Ann Dooms: what is secret today could be out in the open tomorrow

A month earlier, a study by the technology federation Agoria revealed that six out of ten Belgian technology companies do not have a complete inventory of their digital infrastructure, nor a cybersecurity policy. Nearly half lack a monitoring system to detect attacks.

Belgium is therefore still struggling with today's security challenges, while a more fundamental threat is emerging. One that cannot be solved with a few lines of code: the arrival of the quantum computer.

The Quantum Computer as a New Threat
It is striking how little attention is being paid to the security guidelines published last week by the American standards institute NIST. In the United States, the most sensitive federal systems must switch to quantum-resistant key exchange by 2030 and to new digital signatures by 2031. The broader transition must be completed by 2035.

Digital security makes information unreadable through calculations that are easy for the sender and recipient thanks to a secret key, but difficult for eavesdroppers. This generally relies on mathematical problems that classical computers, and therefore attackers, cannot solve efficiently. Since the time of Euclid, around 300 BC, we have known that every natural number greater than 1 can be expressed as a product of prime numbers. But try finding those prime factors for a number containing more than 600 digits. Even the most powerful classical computers grind to a halt. For now, AI does as well.

This creates a false sense of security, because in 1994 the mathematician Peter Shor demonstrated that a quantum computer could solve such problems efficiently. His discovery gave enormous momentum to research into machines that compute according to the laws of quantum mechanics and can tackle computational problems that defeat classical computers.

What seemed like an abstract theory in the early 1980s has evolved into a holy grail with far-reaching applications. Alongside specialised companies, technology giants such as IBM, Google and Microsoft are investing heavily in quantum hardware. The development process is proving exceptionally complex, however. Physics does not yield easily. As a result, these machines are still nowhere near powerful enough to break our cryptography. When that will become possible, nobody knows.

“Anyone who thinks they are safe until the quantum computer arrives will be too late”

Yet our security is already at risk. Malicious actors can simply store encrypted information today and decrypt it later using a quantum computer. Harvest now, decrypt later. Diplomatic communications, medical records and corporate secrets do not necessarily lose their value or confidentiality after a few years.

Ten to Twenty Years
For years, researchers have been working on alternative cryptographic systems for classical computers, which will remain in use. This field is known as post-quantum cryptography. These systems rely on mathematical problems for which no efficient classical or quantum solutions are currently known.

To gain greater confidence in their security, candidate algorithms are published by NIST and subjected to years of cryptanalytic attacks. Anyone who successfully breaks such a system is more likely to choose academic fame than a career as a hacker. This field, too, is now being accelerated by AI. This summer, Anthropic developed a conventional attack against HAWK, a candidate for a new digital-signature standard, in just 60 hours.

The transition to these new cryptographic systems requires far more than a software update. Algorithms often run on specialised hardware and are deeply embedded within our digital infrastructure. NIST points out that previous cryptographic transitions took between ten and twenty years. Governments, hospitals and businesses must therefore urgently identify which cryptographic systems they currently use, prepare migration plans, and ensure that security systems can be replaced flexibly.
We are entering an era of ever-faster cat-and-mouse games. If we continue to ignore the threats posed by AI and quantum computing, the next period of digital disruption may last far longer than a single day.