It’s time to invest in innovation… and governments, start-ups, and major industry need to align all their force vectors in the same direction.

The time to invest in the innovations needed to build and protect the next generation of our communication systems is now. Quantum computers might still be a number of years away, but we need to prepare now in order to be ready. Especially given the advancements at Google, IBM, DWave, and others that are rapidly shrinking our time window to upgrade.

Many governments mostly understand this, recently the US launched its Strategic Vision for America’s Quantum Networks. Kickstarting most of this, the UK launched the National Quantum Hubs and specifically the Quantum Communications Hub back in 2013. The EU launched their Quantum Flagship programme in 2018 with 4 of the 20 projects directly working on secure quantum communications and a further 3 supporting it. And now many individual nations also have a strategy, from Quantum Industry Canada to France’s recently unveiled Quantum Strategy. Perhaps the most precocious of all is China, spurred on by a $10B (yes with a B!) investment in building the National Laboratory for Quantum Information, it’s flying quantum satellites and recently set the record for entangling two quantum memories separated by more than 50 km of optical fibre.

So, what’s the challenge then? Well, while many, many people understand this statement, given how long it will take to replace and roll out significant swaths of new infrastructure, many others don’t. I used the word “mostly” above because with their right hand many governments are spurring on innovation with grants and quantum strategies while with their left hand they are often inadvertently putting the brakes on innovation.

Many national security agencies have made a public pronouncement that quantum encryption is not yet ready for scalable, widespread adoption. And they’re right! There’s a lot that we don’t know around implementation questions, such as:

• distance limitations,
• the best protocol/technique to use in a particular situation,
• software and hardware interfaces,
• how to ensure backwards compatibility with legacy systems,
• knock-on effect of increased latencies,
• what other pieces are needed in a real, full solution,
• and required form-factors;

and commercial questions, such as:

• costs and time to upgrade,
• cost targets to make it commercially viable,
• and standards and certification.

But the same is also true of post-quantum (PQ) algorithms and other solutions. This is why many of the speakers at the recent ETSI/IQC Quantum Safe Cryptography Workshop 2019 paid a lot of attention to getting a handle on the unknowns of post-quantum algorithms in first use cases. From Cisco studying the consequences of using PQ algorithms in secure bootloading, image signing, and signatures in TLS 1.3 to Cloudflare and Google testing out the effects of integrating PQ algorithms into our web browsers. There are similar implementation questions to ask, such as:

• the best algorithm to use in a particular situation,
• software and hardware interfaces,
• how to ensure backwards compatibility with legacy systems,
• knock-on effect of increased latencies,
• what other pieces are needed in a real, full solution,
• and required form-factors (pure software or hardware accelerated);

and also commercial questions, like:

• costs and time to upgrade,
• cost targets and revenue models to make it commercially viable and attractive to upgrade,
• and standards and certification.

Selective wording in many of these national security pronouncements singles quantum encryption out, but the truth is no successor to our current encryption is yet ready to replace it. And while it’s not ready for widespread adoption it absolutely does need widespread experimentation and innovation – both quantum hardware and post-quantum software. Especially quantum hardware and post-quantum software together, since real solutions in the real world are going to be messy, complex, and almost certainly comprise the two.

In one low-level security scenario, maybe consumer shopping or content providers, you might use a PQ algorithm seeded with entropy provided by a quantum random number generator (QRNG) to establish a link and secure your data. In another mid-level security scenario, maybe non-critical infrastructure or consumer data in telecoms networks, you might use a PQ algorithm to get a new datalink going before passing it off to quantum key distribution (QKD) hardware to rekey AES encryption which will allow high-volume secure traffic. And in a high-security scenario, maybe securing a telecoms network’s control plane or top-secret government communications, you might go the whole nine yards with pre-shared secrets, QKD, and the one-time pad for each message. Or perhaps you’d immediately rekey a newly flown satellite, whose encryption keys have been sitting vulnerable in the lab and on the launchpad for months, with QKD before passing day-to-day communication security back to PQ algorithms.

All that these national security pronouncements require is a slight modification to their lead-in introduction that states “While post-quantum and quantum encryption are not yet ready for widespread adoption, the time is now for governments, start-ups, and major industry to start experimenting with the technologies in trials and proof-of-concepts.”

Because the time for companies to invest in a quantum-safe communications strategy is now. And make no mistake, it will take some investment. But there are some great vehicles in government grants at the moment to help, from the UK’s Industrial Strategy Challenge Fund Quantum Technology grants to new ones expected in the US, EU, and globally. And don’t forget, interacting with quantum-safe start-ups through early paid projects is precisely the industry and government buy-in and engagement that investors are waiting to see in order to add their resources to help solve the problem. With it, start-ups will be able to unlock and raise significant investment to build the solutions that otherwise your company would have to foot the full bill for.

All companies need to start examining and taking stock of their current secure communications infrastructure and systems to identify weak points. And they need to start developing how they will address those by investing in small innovation projects which allow them to play with the new quantum-safe technologies of post-quantum and quantum encryption. KETS and many other quantum-safe companies would love to help. So don’t wait, get in touch. Start proactively playing with the new technologies in safe sandboxes, start protecting your assets for the quantum future. The time to invest in the innovations needed to build and protect the next generation of our communication systems is now. Remember, it takes a village… and helps a lot if everyone’s pulling in the same direction.

Chris Erven, March 2020