The federal agency recently published a report focusing on cryptography in a quantum world that outlines a long-term approach for avoiding the problem before it happens.
"There has been a lot of research into quantum computers in recent years, and everyone from major computer companies to the government want their cryptographic algorithms to be what we call 'quantum resistant,'" said NIST mathematician Dustin Moody. "So if and when someone does build a large-scale quantum computer, we want to have algorithms in place that it can't crack."
Encryption often relies on the challenge of factoring large numbers to ensure security, but researchers at MIT and the University of Innsbruck in Austria recently demonstrated what they said is the first five-atom quantum computer capable of cracking such encryption schemes.
Whereas traditional computers represent numbers as either 0s or 1s, quantum computing relies on atomic-scale quantum bits, or “qubits,” that can be simultaneously 0 and 1 -- a state known as superposition that promises huge gains in efficiency and performance.
One recommendation in the NIST report is that organizations begin by focusing on "crypto agility," or the ability to rapidly switch out whatever algorithms they are using for new ones that are safer. Creating those safer algorithms is the longer-term goal.
Toward that end, a key part of NIST's effort will be a competition in which members of the public will devise and test promising new cryptographic methods. A similar contest led to the development of the SHA-3 hash algorithm used for authenticating digital messages. The agency plans to launch the new competition in the next few months.
"It will be a long process involving public vetting of quantum-resistant algorithms," Moody said. "And we're not expecting to have just one winner."
Several of today's security mechanisms could be cracked by a quantum computer, including public-key encryption and digital signatures, so multiple new alternatives will be required.
Though any practical threat is still in the future, the NIST doesn't want to waste time.
"Historically, it has taken a long time from deciding a cryptographic system is good until we actually get it out there as a disseminated standard in products on the market -- it can take 10 to 20 years," Moody said. "Companies have to respond to all the changes, so we feel it's important to start moving on this now."