Quantum computing is safe and effective – there’s no risk of a Hal-like takeover.

There is a race among companies to achieve supremacy in quantum technology because it will drastically reduce computing time from years to hours or even minutes. The power of quantum computing will be a boon for data-intensive industries such as pharmaceuticals, artificial intelligence, industrial design, logistics, and national security [31]. However, it raises serious threats to the cybersecurity of classical computing devices. Theoretically, all cryptography algorithms are vulnerable to quantum attacks. Q-Day is when quantum computers will break the Internet [4]. Given the ubiquity of cryptographic schemes in our everyday online activities, this could be catastrophic. Computer scientists are predicting how quantum computers can cause havoc with encryption, resulting in a global catastrophe [32].

With Google’s declaration of quantum supremacy in 2019, claiming that they solved a problem in three minutes that would take a classical computer over a thousand years, quantum computing is no longer a hypothetical idea [33]. Nevertheless, the millions of qubits of computing power required to break modern cryptography remains a challenging goal. Practical quantum computers with millions of qubit capacity will be able to break nearly all modern public-key cryptographic systems. Before quantum computers arrive with sufficient qubits, we must be ready with quantum-safe cryptographic algorithms, tools, techniques, and deployment strategies to protect the classical ICT infrastructure.

5.1. Potential Quantum Computing Business Model

It is estimated that breaking the classical encryption will require 317 million qubits [34]. Today, each qubit costs around USD 10,000 a piece [35]. Even if the qubit price comes down a hundredfold, an encryption-breaking quantum computer will cost hundreds of millions apiece. Due to the very high costs and the race to protect trade secrets, the expected business model for quantum computing is likely to resemble the current model for cloud-based computing dominated by Amazon/AWS (33%) [36]. This essentially means that, unlike a standard computer that almost anyone can own, ordinary citizens or, for that matter, hackers cannot afford a quantum computer. They will have to rely on the quantum computing service providers (QCSPs) for leasing quantum computing resources to design and execute their quantum malware to launch a quantum attack on any victim computing device remotely. The astronomical cost of quantum computers rules out the possibility of an encryption-breaking personal desktop version anytime in the future and, in fact, comes as a blessing in disguise. The QCSP business model makes the job of standard-regulating authorities such as the NIST in the US and ENISA, its equivalent in Europe, a lot easier. Building standards to regulate cloud service providers is much easier than regulating a desktop hacker. These standardizing and policy-making agencies are currently focusing exclusively on PQC (post-quantum cryptography) to withstand the decryption capabilities of powerful quantum computers. Although we have seen over 90% of the candidate PQC algorithms that the NIST reviewed over the past 5 years fail [20,21], even if none of the candidate PQC algorithms succeed, these agencies can draft technical standards for operating QCSPs and let government regulatory agencies implement those standards as rules for availing quantum computing services. However, in the given circumstances, it is worth looking beyond PQC for safeguarding classical computers from future quantum hackers.

5.2. Securing Quantum Computing Service Provider (QCSP) Network

As illustrated in Figure 7, a typical QCSP provides its cloud-based quantum computing services to its subscribers in a business model that is quite similar to any cloud computing service provider of today. As a term of service, the subscribers are provided with a 3SoC client for accessing the quantum computing services of the QCSP. The QCSP routes access to the quantum computer through a 3SoC server that only accepts authentication requests from a 3SoC client device. All other requests from non-subscribers or hackers with legacy computing devices are declined. Thus, a 3SoC intranet can potentially offer defense against misuse of quantum computing by bad actors even if the PQC algorithms fail to deliver the promise.