2022-09-16-德勤-Managing_the_quantum_cybersecurity_threat_11页_2mb

报告摘要

Organizations should begin preparing now for the threat posed by future quantum computers to current cryptographic systems.
The transition to a quantum-secure economy requires cryptographic agility, adoption of quantum-resistant technologies, and proactive risk assessment.

Quantum computers threaten to break widely used public-key cryptography through algorithms (e.g., Shor's Algorithm).
Specific examples include compromising cryptocurrencies like Bitcoin and Ethereum due to vulnerabilities in public-key encryption.
Attacks might employ "harvest-now, decrypt-later" strategies, and the transition timeline for post-quantum cryptography (PQC) and sensitive data shelf-life ("x" and "y") are significant factors.
While destroying existing data via "now" attacks might be limited for blockchain, preparatory steps are essential.

Experts suggest quantum computers capable of breaking encryption could appear relatively soon (within 10 years).
The global impact includes severe breaches affecting health, finance, personal data 💰, cryptocurrency validity, internet communications interception, document integrity, and the erosion of trust systems.

Three main approaches exist to mitigate quantum risks:

Post-Quantum Cryptography (PQC): Uses new algorithms resilient to quantum attacks. Advantage: software-compatible, secure against current known quantum attacks. Disadvantage: performance issues, need for validation.
Quantum Key Distribution (QKD): Physically transmits encryption keys securely, theoretically unbreakable. Advantage: information-theoretic security, protects "harvest-now". Disadvantage: requires specialized infrastructure and has distance limitations.
Quantum Random Number Generation (QRNG): Provides truly random numbers for secure key generation. Advantage: certifiable randomness. Disadvantage: difficult to quantify benefits compared to classical RNGs.

Build Awareness: Educate senior leadership and understand quantum risk fundamentals.
Develop Strategy: Formulate a roadmap for a quantum-safe enterprise transition.
Engage Ecosystem: Collaborate with public/private partners on standards (e.g., NIST/FIPS) and implementation guidance.
Practice Cyber Hygiene: Maintain strong general cybersecurity and safeguard sensitive data.
Become Crypto-Agile: Plan for smooth transitions to new cryptographic algorithms and technologies.