Q‑Day Explained: How Quantum Computing Threatens Today’s Cryptography

Here's a disaster just waiting to happen, and it is going to happen. When someone finally opens the door, those plates are going to go everywhere all at once. It's not a question of if, but when. For you quantum nerds, this meme has been called Schroeder's Plates, and for the rest of you, plug that term into your favorite chat bot and learn why. As sure as those plates, are going crash, Q-Day is coming, and its going to wreck your defenses, except unlike the plates... Your crypto is going to break even if you do nothing, especially if you nothing. So what the heck is Q Day? Well, I'm glad you asked. Q Day is the day when quantum computers finally get strong enough to break all of our classical cryptography. And when that happens, your future self will be glad that you watched this video and took the necessary steps to prepare. Your future self, will also wonder what in the world were you thinking with some of those regrettable fashion choices? But that's a topic for another day. In this video, we're going to cover what is Q-Day, why you should care, and when it's going to happen. Then I'm going to blow your mind by explaining how you've effectively already been compromised by a quantum computer in the future and just don't know it yet. So stick around to the end for that. Your future self will thank you. As I said before, Q-day is the day when quantum computers finally get strong enough to the crypto. We use to keep our secrets secret. Let's explore what that means in a little more detail. So if I wanna have a message that only you can read or that only I can read, then I'll encrypt it. And I'll use what's known as a cipher. That's an algorithm that encrypts the information. And we have two different types of ciphers that I'll talk about here, symmetric and asymmetric. And the reason they're called that is with a symmetric cipher, I have one key. I encrypt with that key. I can only decrypt with that same key. An asymmetric cipher is different. There are two keys that are mathematically related and whatever is encrypted with one can only be decrypted with the other. That actually gives us some leverage. And there are cases where we're gonna use both of these. AES is the most common symmetric algorithm in use today. It stands for Advanced Encryption Standard. And this is what we use for bulk encryption. I've got a thousand bytes, a million bytes, whatever, a lot of data that I need to encrypt. This is relatively fast as compared to the asymmetric algorithms, which are a lot slower. And most common example over here on the asymmetric side is RSA. But even though it's slower, it solves some problems for us. It helps us do key distribution. So if I need to do the case where I pick a key that I'm going to encrypt something with and I need to communicate it with you, I could use an asymmetric way to distribute that key. More details on that in other videos. But this is also the basis for our public key infrastructure, PKI. It's where you hear the term digital certificates come in because that's a way of communicating what one of those two keys is in order to do some of these kinds of distributions. So all good and we use them in combination all the time. So these are very common. The problem is a sufficiently strong quantum computer using a thing called Grover's algorithm we'll be able to what is our traditional key strength, 128 bits. And by the way, with crypto keys, the longer the key, the more possibilities an attacker has to try. So the bigger the key the stronger it is. But Grovers will be able to break 128 bits with a sufficiently strong quantum system. So what we'll do in this case is double the key size to 256. The AES algorithm allows for either of those options. And we should be good to go according to the crypto experts, what they say. However, it's a different story on the asymmetric side. There's a thing called Shor's algorithm. And what Shor is able to do is obliterate these asymmetric algorithms. We can't just double the key size. It's still a problem. So we actually need new algorithms here, post quantum crypto algorithms, or sometimes called quantum safe cryptography, post quantum cryptography. We're going to have to implement these. A doubling of key size and a complete change out of the asymmetric algorithms in order to be ready for Q-Day. Okay, so that's what Q-day is, but why should you care? Well, if you've got a secret, and what might a secret be, well, maybe it's your personal health information or it's credit card numbers or it could be a lot of different things. It could be company secrets, intellectual property that you don't want just everyone having. If you encrypt that, it should remain secret. But if a sufficiently strong quantum computer can break that cryptography, then the secret isn't a secret anymore.

