Security Bits — 27 April 2025 — Deep Dive into Quantum Computing

Deep Dive — Where are we with Quantum Computing

NosillaCastaway @milddemons asked the following in the Podfeet Slack:

“I am wondering if you know and can tell us what the security community is up to in regards to quantum computing breaking the encryption that we have now. I just thought about this as Microsoft has a quantum computing chip and I was just wondering the above.”

NosillaCastaway Calum B was quicker off the mark than me with a great reply pointing to NIST’s release of the first three post-quantum algorithms last summer. But milddemons insisted he’d love to hear myself & Allison discuss it in more detail, so here we go 🙂

TL;DR — Quantum computing is not going to destroy all cryptography, but when we figure it out, it will break the security of some of our current algorithms, including some of the most widely used ones. We’ve known this was coming for a long time, and we’ve been preparing for it very well. We already have quantum-safe algorithms that have been rigorously tested and approved by the relevant standards bodies, and a controlled transition is already well underway. We have what we need to secure our most critical systems today, and now it’s ‘just’ a matter of rolling it out everywhere it’s needed. There are likely to be bumps in the road, and there will inevitably be laggards, but there’s no reason to expect any kind of calamity.

Are Quantum Computers just Faster Computers? NO!

The single most important thing to understand when thinking about all this is that quantum computers are fundamentally different from the computers we use today. They don’t do the same things faster, they do completely different things. But, sometimes their ability to work so differently can break important assumptions that underpin our current cryptography.

I’m going to use the retronynm digital computer to refer to the kinds of computers we have on our wrists, in our pockets, and on our desks today. To explain the essence of why quantum computers are different, I need to start by explicitly describing what our digital electronic computers are actually doing at the fundamental level.

What Digital Computers Fundamentally Do

In a digital computer, absolutely all data is represented as a sequence of bits, that is to say, a sequence of 1s & 0s. Every single thing our digital computers do is accomplished by nothing more than sequences of Boolean operations applied to bits. Boolean operations are logical operations that work with true/false values (represented as 1 & 0 in computing) to produce new true/false values, e.g., AND, OR, and NOT. (Boolean is an eponym, named for its inventor, George Boole, who did his most important work at the University College Cork in Ireland.)

An important feature of digital computers is their inherent paralleliseability. We don’t actually apply single Boolean operations to single bits in sequence, we work with groups of bits, officially known as words. There’s nothing complicated going on here, though. To apply a Boolean operation to 8 bits of data, you just wire things up so you have 8 inputs going to 8 identical circuits wired up next to each other. Think of a circuit for processing a single bit as being like a single-lane back road, and the one for processing a word as being like a multi-lane highway. When you hear people talking about 32-bit architectures versus 64-bit architectures, they’re just talking about the word size for the architecture, i.e., the number of bits that get processed in parallel, which is now 64 on most of our processors. Put a mental pin in the fact that parallelisation is easy with digital computers, it’ll be important later 🙂

So, the illusion of complexity comes purely from scale! We literally have billions of groups of 64 bits being altered billions of times a second in even our smallest computers, like smart watches! (Seriously, giga means a billion, and modern smart watches. Even watches have 64-bit processors that run at a few gigahertz and can store a few gigabytes of data!)

Just how much of an illusion the apparent complexity of our computers really is catches most non-computer scientists by surprise — each bit has exactly one of two possible values at all times, and there are just four fundamental Boolean operations (NOT, AND, OR, and exclusive XOR)! If you negate the outputs from AND and OR by placing them in series with a NOT, you get two more less fundamental operations that you might see mentioned in articles: NAND and NOR.

But, at the physical level of electronics, things actually get even simpler! The easiest operator to implement with silicon semiconductors happens to be NAND (using a circuit called a NAND gate), and it’s possible to implement every Boolean operation by chaining together a few NAND gates. So, because NAND gates are the easiest to manufacture, and because they can implement all possible Boolean operations, many of our silicon chips use NAND gates for just about everything! You really can think of a modern silicon chip as just an intricately wired collection of NAND gates! Again, the complexity just comes from the scale.

Something else I’d like you to put a mental pin in is that Boolean logic is determinative. This means that our digital computers are deterministic, so if you take the same two 64-bit numbers and XOR them together, you will always get the same result. Always!

