cryptographic inventory.
5. Why does QKD require an authenticated classical channel?

Long Answer Questions

1. Explain the different security consequences of Shor’s and Grover’s algorithms.
2. Describe a complete organisational process for migrating to post-quantum cryptography.
3. Discuss why confidentiality lifetime is central to HNDL risk assessment.
4. Compare PQC and QKD in terms of deployment, assumptions and limitations.
5. Explain how cryptographic agility, supplier management and inventory governance support transition.

Analytical / Application Questions

1. A government archive retains confidential records for 25 years and currently uses elliptic-curve key exchange. Prioritise its migration activities and justify your order.
2. An organisation proposes doubling every RSA key size instead of adopting PQC. Evaluate the proposal and recommend a better strategy.
3. A data centre proposes QKD for its backbone but leaves endpoint authentication and firmware signing unchanged. Analyse the security gaps in this plan.

Multiple Choice Questions with Answers

Question 1

Which cryptographic assumption is directly threatened by Shor’s algorithm?

A. The difficulty of integer factorisation and discrete logarithms

B. The confidentiality of all symmetric ciphers without exception

C. The availability of optical communication links

D. The randomness of every physical noise source

Correct Answer: A. The difficulty of integer factorisation and discrete logarithms

Question 2

For an idealised unstructured search over 2^k possibilities, Grover’s algorithm requires approximately what number of oracle evaluations?

A. 2^k

B. 2k

C. 2^(k/2)

D. k^2

Correct Answer: C. 2^(k/2)

Question 3

Which situation best illustrates harvest-now-decrypt-later risk?

A. An attacker deletes an expired certificate immediately

B. An attacker records encrypted diplomatic traffic for future decryption

C. A user changes a password before it expires

D. A firewall blocks an unauthenticated packet

Correct Answer: B. An attacker records encrypted diplomatic traffic for future decryption

Question 4

Which item is most important for prioritising HNDL exposure?

A. The colour of the system’s user interface

B. The confidentiality lifetime of the protected information

C. The number of pages in the system manual

D. The physical size of the server room

Correct Answer: B. The confidentiality lifetime of the protected information

Question 5

What is the primary purpose of a cryptographic inventory?

A. To list only passwords held by employees

B. To record where and how cryptography is used and managed

C. To replace all network monitoring

D. To guarantee unconditional security

Correct Answer: B. To record where and how cryptography is used and managed

Question 6

Which statement about post-quantum cryptography is correct?

A. It requires a quantum computer at every endpoint

B. It is intended to run on conventional computing systems

C. It eliminates the need for authentication

D. It guarantees security against every future attack

Correct Answer: B. It is intended to run on conventional computing systems

Question 7

In the expression K_session = KDF(K_classical ∥ K_PQC ∥ context), what does KDF represent?

A. A key-discovery firewall

B. A key derivation function

C. A quantum detector

D. A certificate revocation list

Correct Answer: B. A key derivation function

Question 8

Which is a limitation of QKD?

A. It automatically authenticates every endpoint

B. It protects software signatures without additional mechanisms

C. It requires specialised infrastructure and an authenticated classical channel

D. It works without any key-management process

Correct Answer: C. It requires specialised infrastructure and an authenticated classical channel

Question 9

Why is simply increasing an RSA key size not a post-quantum solution?

A. Shor’s algorithm attacks the underlying factoring problem

B. RSA keys cannot be represented digitally

C. Larger keys always reduce classical security

D. RSA is a symmetric algorithm

Correct Answer: A. Shor’s algorithm attacks the underlying factoring problem

Question 10

Which migration activity should normally precede large-scale algorithm replacement?

A. Deleting all historical security records

B. Building and validating a cryptographic inventory

C. Removing certificate management

D. Deploying QKD to every endpoint

Correct Answer: B. Building and validating a cryptographic inventory