Europe has its eyes set on Euro Football and the world is focused on the Covid-19 vaccine race, but some necessary sprints shouldn’t make us forget about long-term marathons, one of which is post-quantum cryptography (PQC). Current cryptography and all the tools for data and communication privacy could be obsolete as soon as a quantum computer is operational.
Quantum computing, the coming revolution
PQC is therefore necessary so that future encryption methods can withstand these new quantum computers, while being able to interact with existing networks. In short, we will need much more than the GDPR [règlement européen de protection des données, NDLR] or new passwords to keep our data private and secure – and we also need to harness these technologies to prevent anti-democratic or terrorist groups from abusing encryption to act against our open societies.
To standardize these PQC algorithms, the US National Institute of Standards and Technology (NIST) launched in 2016 a competition to identify algorithms capable of withstanding attacks from quantum computers by 2022 and make them available to ‘by 2024. Ironically, five years ago, American entities like the NSA [National Security Agency, agence de renseignement américaine] spying on the world but also developing the crypto tools of the next decade – reminding us, as Europeans, that we need to be much more proactive when it comes to technology.
Macron bets € 1.8 billion on quantum computing
NIST is interesting proof that beyond “soft power” and “hard power”, regulatory power paves the way for technological domination. As such, NIST (a federal agency of the US Department of Commerce) has no international legal authority. Yet, since the United States is by far the largest post-quantum ecosystem, NIST is able to declare standards that will become standards – this already happened in the early 2000s for the standardization of cryptosystems such as AES (today the most widely used encryption method in the world) and SHA-3 (today used for some bitcoins).
“Crack the code”
The real power of NIST lies in its ability to directly influence future technology standards, choosing the big winners from 82 crypto schemes from more than 5 different families. This shows that GAFAM [acronyme des géants américains des technologies Google, Apple, Facebook, Amazon et Microsoft] haven’t entirely replaced governments: When the state understands tech and proactively sets the scene, regulators hold the (encrypted) keys to our future.
READ ALSO> “We must act to regulate the GAFAM, otherwise it will end badly for the States”
But how can we Europeans “crack the code” and become a technological leader as innovative as the United States and as long-term oriented as China? Post-quantum cryptography tells us that it’s actually easier than we think. First of all, we already have the necessary talent: of the seven NIST finalists, all but one have a majority of European scientists in their midst. We need to keep these talents in Europe, through less bureaucratic and more targeted funding mechanisms, and through a true digital single market offering the scale we desperately lack – otherwise, European policymakers will continue to subsidize technology leaders who will then cross the Atlantic to deploy their solutions.
READ ALSO> Why there is no European Amazon
Second, there is a clear opportunity for Europeans to be the ‘third way’ among other tech superpowers, provided they are much more proactive and tech savvy. In the case of PQC, there is growing concern about the monopoly that NIST and the US administration have on encryption standardization around the world. The European Union can play the role of “kingmaker” not only in the field of cryptography, but also in those of artificial intelligence, green technologies or health care: the carbon mechanism under development can serve as an example, provided we are bold, quick and nimble.
Prepare for the quantum computing revolution
We say that “the code is read more than it is written”. On the contrary, the NIST competition shows that policymakers can still define the code of tomorrow, provided they act and shape the future now, develop much stronger foresight capacities, and find the daring and the lack of agility by working more closely with the European technology ecosystem and civil society.