So, What Do Quantum Computers Do?

Quantum computers don’t use bits, and they don’t implement Boolean logic. Instead, quantum computers use qubits and apply quantum mechanical operations to those qubits (qubit is pronounced ‘Q-bit’ BTW). Qubits don’t encode specific values like bits do; they encode the probability distributions of two-value quantum-mechanical systems. Not 1 or 0, but the probability of a 1 or a 0. Qubits are usually implemented using single particles with a quantum property like spin, which can be up or down. Quantum operations take a collection of probabilities as their inputs and produce a new collection of probabilities as their outputs. This means that quantum computers are fundamentally probabilistic, which means they are not deterministic. Quantum computers are incapable of providing exact answers to anything! It’s probabilities all the way down!

Just like you can only encode a single Boolean value in a single bit, you can only encode a single probability in a single qubit, so to work with more complex data, you need more qubits. But, unlike with bits, you can’t easily parallelise qubits — you need to do something much more tricky instead — you need to quantum entangle your qubits.

Quantum computers are like anti-Schrödinger’s Cats — they can only compute while the proverbial box is closed. In other words, quantum computers can only function while their qubits are in that weird quantum superposition state that causes the hypothetical cat in the famous thought experiment to be simultaneously dead and alive. The moment you open the proverbial box or collapse the superposition (the quantum mechanics term for being in multiple states at once), the quantum computer stops being a quantum computer.

The reason we can’t just build a 64-qubit quantum computer today is that we haven’t figured out how to reliably entangle 64 qubits and then keep them in a sustained quantum superposition for a useful length of time.

But What Could Quantum Computers do if we Could Build them?

The most important thing to take away from all this is that when we build practical quantum computers, we’re not going to use them to replace digital computers, because they don’t do the Boolean logic we need day-to-day. Their strengths lie elsewhere, especially in modelling quantum systems. Using digital computers to do things that obey the laws of classical physics, and even abstract deterministic systems, works great.

But using digital computers to model quantum mechanical systems or probabilistic systems in general doesn’t work so well. Quantum computers will do much better for those kinds of applications. As best as I can make out, the use cases for these kinds of computers will primarily be in universities, research and development facilities, high-end engineering labs, and cutting-edge medical facilities. We may find uses for them elsewhere, but I just can’t see them becoming more prevalent than high-end work stations like MacPros are today, and I don’t think they’d be of any use to us on our wrists, in our pockets, or on our desks!

What About Cybersecurity? Why all the Hubbub?

It turns out that one of the things we know quantum computers could do is factor large numbers really quickly. How do we know that? Because we have the algorithm worked out already — it’s called Shor’s Algorithm. With digital computers, factoring large numbers is really hard, but when we get practical quantum computers, we’ll be able to do it billions of times faster than we can now.

Why is being able to factor numbers quickly a problem? Well, some of our current cryptography is built on the assumption that it’s easy to multiply two big prime numbers together, but really difficult to go the other way, to start with a big number and figure out which two primes were multiplied together to produce it. Quantum computers will break that assumption, and hence, render those specific cryptographic algorithms useless!

So, now that we understand what digital electronic computers can do, and what quantum computers will be able to do, we need to restrict our cryptographic algorithms to the sub-set of mathematical operations that are easy for digital computers to do in one direction, but effectively impossible for both digital and quantum computers to reverse.

As of last year, we have an audited and certified set of such algorithms — the FIPS 203 standard from NIST, the American National Institute of Standards & Technologies.

Not only do we have the algorithms already, but their rollout has started:

So, while it is true that computer scientists are making some good progress towards building practical quantum computers, with a new approach being pioneered by Microsoft making news recently, the cybersecurity community has been busy too. As an industry, we’re actually making good progress on a well-thought-out path towards a world that does not rely on the kinds of cryptography that quantum computers will obsolete.

Even if our estimates of the timelines involved as wildly wrong, we now have the algorithms we need, so we actually could scramble and get our most critical systems upgraded very quickly indeed. Obviously, we’re all hoping there will be no need to panic like that, but it’s comforting to know that since last summer, we could if we had to. Realistically, we’re on a good course to get the most important stuff done in time for the more realistic estimates of when practical quantum computers are likely to arrive.