So that's one example. And imagine a world where there are no secrets, where all of your private information is now public. That would be a big problem. Another example of what would be broken with quantum systems if we don't fix this is that authentication. I won't be able to know if it's a good guy or a bad guy, if it you or someone claiming to be you, because our algorithms that do that also rely on cryptographic primitives. And then we look at digital signatures. So maybe you make a deal on a contract and you say, okay, I'm gonna buy 10 of these. And then someone later comes along after you've signed the contract and changes it to this. Now how do we know which was the actual terms that you agreed to? And we use cryptographic algorithms in order to determine if a document or a piece of data has been tampered with. We'll lose the ability to do that. So that would be a big compromise as well. So that's why you have to care. You'd live in a world without secrets. We wouldn't know who was who, and we wouldn't if what we'd agreed to. Was really even what we thought it was to begin with. Everything would constantly be changing under us. Here's the question everyone wants to know, when is Q-Day going to happen? And here's the unsatisfying answer. No one really knows. In fact, I'm gonna tell you, you're probably not gonna know once it's happened, because the people that do it, maybe a nation state, maybe a hacker collective, once they've done this, they're not gonna go tell the whole world, look what we just did, because if they do, they lose their advantage. They want to be able to read these secrets for as long as they possibly can without everyone knowing about it. So once it occurs, it will be some time most likely before we actually are aware. So just bear that in mind when you're thinking how much time you have to prepare. It could have already happened and you're just not aware of it yet. But most people are thinking it's five to 10 years from now at the time we're recording this. So no one really knows, but five to ten years. A lot of people then take a deep breath and say, okay, I can afford to wait. I'm gonna tell you why you can't. Governments and regulatory agencies around the world have basically looked at this problem as well. They know about all the questions that are involved here. And the general consensus is that in this sort of timeframe, 2030 to 2035 is when they're all saying, we need to deprecate. We need to get rid of these old crypto standards that we've been using. They've served us well. But nothing lasts forever, and these are not designed to last forever. But I'm gonna tell you, you don't actually have that much time. You don't have another five or 10 years to think about this, and here's why. The first one is the amount of time it will take to do the conversion. If you're gonna convert your existing crypto into these new algorithms, think about if you've got 4,000 instances of cryptography in your environment, and that is not uncommon for an organization to have. If you're able to convert one of those per day, then you're looking at more than 10 years before all of your environment is converted over to a totally quantum safe environment. That is too long. In other words, there's not enough runway for this plane to take off. You're going to get caught most likely with a lot of data that could be exposed. The second reason is cost. It's going to cost a lot if you wait till the last minute. Generally, that's how things work. If you need to do it fast, it's gonna be more expensive. The closer we get to Q day, the more expensive it's going to be to do the conversions. Why is that? Well, your people are busy. You're gonna have to take them off of certain projects and that's gonna cost you opportunity cost, or you hire consultants. Guess what everybody else is doing? They all procrastinated as well. And now they're trying to hire those same consultants to come in and do the work for them. And guess what those consultants will get to charge? Guess what they'll have to charge because there's just not enough of them out there if everyone's waited till the last minute. So the scarcity is gonna make the price of this go up dramatically. A third reason that you need to think about this now is basically the wild card factor that could happen. And we've already had two examples of this already where there was research that came out that said using an existing quantum computer with today's level of strength, not the future ones. And existing super computers or other classical computers using a combination of grovers and shores and some other things like that, we're going to be able to break our crypto. Now it turns out those two examples I'm thinking of didn't pan out, but the warning shot was fired. In other words, something could happen. Someone might make a research breakthrough tomorrow and suddenly realize we can break all of this stuff now.

And then It's not five to 10 years. Now it's everyone's gonna be paddling as fast as they possibly can. So be aware that this is one of those wildcards that could come in at any point. And the fourth one, and this is the one I think is really a kind of mind bending one to think about is Harvest Now Decrypt Later. In this scenario, if I make a copy of your data today and it's encrypted, I just have to sit on it and wait for the future to come to me. And once I have a computer, quantum computer that's strong enough, I'll be able to decrypt it in the later, in the future time. Now, in a sense, that attack already occurred in the past. It was already set up. The failure had already been locked in. In fact, if I copied your data last week or last year or 10 years ago, then eventually the future is now. And when that happens, the future will be able to decript that data. So that's why I'm making the argument that in fact, your data just like that china cabinet with the plates that are about to fall, it's already been set up for a disaster to occur, and now it's just a matter of when the door gets open whether you open it or not, the door will be opened so in a sense already the damage has been done we're just waiting for it to happen. There you see, the question is are you ready for Q-Day and if you're honest The answer, clearly, is no for almost all organizations. And now you can see why you can't afford to wait on the migration to post-quantum cryptography. It's too expensive, it'll take too long. There's too many risks involved. So you wanna get started on this now. If you do, your future self will thank you. Oh, and while you're at it, go ahead and toss that awful shirt. Your future self, will thank for that too.