For the time being, since the technology for quantum computers is still in the research and development stages, the threat remains largely theoretical, Szabolcs Kun, co-founder and CEO of Arenim Technologies, tells the Budapest Business Journal in an interview.
However, the mere promise of what is heralded to be the vastly expanded capacity of these revolutionary computers has communications security experts frantically looking for solutions.
“The whole security world is emphasizing this threat right now because, when quantum computers [become] available, they will enable [nefarious] actors to decrypt or break the encrypted communications which today provide protection for their users. I would say this will immediately cause chaos,” says Kun.
KPMG, the global corporate services firm, agrees. In a report this year citing a survey of businesses in North America, it found most were “extremely concerned” about quantum computing’s potential to break through their data encryption.
“Sixty percent of respondents in Canada and 73% in the U.S. believe ‘it’s only a matter of time’ before cyber criminals are using the power of quantum to decrypt and disrupt today’s cyber security protocols,” the report states.
Arenim Technologies’ answer to this challenge is an application dubbed KvantPhone. Described as a “post-quantum secure communications system,” it builds upon the company’s earlier “Crypttalk” encrypted communications system launched a decade ago.
From the start of KvantPhone’s development, Arenim has been carefully following the recommendations made by the U.S. National Institute of Standards and Technology (Nist), which is leading the global fight for cyber security.
As soon as Nist had reduced the number of recommended “post-quantum cryptographic” algorithms for communication security, the Arenim team set about designing the quantum-resilient KvantPhone system in detail. For this, they focused on the “key exchange,” which takes place at the very beginning of any encrypted telephonic communication.
“All industry experts see the risk as this key exchange mechanism that happens before we set up the [encrypted] channel. This could in future be deciphered by quantum computers,” says Attila Megyeri, chief technical officer and co-founder of Arenim Technologies.
To achieve this, the designers married the Kyber-1024 key encapsulation method, one of the latest algorithms recommended by Nist, with the older, “classical” Diffie-Hellman procedure (already in use in Crypttalk) to vastly raise the protection capabilities of the key exchange from any illicit penetration, even if using a quantum computer.
“There were many challenges with these new algorithms, on both security and network level, but our experts did a great job, with a hybrid crypto suite that offers extraordinary protection for threats on both post-quantum and legacy attack scenarios,” Megyeri argues.
Indeed, while acknowledging that some industry players have made progress in post-quantum cryptography solutions (for example, Apple has announced the introduction of post-quantum algorithms into its i-message application), Megyeri believes KvantPhone is the world’s first “fully fledged PQC communication solution.”
“To our best knowledge, we are the only solution providing comprehensive quantum-resilient algorithms; that is, not only chat but voice as well. Besides, we target business customers, where monitoring, administration, integration, [and] on-site deployment is important,” he says.
Arenim Technologies commissioned Silent Signal (SS), a Hungarian IT security company (otherwise known as an “ethical hacker”), to assess the integrity of KvantPhone in April this year. In a summary of the report, seen by the BBJ, SS concluded: “During the security assessment, Silent Signal LLC’s experts haven’t exposed any security vulnerabilities.”
“Silent Signal failed to respond to a BBJ emailed request for further comment on KvantPhone.
Arenim has used a “softly, softly” approach to the initial launch of its latest product, apart from encouraging current users of Crypttalk (mostly telecommunications providers who use the application as a “white label” product under their own brand names) to upgrade to KvantPhone, which comes at the same price as the earlier application.
While admitting the potential market is “huge,” Kun says the cyber security sector “is a pretty conservative business,” meaning clients tread very warily and only take up new products after extensive examination and testing. Perhaps as a result, he is coy about the results so far.
“We haven’t started the [mandatory] migration of CryptTalk users to KvantPhone, so exact results cannot be defined now, but a portion of new subscriptions is already KvantPhone. We are receiving several requests daily regarding the new technology, and the quantum-secure user base is building up,” he says.
Quantum computers represent the next revolution in computing: they are “designed to use quantum physics for computing, which introduces unprecedented capabilities over traditional computation methods,” KPMG wrote in a report earlier this year.
Naturally, as in earlier chapters in the computing story, this new tool can do much good, having the power to transform everything from drug research to manufacturing to autonomous vehicle navigation. However, criminal organizations, and even sovereign states, will inevitably attempt to utilize the new technology for nefarious purposes.
“Encryption is everywhere. As an immediate step, organizations need to understand their risk from the use of public key cryptography and how they value data in their environment. This will impact multiple systems and applications that are fundamental to business operation,” the report wrote, citing Michael Egan, quantum director for KPMG Australia.
One section of this year’s KPMG report asks rhetorically: “When should companies implement quantum risk management?” The response? “The answer is now.”
But since quantum computers are not, thus far, readily available, it begs the question: Why the rush? As a general answer, a vast amount of work is needed to protect all the potentially liable systems and data.
However, the report also highlights “bad actors” employing a “harvest-now, decrypt-later” approach. In other words, adversaries steal encrypted files today and store them until more advanced quantum computers emerge, whereupon they will be decrypted for potential sale. Arenim’s Szabolcs Kun argues that this is precisely the reason for deploying KvantPhone today.
“Just imagine that you are running an embassy somewhere in a hostile environment, and you have an internet connection in that building. As soon as data packets on that wire leave the building, immediately, on the first telephone device, those data packets can be caught, copied and stored. Later on, with quantum computers, these can be decrypted. And you know nothing at all about it,” he says.
With this in mind, clearly, such government files, and indeed any data with long-term value, from health records to banking data, are already of great interest to shady organizations who hope to exploit them later.
In the words of KPMG: “The level of preparation that organizations do today is expected to be critical to limiting exposure and vulnerability to emerging threats, making quantum risk planning a priority.”
This article was first published in the Budapest Business Journal print issue of September 6, 2024.
Producing journalism that is worthy of the name is a costly business. For over 30 years, the publishers, editors and reporters of the Budapest Business Journal have striven to bring you business news that works, information that you can trust, that is factual, accurate and presented without fear or favor.Newspaper organizations across the globe have struggled to find a business model that allows them to continue to excel, without compromising their ability to perform. Most recently, some have experimented with the idea of involving their most important stakeholders, their readers.
We would like to offer that same opportunity to our readers. We would like to invite you to help us deliver the quality business journalism you require. Hit our Support the BBJ button and you can choose the how much and how often you send us your contributions.
