The Financial Services Information Sharing and Analysis Center (FS-ISAC) released a white paper urging the financial services sector to prepare for a “post-quantum” world.
The financial services sector has undergone many cryptographic transitions over the years. Each of those transitions was more complex and time-consuming than the last. And each was treated as a one-off because technologists believed that cryptographic algorithms, such as one called RSA, would suffice for our lifetimes. It probably won’t.
But because we thought these algorithms would last for decades, they’re installed everywhere – deployed across applications and the technology ecosystem, deep in software applications, embedded in hardware devices, and many other places, too. Such was our confidence in those algorithms that few institutions kept track of them. The next radical change will come from quantum computing.
The technology’s arrival is expected in the next few years, and when it’s fully functional, financial services institutions will be able to harness the power of quantum mechanics – hence “quantum computing” – to solve many complex problems (such as stochastic modeling, trade optimization, and much more) exponentially faster than today’s computers can.
The downside is that threat actors will have the same abilities. Malicious actors know that quantum computers will be the key that opens many locks. They’re already buying or stealing data they can’t possibly decrypt, knowing that quantum computing will do it eventually (it’s called “harvest now, decrypt later”).
Meanwhile, more PQC algorithms are expected in cycles of staggered development, and it is increasingly clear that new architectures will probably have shorter operational lives. They’ll need replacing and updating more often, while some of the existing infrastructure cannot even make the jump to more nascent cryptographic algorithms.