Knowledge
Quantum computers are coming. Preparation starts today.
How will quantum computers change IT security? Which data is at risk? And how can organisations prepare?
Here we explain the key concepts and connections, with a focus on long-lived industrial systems and secure communication.
01 / Fundamentals
What are quantum computers?
Quantum computers use the properties of quantum physics to process information. Their computing units are called qubits.
With suitable algorithms, they could solve certain mathematical problems much faster than classical computers. They are not universal “supercomputers” that perform every task faster.
For IT security, the key point is that these problems include some that underpin widely used cryptographic methods.
02 / Cryptography
Why does this affect our cryptography?
Cryptography does more than protect data confidentiality. It also helps identify communication partners and detect tampering.
Many systems rely on asymmetric methods such as RSA or elliptic-curve cryptography for this. A sufficiently powerful quantum computer could break the mathematical foundations of their security.
This particularly affects key exchange and digital signatures, which are essential building blocks for secure connections, certificates and software updates.
Not all encryption is affected in the same way.
Symmetric methods such as AES need to be assessed differently from RSA or elliptic-curve cryptography. That is why preparation starts with the question: which cryptography is used where?
03 / The risk today
What does “harvest now, decrypt later” mean?
Harvest now. Decrypt later.
Attackers can record and store encrypted communications today. Once the necessary technical capabilities are available, they could try to decrypt that data later.
This is especially relevant for information that must remain confidential for a long time, such as trade secrets, development data or sensitive infrastructure information.
A later migration cannot retroactively protect data that has already been intercepted. How we transmit information today matters too.
04 / Preparation
Why should organisations start now?
No one can reliably predict when quantum computers will be able to break widely used cryptographic methods in practice. But organisations can already assess how long their data needs protection and how complex a migration could be.
For industrial systems in particular, three questions come together:
How long will the system remain in operation?
An industrial system purchased today may remain in operation for many years. Its security architecture must be able to evolve during that time.
How long will the data remain sensitive?
Some information quickly loses its value. Other data must remain confidential for years or decades.
How long does migration take?
Inventory, coordination with suppliers, integration and testing all take time. The more systems and dependencies are affected, the earlier planning should begin.
The first step is to map the affected systems, data and connections.
This helps identify where migration should take priority.
05 / PQC
What is post-quantum cryptography?
Post-quantum cryptography, or PQC, refers to cryptographic methods designed, according to current research, to withstand attacks from quantum computers.
They run on conventional hardware. Organisations do not need a quantum computer to use PQC.
The first NIST standards were published in August 2024:
| Algorithm | Purpose |
|---|---|
| ML-KEM | Establish shared secret keys that can then be used for encrypted communication |
| ML-DSA | Create and verify digital signatures |
| SLH-DSA | Another digital signature method based on hash functions |
PQC is already a foundation for practical migration projects. The right methods and configurations depend on each system and its requirements.
06 / Hybrid methods
What is a hybrid approach?
A hybrid approach combines classical cryptography with post-quantum cryptography.
In a hybrid key exchange, for example, contributions from both methods are combined to create a shared key. When properly designed, protection remains as long as at least one of the two methods is secure.
The German Federal Office for Information Security (BSI) recommends combining post-quantum methods with classical methods wherever possible. Secure implementation within the relevant protocol is essential.
Source: BSI: Quantum technologies and quantum-safe cryptography
07 / Industry & OT
What does this mean for existing industrial systems?
In industrial environments, new security functions must fit ongoing operations. Availability, limited resources, existing protocols and maintenance windows all affect integration.
That is why at QMS we look at the specific communication path:
- Which systems and endpoints are involved?
- What information is being transmitted?
- How long does it need to remain protected?
- What are the requirements for latency, throughput and availability?
- Where can additional cryptographic protection be integrated?
Our Security Gateway brings PQC to selected communication paths. We tailor the configuration to the environment and its operating conditions.
Let’s get started
Where should you start?
Start with your most important data and connections. Identify which cryptographic methods protect them, how long that protection is needed, and what options exist for adapting them.
Then select a clearly defined use case and test the integration under real-world conditions. Taking inventory and prioritising affected systems are central parts of PQC migration.
Source: NIST NCCoE: Migration to Post-Quantum Cryptography
Want to understand what this means for your environment?
Let’s discuss your infrastructure and a practical first step.