What is quantum computing?
Most people understand that computers operate using 1s and 0s. Each 0 or 1 is a “bit.”
Going all the way down to the particle level, things behave differently. A particular value can be both a 0 and a 1 at the same time (called “superposition”). Those bits are replaced with quantum bits, called “qubits.”
Qubits sometimes behave like devoted sports fans at a game — you don’t need to know what each and every fan is doing, you can just focus on one, and that tells you about the entire group of fans (called “entanglement”). When Fan A jumps up and cheers, you can be sure the rest of that fan section will be doing the same and you’ll predict that the team likely did something good. Even fans in different locations, whether watching the game at home or across the country, will also jump up and cheer at the same time. A group of fan sections at the stadium can do the wave — called “interference” in quantum computing. Unfortunately, so far, these groups of qubits aren’t very stable, and so they collapse back to the “real world” — called “decoherence.” (The game is over and everyone goes back to their separate lives.)
Why Do Regulators and Insurers Care?
An example can help explain why regulators and insurers are asking about quantum computing readiness. Following is a sample of a check. Suppose for purposes of this example, you feed it into an ATM to deposit it into your account.
The ATM needs to solve the question: What is the amount? It starts by looking at the first character next to the dollar sign:
Is it a 0? No
Is it a 1? No
Is it a 2? Possibly
Is it a 3? No
Is it a 4? No
Is it a 5? No
Is it a 6? No
Is it a 7? Maybe
Is it an 8? No
Is it a 9? No
It asks these questions sequentially and knows that the choices are limited to 0-9. It then moves on to the second digit, asking the same questions.
At the end, the system will ask you to confirm that the amount you wish to deposit is $24.15 — is that correct?
Keep in mind that each field was limited to 0-9. If this was a password, it could also include letters and special characters, and could include capitals and lower-case entries. Suddenly, we’ve gone from 10 possible outcomes to about 75 for each field.
What quantum computing offers is the ability to send all possible outcomes at each field — that is “superposition” — all at the same time. Instead of getting precise answers, you would most likely get probability waves — your dedicated fans — “interference.” That third entry is likely a numeral 1 or a numeral 7 or the lower-case l or the vertical line |. Instead of 75 choices, you’re down to four — and you reached that result at blindingly fast speeds.
In other words, the encryption that financial institutions have relied on for decades is now at risk, because the threat actors will also have access to quantum computing. Authentication algorithms are also at risk.
Why is this important now?
Quantum computing isn’t stable yet. Many large companies are making test sites available and are heavily investing in it. For example, if you combine AI with quantum computing, consider the advances in the pharmaceutical field that could occur. No one knows whether quantum computing will be readily available in five years or 10 years — or there could be a breakthrough tomorrow.
In the meantime, however, some threat actors are taking a “harvest now, decrypt later” approach. They are stealing password files or authenticators even though they are encrypted in the hopes that quantum computing will make them simple to crack in the future. Keep that in mind the next time your financial institution, or one of your vendors, has a security incident.
In addition, your IT department will tell you that implementing a new encryption method is not a 5-minute exercise. It not only involves your own financial institution and most of its systems, but everyone — vendors and customers alike — who interacts with your financial institution and its systems.
What to do
The time to start working on this is now. NIST has already publicly provided some quantum-resistant algorithms. An experienced counsel can assist you with responses to regulators.