Quantum computers are expected to create a quantum leap in computing power, but at the same time pose a threat to the encryption algorithms that protect today’s Internet. Here’s why quantum resistant cryptography (Post-Quantum Cryptography – PQC) has become a trend actively deployed by technology companies such as Google, Apple, Microsoft and Cloudflare.

So What is quantum resistant cryptographywhy is it important and should the average user care? Let’s find out.

What is quantum resistant cryptography?

Post-Quantum Cryptography (PQC) is a group of encryption algorithms designed to withstand attacks from both traditional and quantum computers.

Contrary to what many people think, cryptography is quantum resistant does not require a quantum computer to operate. These algorithms still run on computers, phones and servers today, but use mathematical problems that no quantum algorithm has been able to solve effectively to date.

Why do we need quantum resistant cryptography?

Currently, most secure connections on the Internet are based on algorithms such as RSA, ECC or Diffie-Hellman. They protect:

• HTTPS connection.
• Online banking.
• E-mail.
• VPN.
• SSH.
• Digital signature.

However, when quantum computers are powerful enough, algorithms Shor can analyze integers and solve discrete logarithm problems much faster than today’s computers. This makes RSA and ECC no longer secure enough.

How do current security methods work?

Every day, billions of users log into Facebook, Gmail, banks, e-wallets or online services without knowing there are many layers of security working behind them. Most of these technologies are based on modern cryptographic platforms such as RSA, ECC or AES.

Password – the first layer of protection

Passwords are still the most popular authentication method. When you enter a password, the server will not save it as text but convert it into a hash value using algorithms such as Argon2 or bcrypt. Even if the database is stolen, it is difficult for an attacker to recover the original password.

However, passwords still have many weaknesses such as being easily revealed, reused or tricked through fake websites (Phishing).

Two-factor authentication (2FA)

To increase security, many services require an additional verification step after entering the password. This is two-factor authentication (Two-Factor Authentication – 2FA).

Common forms of 2FA include:

• OTP code sent via SMS.
• OTP code generated from Google Authenticator or Microsoft Authenticator.
• Physical security key (Security Key).
• Confirmation notification on phone.

Even if hackers know the password, it’s still difficult for them to log in without a second authentication device.

Passkey – the trend of replacing passwords

In the last few years, Google, Apple and Microsoft have all pushed technology forward Passkey. Instead of remembering passwords, users just need to unlock the phone with fingerprint, Face ID or PIN code.

When creating a Passkey, the device will generate a key pair:

• The Private Key is securely stored on the device.
• The Public Key is sent to the server.

The private key never leaves the device, so even if the server is attacked, hackers can’t get the login information.

FIDO2 and WebAuthn

Passkey is built based on two standards: FIDO2 and WebAuthn. These are authentication protocols supported by most browsers and operating systems today.

They allow users to log in without a password but still ensure very high security.

Encryption when accessing the Internet

When accessing a website with an HTTPS lock icon, the browser and server will perform a key exchange process (Key Exchange) to create a secret session key.

After this process is completed, all data transmitted on the Internet will be encrypted using a symmetric algorithm such as AES-256 or ChaCha20. This makes it impossible for others to read the content even if the transmission is blocked.

Role of RSA and ECC

For many years, RSA and ECC have been the foundation of most security protocols on the Internet. They are used to:

• Exchange encryption keys.
• Authenticate HTTPS server.
• Digital signature.
• VPN.
• SSH.
• SSL/TLS certificate.

The strength of RSA and ECC is that they are very difficult to break with traditional computers. However, when quantum computers are powerful enough, the Shor algorithm can solve the underlying mathematical problems of RSA and ECC much faster. This is why the security community is gradually turning to quantum-resistant cryptographic algorithms.

The risk of “Collect today, decode tomorrow”

One of the biggest risks is strategic Harvest Now, Decrypt Later. Hackers can collect encrypted data today, store it for many years and wait until a quantum computer is powerful enough to decrypt it.

This is especially dangerous for:

• Government data.
• Medical records.
• Military documents.
• Financial information.
• Personal data needs to be kept for a long time.

Popular quantum-resistant cryptographic algorithms

Unlike RSA or ECC, post-quantum algorithms are based on many different mathematical problems.

1. Lattice-based Cryptography

This is the most highly appreciated development direction today. Algorithms like Kyber and Dilithium all belong to this group thanks to their good performance and resistance to quantum attacks.

2. Hash-based Signatures

Typical representatives are SPHINCS+. This algorithm is based on a cryptographic hash function so it is highly reliable but has a larger signature size.

3. Code-based Cryptography

Classic McEliece is a famous algorithm in this group. Although it has been around since 1978, there is still no effective attack method.

New NIST standards

After years of research, the US National Institute of Standards and Technology (NIST) has selected post-quantum algorithms as the new standard.

How have technology companies implemented it?

• Google testing quantum-resistant TLS on Chrome and Google Cloud.
• Apple Implements PQ3 protocol for iMessage.
• Microsoft integrate post-quantum algorithms into Windows and Azure.
• Cloudflare supports HTTPS connections using a quantum-resistant algorithm.

Do users need to worry?

The answer is Not yet. Currently, there is no quantum computer powerful enough to break RSA-2048 or ECC in practice.

However, the transition to quantum resistant cryptography happening now because upgrading Internet infrastructure can take years.

Conclude

Quantum-resistant cryptography is an important step forward to protect data against the development of quantum computers. Although this technology is still in the implementation phase, new standards have been issued and many large technology corporations are gradually applying it to their products.

In the future, security protocols such as HTTPS, VPN, SSH and digital signatures will gradually shift to using post-quantum algorithms to ensure data remains safe even as quantum computers become widespread.