Why Do We Need Post-Quantum Cryptography (PQC) Now?
Why Do We Need Post-Quantum Cryptography (PQC) Now?
Author: Niko Keskitalo, Product Manager
Most of us have likely heard of quantum computing, but did you know that while the technology promises incredible advancements, it also poses a threat to the encryption methods we rely on to protect sensitive data?
In this post, we’ll explore why post-quantum cryptography (PQC) is essential to safeguarding our digital future. You’ll learn how the cybersecurity community is addressing the threat of quantum computing, the role of innovative solutions in ensuring data security, and, most importantly, why organizations must act now to prepare for the quantum era.
The Era of Quantum-Safe Algorithms Begins
In today’s rapidly evolving digital landscape, protecting data is more critical than ever. With the rise of quantum computing, traditional cryptographic methods face unprecedented threat. Enter post-quantum cryptography—a field dedicated to developing systems resilient to the power of quantum computers.
The threat of quantum computing prompted concrete actions in the cybersecurity community nearly a decade ago. In 2016, the U.S. National Institute of Standards and Technology (NIST) announced a Call for Proposals to solicit, evaluate, and standardize one or more quantum-resistant public-key cryptographic algorithms.
Alongside the NIST initiative, also the Finnish academia, industry, and government organizations came together in a project called PQC Finland. The aim of the national project, funded by Business Finland’s Digital Trust program, was to develop, analyze and study quantum-safe algorithms and suitability to national security, products and practices. Industry leaders like Bittium and Insta contributed their expertise in quantum secure key exchange and authentication.
As a result of their initiative and after multiple evaluation rounds, NIST published standards for three quantum-safe algorithms in August 2024:
– ML-KEM (derived from CRYSTALS-Kyber) — a key encapsulation mechanism selected for general encryption, such as for accessing secured websites
– ML-DSA (derived from CRYSTALS-Dilithium) — a lattice-based algorithm chosen for general-purpose digital signature protocols
– SLH-DSA (derived from SPHINCS+) — a stateless hash-based digital signature scheme
With these new standards, industry can start offering solutions for PQC and user organizations can start their migration into quantum-safety.
Harvest Now, Decrypt Later
But why is it relevant now? Although quantum computers are not yet in use, unfriendly parties can already exploit a strategy called “harvest now, decrypt later”. This involves collecting encrypted data today with the intent of decrypting it in the future when quantum computers become viable.
This is particularly critical for nations handling data that remains highly sensitive for decades to come. By adopting PQC today, we can safeguard data, maintain trust in digital systems, and ensure a secure future.
Quantum-Safe Solutions Are Already Available
The “harvest now, decrypt later” threat is why Bittium participated in the PQC Finland project and why we have already implemented the standardized ML-KEM algorithm in our Bittium SafeMove® Mobile VPN and Bittium Secure Call™ products.
The IPsec SafeMove® Mobile VPN now uses a hybrid approach for encryption, combining a classical public-key algorithm with a quantum-safe algorithm. The advantage is that the security of the data is not compromised even if vulnerabilities are discovered in the quantum-safe algorithm, as the research of the algorithms and the development of quantum computers continue to advance. The quantum-safe SafeMove® Mobile VPN connection secures also such network traffic that has not yet been updated to be quantum-safe, such as TLS-encrypted e-mail traffic, which may take years to transition.
Secure Call has enhanced private session security as the PQC algorithm has taken its part in parallel to its existing cryptography. This means an attacker would need to break both the classical encryption and the quantum-safe algorithm to compromise the communication.
Planning the Transition
Echoing the National Cyber Security Centre Finland, we urge all organizations handling sensitive data to begin planning their transition to quantum-safe algorithms. By doing so, you ensure the resilience of your systems against the challenges posed by quantum computing. Quantum computing is on the horizon, and the future of security belongs to those who act now.
Niko Keskitalo, Product Manager at Bittium
Niko Keskitalo is an expert in mobile technologies. After earning a Master’s degree in 2019 from the University of Oulu, Niko joined Bittium and began his career as an engineer. He currently serves as the product manager for Bittium’s Secure Mobile Communications products. In his free time, Niko is an avid disc golf player and enjoys life as a new father.
