The functioning of the internet and other communication systems relies on secure and efficient cryptographic algorithms. These algorithms allow internet entities to communicate with secrecy, and also to verify the identities of those parties with whom they are communicating. Symmetric-key algorithms such as the Advanced Encryption Standard (AES) provide secrecy by use of a shared key between the communicating parties. Public-key cryptography provides key-agreement algorithms (e.g. Diffie-Hellman) for deriving the shared key, and also verification algorithms (e.g. RSA algorithm) for authenticating the identity of each entity.
The security of RSA and Diffie-Hellman are based on computational problems such as factoring large numbers and finding discrete logs. These are exponentially difficult to solve using conventional computers and classical algorithms. Even considering Moore’s Law, it was thought that unless very significant progress was made in factoring algorithms, RSA, Diffie-Hellman and other such algorithms would be secure for the long-term future.
Shor’s algorithm, invented in 1994, changed this. It is an algorithm for factoring large numbers, but a critical part of that algorithm could only be run on quantum computers. If a sufficiently large quantum computer could be built in practice to run Shor’s algorithm, then large numbers could be factored very efficiently, and the security of RSA and related algorithms such as Diffie-Hellman would fall apart. The impact on the internet would be enormous. It is estimated that if certain problems could be solved, a quantum machine with twenty million quantum bits (qubits) could be built to break 2048-bit RSA . Current experimental quantum computers contain around fifty qubits.
Due to uncertainties concerning the scaling of quantum computers, it is unknown as to when such a practical quantum computer could be built, or even if it is feasible. One milestone for measuring the progress of development is the notion of quantum supremacy, whereby a quantum computer is able in practice to solve tasks beyond the reach of conventional computers. Amidst the funding of billions of dollars for research, industry is now predicting quantum supremacy can be achieved in the next few years . While this does not mean that our public key algorithms are in imminent danger of being broken, it means that industry needs to start preparation for transition to quantum-safe algorithms, immune to Shor’s and other quantum algorithms.
We note that even against the power of a quantum computer, symmetric-key algorithms remain safe. It’s estimated that the quantum computing may halve the effective length of symmetric keys, which means that algorithms like AES-256 will remain secure, without need for replacement.
Huawei plans to introduce quantum-safe algorithms into its products at an early date, to ensure the long-term security of its products. Most important is to introduce secure quantum-safe algorithms for key-agreement. This is because key-agreement messages can be stored now, and retrospectively attacked when a quantum computer becomes a reality. This means that sessions conducted before the realization of a quantum computer might not have forward security if legacy key-agreement algorithms continue to be used.
Huawei is following various standardization activities for post-quantum algorithms with interest. One well-known standardization exercise is in the process of analyzing many dozens of post-quantum algorithms with the help of the global academic community. This standardization exercise is expected to finish by 2024, although the nature and number of algorithms to reach the final portfolio is difficult to predict.
We plan to introduce some of these algorithms into our products in advance of the 2024 deadline in order to prevent the key-agreement hoarding problem. This involves considering the properties of the candidate algorithms, which can be divided into six categories. Each category has special implications for both the implementation characteristics and maturity of the algorithm’s security. The categories are:
A company such as Huawei has several options in how to deal with the problem of forward security of key exchange messages. It can immediately implement a promising post-quantum algorithm to replace Diffie- Hellman, but this introduces risks that the algorithm might be broken over the forthcoming years as the academic community scrutinizes the new range of quantum-safe algorithms. Alternatively, the company might choose to delay any action for several years, until the conclusion of standardization activity, in which case the problem of forward-security of key-exchange messages remains in the interim.
A third option is to implement a hybrid scheme that implements both Diffie-Hellman and a candidate quantum-safe key-exchange mechanism. This mitigates the risk significantly, since if realistic quantum computer is ultimately implemented, it cannot directly break the quantum-safe mechanism. On the other hand, if a problem with the quantum-safe mechanism is found in the interim, then the Diffie-Hellman algorithm affords some medium-term protection.
Ideally, the quantum-safe or hybrid key-exchange algorithm should drop directly into well-known protocols such as TLS or IPsec. In reality, quantum-safe algorithms are complex compared to legacy algorithms both in terms of difficulty of implementation, and in parameter characteristics (for example, large keys, or consumption of bandwidth). Careful study of the protocols and optimization of the algorithms will reduce the performance impact of using a hybrid-key exchange scheme.