The clock is ticking on Q-Day, the looming yet unknown date when quantum computing will have the capacity to quickly and easily break the encryption keys that keep most internet communication safe.
Experts have known about the hypothetical risk of Q-Day since the 1990s. But Google recently warned that quantum computers may be able to hack some encrypted systems by 2029 — a timeline that drastically narrows the window to safeguard data that many cybersecurity specialists had previously predicted. The new estimate means that governments, companies and other entities may have far less time to prepare.
“It’s the day when people, perhaps adversaries, will have access to a quantum computer that can break cryptographic codes that are in use,” said Michele Mosca, cofounder and CEO of cybersecurity company evolutionQ.
Q-Day marks the moment a quantum computer gains enough resources and stability to crack conventional crytopgraphy. When that happens, every financial transaction, medical file, email, location history and crypto wallet protected by today’s commonly used algorithms could be unlocked by a machine capable of solving the complex math that currently keeps sensitive data secure.
At that game-changing turning point, “everything’s safe — safe, safe — and then suddenly it’s not safe. It’s a very drastic jump,” said Mosca, who is also a professor at the Institute for Quantum Computing at the University of Waterloo in Ontario.
Adversaries and bad actors may already be collecting encrypted data, with the intention of launching “harvest now, decrypt later” attacks. In this scenario, information is stolen, stored and then decrypted when a full-scale quantum computer is available, he added.
Mosca has coauthored the Quantum Threat Timeline Report, published by the Global Risk Institute in Toronto, since 2019. The seventh edition, published March 9, suggested a full-scale, cryptographically relevant quantum computer was “quite possible” within the next 10 years, and “likely” in the next 15. Mosca and his coauthor based their prediction on the opinions of 26 experts.
“Many organizations may be unaware that they are currently exposed to an intolerable level of risk that requires urgent action,” the report authors wrote.
Google said on March 25 that it was targeting 2029 “to secure the quantum era” with post-quantum cryptography. The timeline reflected advances in the quantum computing field, the company said. “By doing this, we hope to provide the clarity and urgency needed to accelerate digital transitions not only for Google, but also across the industry,” it noted in a blog post. Similarly, cloud computing services company CloudFlare announced it was also now targeting 2029. Google declined an interview request.
