How the Financial Sector Can Anticipate the Threats of Quantum Computing to Keep Payments Safe and Secure
Total Page:16
File Type:pdf, Size:1020Kb
Journal of Payments Strategy & Systems Volume 14 Number 2 How the financial sector can anticipate the threats of quantum computing to keep payments safe and secure Received (in revised form): 29th April, 2020 Oscar Covers* Senior Information Risk Consultant and Cybersecurity Analyst, Dutch Payments Association, The Netherlands Oscar Covers Marco Doeland** Manager Risk Management, Dutch Payments Association, The Netherlands Oscar Covers is Senior Information Risk ABSTRACT Consultant and Cybersecurity Analyst at the At the end of 2015, the Dutch General Intelli- Dutch Payments Association. He analyses gence and Security Service informed owners and ICT-related security risks for the Financial managers of vital infrastructure in the Nether- Institutes — Information Sharing and Anal- lands about the developments and threats ema- ysis Centre and, where necessary, coordi- nating from the advent of quantum computing. Marco Doeland nates the response. He chairs the European Dutch financial institutions have since started Cards Payments Association Security Working to monitor developments in quantum computing Group and participates in the working group and are seeking to understand the implications that maintains the international requirements for their interbank business processes. This paper for payment terminals. He is also a member looks at how banks and payment institutions of the board of advisors that advises the pay- can anticipate how quantum computing will ment card industry on issuing and maintaining evolve and respond accordingly, even though the international security standards used by developments remain ongoing. To gain and American Express, Discover, JCB, Mastercard maintain a good understanding, the Dutch and Visa. Payments Association brings together quantum computing experts and experts from financial Marco Doeland is Manager Risk Management institutions to discuss the impact of quantum at the Dutch Payments Association and the computing advancements on the industry. The Chief Information Security Officer of Currence. key deliverable is to offer an approach to deal- He is responsible for managing the shared ing with the threats associated with quantum computing, so that payment systems can continue Dutch Payments Association, interests with respect to the security and cyber PO Box 83073, security of the Dutch payment infrastruc- securely and undisturbed. As this paper will 1080AB tures, including online, cards, mobile, iDEAL discuss, this has resulted in a quantum Amsterdam, The Netherlands and iDIN. He is also Chairman of the Secu- readiness programme and seven so-called low- *E-mail: o.covers@ rity Task Force at the Dutch National Forum regret moves. betaalvereniging.nl on the Payment System and Chairman of the **E-mail: m.doeland@ Interbank Security Task Force. In addition, he betaalvereniging.nl is a member of the Dutch Financial Institutes Keywords: quantum computing, Journal of Payments Strategy & — Information Sharing and Analysis Centre post quantum cryptography, finan- Systems Vol. 14, No. 2 2020, pp. 147–156 (FI-ISAC), the European EU FI-ISAC and the cial sector, banks, cyber security, © Henry Stewart Publications, global FS-ISAC. payments 1750-1806 Page 147 Anticipating the threats of quantum computing to keep payments safe and secure INTRODUCTION as a superposition of all possible states, so the Research into quantum computing is evolv- computation is performed on multiple states ing quickly.1,2 Quantum simulation and simultaneously; this is known as quantum quantum machine-learning algorithms can parallelism. Secondly, the input is pro- help find new medicines, elucidate reac- cessed using a series of quantum gates that tion mechanisms in complex chemical can create and process superposition states. systems, making it possible to mimic chem- A quantum gate is like a logical gate — a ical processes found in nature that are more basic operating circuit performing a logical efficient than the processes currently used in operation based on a small number of qubits the chemical industry, and so on. In short, leading to a result. Beside the gate opera- quantum technologies are expected to have tions, measuring the state of a qubits is also a profound impact on many of the world’s one of its functions. Measurements are often largest markets. an indispensable aid in the calculation phase. One area where quantum technologies Finally, a measurement is made of the qubits. pose a particular threat, however, is cryp- However, if the final state is a superposition, tography, as quantum computing makes the answer will not deliver a coherent result it much easier to retrieve corresponding as the collapse delivers an unpredictable out- cryptographic keys. While nobody knows come. In that case, the calculation can be exactly when this threat will actually man- repeated multiple times to determine the ifest, it is essential for the financial sector to result with the highest probability. understand the extent to which advances in While