Quantum Threat: The Race Has Already Begun

Codes protect our payments, banking transactions, and digital assets. One day, they could be cracked by a quantum computer. No one knows when that will happen. However, banks must be prepared for this possibility, writes Thomas Brunner, Head of Custody and Staking at Sygnum.

Experts have a name for this moment: «Q-Day.» That is the day when a quantum computer will be able to crack the codes that secure the financial system. Today, no machine is capable of doing so. Predictions about when that might happen vary widely.

Nevertheless, the threat must be taken seriously. These security codes serve two purposes: they render data unreadable and sign transactions to verify who authorized them. In the case of digital assets, they serve as the keys that grant access to the assets themselves. Algorithms capable of withstanding quantum attacks already exist. Several governments are already calling for their implementation. The right approach is to remain calm in the face of this uncertainty and get to work.

A risk that already exists today

Migrating a large institution takes time. Data stolen today could be decrypted tomorrow. The strategy behind this is «collect today, decrypt later»: An attacker intercepts encrypted data and counts on future machines being able to decrypt it. For all information that remains relevant for a long time, this threat already exists today.

The risk of counterfeiting is the biggest concern. Counterfeit signatures could make it possible to transfer digital assets that were thought to be protected.

Two areas of work that must be addressed simultaneously

A bank must migrate two layers simultaneously: the cryptography that protects customers’ assets and communications, and the core banking systems on which it is built. These systems are often outdated and interconnected. The pace is determined by whichever of the two levels is progressing more slowly.

The focus is on what is known as cryptographic agility: the ability to replace a signature or encryption scheme without disrupting anything that depends on it, while maintaining normal operations. To do this, it is necessary to know where the keys are stored—often in unexpected places, such as backups.

Digital assets introduce additional complexity. A custodian cannot simply change the keys for its clients’ on-chain assets at will. A migration involves processes and consent just as much as it does cryptography.

That is why we believe that the banks’ programs should be well advanced by 2027—and thus ahead of the timelines set by the major networks. The bulk of the costs comes from untangling and testing all areas that rely on cryptography.

A topic for the Board of Directors

For a board of directors, three questions are crucial: Do we know where our cryptographic risks lie? Do we have a migration plan? Do we have the agility needed to implement it? As soon as regulators include this risk in their reporting requirements, it will move from the innovation roadmap to the audit agenda.

An honest message is also reassuring to customers: No computer today can crack this cryptography; assets are secure; and work is already underway to ensure that remains the case in the future. Customers want to know that their provider has a plan and is implementing it to mitigate risks early on.

By 2030 or 2035, quantum-resistant cryptography will be the standard for payments, custody, and communication. Networks and custodians will be able to seamlessly transition their clients’ assets to new signatures with their consent. Ultimately, it comes down to one capability: the ability to change cryptography as needed. Institutions that build this capability now will be ready in time.

More information: https://www.sygnum.com