Quantum Cryptography Risks: Protecting Critical Infrastructure from Entanglement Threats – A Comparative Analysis of PQC, QKD, and US-PRC Risk Postures
Emerging Risks in Critical Infrastructure Security
The United States’ approach to securing critical infrastructure has been called into question as a recent white paper highlights the need for a more nuanced evaluation of post-quantum cryptography (PQC) and quantum key distribution (QKD) in the face of rapidly evolving threats.
Post-Quantum Cryptography (PQC)
The U.S. currently focuses primarily on PQC, executing a migration timeline that is already under strain. This sole reliance on PQC may not be sufficient for protecting certain high-risk systems, according to the report.
China’s Approach to Quantum Cryptography
Contrary to the U.S., China is investing in both PQC and QKD infrastructure, creating a layered resilience against potential failures in either approach. This divergent approach raises concerns about the U.S.’s concentrated focus on PQC without a physics-based fallback, especially for Tier-1 critical infrastructure links.
Tier-1 Links: High-Risk Systems
Tier-1 links refer to communication paths where confidentiality horizons are permanent or multi-decadal, compromise can lead to physical consequences or systemic financial disruption, and failure is not recoverable through patching after the fact. The authors argue that the U.S. should apply a similar level of scrutiny to its approach as it does to other areas, such as nuclear deterrence and missile defense.
Risks Associated with Relying Solely on PQC
The white paper identifies several key factors that demonstrate the importance of considering both PQC and QKD in evaluating quantum cryptography:
- Authentication dependency: QKD relies on PQC for endpoint authentication and protocol operations, meaning that PQC cannot outrun QKD migration.
- Partial-deployment downgrade: Both PQC and QKD have issues related to falling back to classical cryptography under heavy load or misconfiguration, expanding the exploitable surface during the transition period.
- Hardware maturity gaps on overlapping timelines: Neither PQC nor QKD is a drop-in fix for every Tier-1 link within the same planning horizon, due to differences in hardware maturity and standards stabilization.
- Concentrated-node vulnerability: QKD backbones that rely on trusted nodes create innumerable chokepoints, which become high-value targets in case of compromise.
- Interaction effects during simultaneous migration: The maximum compound exposure period is the same period in which states and critical infrastructure operators will lock in infrastructure decisions for the early 2030s.
By acknowledging the complexity of the issue and the need for a more comprehensive approach, the U.S. can take a proactive stance in securing its critical infrastructure and mitigating the risks associated with emerging technologies.
The authors conclude by emphasizing the importance of taking a proactive approach to addressing the emerging risks associated with quantum cryptography and ensuring the security of critical infrastructure.