Quantum’s Coming Threat to Digital Security
Quantum computing research stretches back to the early 1980s, but the field's practical impact has remained mostly theoretical until recently. Unlike classical machines, quantum computers use quantum physics to process complex mathematical operations at speeds far beyond current capabilities. Milestones like Google’s 2019 announcement of a 53-qubit machine achieving “quantum supremacy” signal that the technology is moving from lab curiosity to industrial reality.
The implications for cryptography are severe. Most modern encryption relies on the difficulty of factoring large numbers—the basis of RSA, developed in 1976. Shor’s algorithm can exploit quantum computing to factor these numbers rapidly, meaning a quantum adversary could derive private keys from public ones. The result would expose secure communications across banking, IoT devices, and critical infrastructure.
Fragile Algorithms, Uncertain Timelines
It remains unclear exactly when a quantum computer powerful enough to break today’s standards will exist. Estimates range from a decade to fifteen years, but the hardware hurdles are significant. Qubits must be prepared from atomic-scale particles that are difficult to stabilize, which complicates running the long calculations cryptography requires. Until then, researchers are working on two fronts: improving quantum machines and shoring up encryption.
In practice, the vulnerabilities are not just forward-looking—they create a “harvest now, decrypt later” scenario. Adversaries can collect encrypted data today and wait for quantum capability to crack it, which highlights the urgency of migrating to resilient systems sooner rather than later.
Building Quantum-Resistant Standards
The National Institute of Standards and Technology (NIST) is leading efforts to identify new algorithms that hold up against Shor’s algorithm. The organization is testing candidate schemes for encryption and digital signatures, aiming to make recommendations between 2022 and 2024. Their strategy is to back multiple algorithms so that if one type (such as lattice-based systems) is found to be flawed, another remains secure.
Cloudflare has been actively testing these emerging algorithms. In a collaboration with Google, it ran a TLS Post-Quantum Experiment, implementing new key exchange mechanisms for all of its customers over a period of months. That exercise helped determine which algorithms are best suited for TLS. More recent research with the University of Waterloo and Radboud University will be presented at the Real World Crypto 2021 conference.
Integrating Post-Quantum Edge Services
On the implementation side, Cloudflare has contributed high-speed assembly versions of NIST finalist algorithms, including Kyber and Dilithium, as well as other post-quantum candidates, to its CIRCL cryptography library written in Go. The company’s goal is to deploy post-quantum cryptography for most internal services by the end of 2021, which aims to demonstrate that transitioning to these standards is viable in production environments.
The path forward is a coordinated effort between NIST, Microsoft, Cloudflare, and other players in the industry. While the arrival of powerful quantum computers is likely, the work being done now to implement and test solutions is key to ensuring the internet’s foundations are ready.
