Digital Sovereignty & Cyber Security

A few weeks ago I was on a blockchain panel, organised by the World Economic Forum, discussing amongst many things use of blockchains as a digital identity store, when someone from the audience asked me about the implications of quantum computing on confidentiality of data stored on blockchains.

My answer was somewhat under par. Indeed, quantum computing will break many existing cryptographic algorithms - making today's secret data public, but with quantum computing comes quantum cryptography, or more precisely quantum key distribution, which is immune to quantum computing attacks.

After the panel was over, the lady who asked me that question came over, thanked me for being on the panel, and asked a follow up question - what would happen to all that data encrypted with quantum un-safe algorithms already stored on blockchain?

A big thank you to her for being so polite and not embarrassing me on the panel because I suspect the answer was obvious to her, and yet it's implications escaped me. Data already stored on blockchain with current quantum un-safe algorithms will become public, even if all data encrypted with quantum  safe techniques will be kept secure going forwards.

Cryptography relies on scrambling data using a very long secret random number, and the only way to unscramble that data is by knowing that secret. There are no mathematical tricks to shortcut the working out of that number, so the only way to un-scramble the data is to guess, in a brute force fashion, the secret number - impractical using today's computers, as secret number range is so big that that it takes almost an infinite amount of time to guess it.

However, how do you safely share that secret safely over a public network? To solve this problem, public key cryptography was invented. You create two keys, public and private, which are mathematically linked - any data encrypted with a private key can only be decrypted with public key and vice versa.

If you keep the private key safe, and send out your public key, then people can send you confidential messages by encrypting data with your public key, safe in the knowledge that only you, as the sole keeper of the private key, can read that message i.e. no need to secretly pre-share a key over some private transfer method that reduces the risk of eavesdropping.

However, this link between private and public key introduces a tiny vulnerability - there is now a mathematical shortcut that allows you guess the linked private key much more quickly that when trying to guess a random secret key. 

Using today's computers though it still takes almost an infinite amount of time to guess the private key, even with the shortcut. However, quantum computing relies on many different states of quantum particles to perform millions of calculations all at once, allowing you to guess the private key in short enough time compared to today, breaking confidentiality. On the hand, even with quantum computers, it is still likely to take unpractically long time to guess a shared secret key, as there is no public key to exploit.

Lucky for us, quantum key distribution, an implementation of quantum cryptography, uses the same very principles that allows super fast calculations to break today's popular public-key cryptography algorithms for a different purpose - you can do away in some cases with public and private keys and simply share quantum-safe secret keys over public networks without a possibility of interception, as it is impossible to copy quantum encoded data and any eavesdropping changes the state of data, making intrusion highly detectable. This may go some way to mitigating against quantum attacks.