Quantifying quantum risk: a measure of crypto agility
量化量子风险:加密敏捷性的一种度量
Coryan Wilson-Shah
AI总结 本文提出旋转时间作为加密敏捷性的度量,通过历史CVE数据推导出旋转时间容忍度与安全风险容忍度的近似关系,发现旋转时间容忍度在数小时到数天量级,表明加密敏捷性与混合加密结合是设计量子弹性系统的有效方法。
详情
由于量子计算机能够实现新的密码分析形式,它们对广泛用于保护当代计算机系统的加密算法构成威胁。实用量子计算机可能在未来十年左右出现,但由于理论上的“先收获,后解密”式攻击者行为,今天就需要采取缓解措施。密码学和安全架构的最新进展显示出支持设计能够抵御量子密码分析的系统的潜力,但在文献中关于推导此类系统的容限方面存在关键空白。在本文中,我们引入了旋转时间的概念作为加密敏捷性的一种度量,并推导出将旋转时间容限与安全风险容限联系起来的近似值。使用历史CVE数据计算旋转时间容限的示例值,发现其量级为数小时到数天。这表明,将加密敏捷性与混合加密结合使用是设计量子弹性系统的有效方法,但可能需要具有挑战性的技术和操作容限以满足组织的风险容限。
Because of their ability to enable new forms of cryptanalysis, quantum computers pose a threat to the cryptographic algorithms that are widely used to secure contemporary computer systems. A practical quantum computer may emerge within the next ten years or so, but due to theorised "harvest now, decrypt later" style attacker behaviour, mitigations are necessary today. Recent advances in cryptography and security architecture show promise in supporting the design of systems that exhibit resilience against quantum-enabled cryptanalysis, however there is a key gap in the literature around the subject of deriving tolerances for such systems. In this paper, we introduce the concept of rotation time as a measure of crypto agility, and derive an approximation that links rotation time tolerance to security risk tolerance. Historical CVE data is used to calculate illustrative values for rotation time tolerance, which is found to be of the order of hours to days. This demonstrates that using crypto agility in conjunction with hybrid encryption is an effective approach for designing quantum-resilient systems, but may necessitate challenging technical and operational tolerances in order to meet organisational risk tolerances.