quantum computing offers new quantum computing affect the security of directions to solve computational problems, the core banking and payment services. To the quantum parallelism causes it to scale gain the required understanding, the Dutch up quickly. Adding one qubit doubles the Payments Association (DPA) is bringing computing capacity of the quantum com- together quantum computing experts and puter. Some known ‘hard problems’ are experts from financial institutions to discuss exponentially faster to solve with a quantum how advances in quantum computing may computer. This opens up new possibilities impact on the financial sector. for finding new chemical processes, new drugs and so on, but also weakens certain existing encryption algorithms, with clear WHY THE QUANTUM COMPUTER IS consequences for the encryption currently A THREAT used to secure data. It all starts with the information unit. The information unit of the classical computer is CURRENT ENCRYPTION, the ‘bit’. A bit has two states: zero (0) and OR COMMON CLASSICAL one (1). The quantum computer, however, CRYPTOGRAPHY uses a ‘qubit’ (quantum bit), which is in both states at the same time. This concept is Symmetric-key algorithms known as superposition. Another quantum The most common and well-known encryp- fact is that a qubit in a superposition can- tion method is the symmetric encryption or, not be observed directly. When the qubit is more accurately, symmetric-key encryption. measured it will ‘collapse’ into a 0 or 1 in an The symmetric-key algorithms use the same unpredictable way. As the information unit key for both encryption of plaintext and has different properties, quantum calcula- decryption of the encrypted text. This key, tions also follow a fundamentally different which is used to secure the data, is a secret approach. First, the input must be presented shared by the parties. Many secret writings Page 148 Covers and Doeland made by enthusiasts, such as Julius Caesar,3 public key, and that encrypted message can probably fall into the category of symmetric be decrypted only by using the receiver’s pri- encryption. vate key. This is a big advantage. Public-key Well-known symmetric-key algorithms algorithms do not need a secure channel for include the Data Encryption Standard the initial exchange of one or more secret (DES) and its successor, the Advanced keys between the communication parties. Encryption Standard (AES). DES dates The drawback is that it is computation- from the early 1970s and ought to have intensive, particularly in comparison with been replaced already, but the trick of symmetric-key algorithms. cycling through the algorithm three times Examples of asymmetric public-key with two or three different keys prolonged algorithms include RSA (an acronym of its life.4 Today, there are still many sys- the surnames of Ron Rivest, Adi Shamir tems that use triple DES. The current gold and Leonard Adleman), the digital signa- standard for symmetric-key algorithm is ture algorithm (DSA) and elliptic-curve AES.5 cryptography (ECC). The big advantage of symmetric encryp- tion is that it is very fast; the disadvantage is the shared secret key. After all, if someone is Cryptographic hash functions able to discover this secret key, all encrypted Cryptographic hash functions are a spe- messages can be decrypted and read as well cial class. The hash function can be used to as manipulated and re-encrypted. Further- map data of arbitrary size to data of fixed more, in the case of multiple communication size. It is used to verify data integrity and is partners, a unique key is needed for each designed as a one-way function, which can- communication partner, which soon results not be reversed. in an untenable situation. So, symmetric-key Cryptographic hash functions are algorithms always lead to key distribution widely used not only to verify data concerns. integrity but also as building blocks to construct a digital signature or message Asymmetric public-key algorithm authenti cation code. They are also used (classical) for pseudorandom generation and key Asymmetric public-key algorithms dis- derivation. tinguish themselves by the fact that they Examples of cryptographic hash employ two keys that together form a single algorithms include the MD5 message- pair. What is encrypted with one key can be digest algorithm and secure hash algo- decrypted only by the associated key. This rithms (SHAs). SHAs are cryptographic makes it possible to make one key publicly hash functions published by the National known; after which anyone can use this Institute of Standards and Technology public key to encrypt a message for the (NIST). owner of the other key. In this case, the other key must be kept private to make sure that only the owner is able to decrypt Key distribution the message, hence this key is known as the Traditionally, a requirement of secure private key. communication between two parties is Based on the feature that what is encrypted that they first exchange key parts in a with a public key can be decrypted only by secure manner; for example, via a face- using the associated private key, any person to-face meeting.