❗ Action Alerts

ASUS Confirms Critical Flaw in AiCloud Routers; Users Urged to Update Firmware — thehackernews.com/…

Worthy Warnings

Google Creators and Organisation Admins Beware: Google phishing scam e-mail deploys diabolical deceptions — www.intego.com/…
- Google are working to fix the weakness in their system that made it possible for the malicious emails to get wrongly digitally signed by Google, so similar attacks will get a little less convincing in the future, but only a little
- Takeaway: When a service offers user-created content on a subdomain (like sites.google.com in this case), anyone can post content there, so the organisation itself will never use that subdomain for legitimate communications. (Not always easy advice to follow as it means understanding the full suite of services offered by the company whose services you’re using, but the time you need to invest to stay safe 🙁)
- 🎩 Hat-tip to Nosillacastaway George from Tulsa, who was one of a few people who drew my attention to this story because they were exactly the kinds of people being targeted, and most of those people reached out because they were unsettled by the fact that they realise they could easily have fallen prey to this 😰
🇺🇸 Blue Shield of California leaked health data of 4.7 million members to Google — www.bleepingcomputer.com/…
- An unusual data breach, no malicious actors involved, just poorly configured analytics
- No payment details or government identifiers leaked
- It did include Blue Shield Identifiers, so spear phishing is a possibility
- Did include a lot of potentially sensitive health information 🙁
- Most likely outcome is really darn spooky ads that know just what medical condition you’re dealing with
- Based on the article, it appears affected users have not been notified!

Notable News

A New Form of Verification on Bluesky — 📣 BlueSky PR
- Domain validation remains the best option for regular folk (i.e., have your website as your username, like I do, you’ll find me on Bluesky as @bartb.ie)
- Bluesky will do centralised validation of noteworthy accounts (like Twitter used to do)
- Also adding an interesting extra layer to make it more sustainable and decentralised — trusted verifiers
- Verified organisations can verify their own users, and that chain of trust will be displayed in the verified user’s profile (Very clever! 👍)
WhatsApp’s new Advanced Chat Privacy protects sensitive messages — www.bleepingcomputer.com/…
- Don’t put too much faith into these kinds of things — nothing here stops the analogue hole (grabbing a photo of the screen)
- Still a nice-to-have though
🇺🇸 A timely reminder of why it’s important to remain vigilant: FBI: US lost record $16.6 billion to cybercrime in 2024 — www.bleepingcomputer.com/…

Excellent Explainers

🎧 An excellent 40-minute explainer on how Generative AI actually works and what we might expect in the future: Big Technology Podcast: Generative AI 101; Tokens, Pre-training, Fine-tuning, and Reasoning with Dylan Patel — overcast.fm/…

Interesting Insights

Two sponsored posts well worth a read (first 80% give excellent insight, last 20% is the sales pitch, so you can stop reading there 🙂):
- A good high-level overview of one of the important cogs in the cybercrime economic machinery: Initial Access Brokers Shift Tactics, Selling More for Less — thehackernews.com/…
- Phishing detection is broken: Why most attacks feel like a zero day — www.bleepingcomputer.com/…

Palate Cleansers

From Bart: some CSS humour for the PBS community 🙂 — phpc.social/…
From Allison: Professor explains how quantum mechanics isn’t intuitive and no one (even Richard Feynman) understands it: www.linkedin.com/…

Legend

When the textual description of a link is part of the link, it is the title of the page being linked to, when the text describing a link is not part of the link, it is a description written by Bart.

Emoji	Meaning
🎧	A link to audio content, probably a podcast.
❗	A call to action.
flag	The story is particularly relevant to people living in a specific country, or, the organisation the story is about is affiliated with the government of a specific country.
📊	A link to graphical content, probably a chart, graph, or diagram.
🧯	A story that has been over-hyped in the media, or, “no need to light your hair on fire” 🙂
💵	A link to an article behind a paywall.
📌	A pinned story, i.e. one to keep an eye on that’s likely to develop into something significant in the future.
🎩	A *tip of the hat* to thank a member of the community for bringing the story to our attention.
🎦	A link to video content.