1. Quantum Computing

2. Agenda Background Benefits & Concerns Cryptography Timing of Impacts
Enhancement Methodology
BPI/BITS Quantum Risk Calculator
Sample High Level Strategy & Timeline
pg. 1

3. Classical/Conventional Computing
Background
Quantum computers are not like general-purpose or “classical” computers.
“Classical” computing uses a string of “0”s and “1”s or BITS. Quantum performance is achieved through the ability for QUBITS (Quantum BITS) to exist as both “0” and “1” at the same time, resulting in all the possible combinations of “0”s and “1”s being processed simultaneously.
Quantum computers are projected to have performance gains over conventional computers in the billion-fold realm.
Quantum computing is expected to be a “disruptive” technological advancement.
Characteristic
Classical/Conventional Computing
Quantum Computing
Processing Model
Uses electronic transistors.
Uses quantum physics operating at the atomic partial level.
Base Data Processing Construct
Uses electronically set “bits” that make up a “byte” that are limited by electronic “on” and “off” settings, i.e., processing state to logically define data elements.
Uses configurable atomic/sub-atomic level quantum bits or “qubits” that can run in both on/off states at the same time to define data elements.
Speed
Is fast, but we are reaching the physical and logical limits of transistor-based technology.
Can bind many qubits together to work in tandem (parallel processing) allowing an exponential increase in processing speed.
Capabilities
The number of transistors per chip, minimum size of transistors, and limits of processing speed are expected to reach their maximums by 2020.
Will allow continued expansion of computer capabilities and needs for the foreseeable future.
pg. 1

4. Benefits & Concerns Other Benefits Top Benefits Top Concern
Search algorithms for big data - searching over a set of possible outcomes for complex pattern prediction and simulations.
Factoring large numbers and performing complex scientific calculations.
Other Benefits
Escalation of technology advancements.
Will accelerate computing tasks that are too complex or are unattainable today, e.g., Improved decision-making models.
Advancements in cryptography and Artificial Intelligence machine-learning capabilities.
Other Concerns
Potential military/strategic and economic imbalance if only a few have the capability.
Advancement of Nation/State attack capabilities for early adopters.
Strategic positioning of legacy technology.
Time to transition: service providers, partners, and clients.
Top Concern
The computational power of quantum computing could be used to overcome current encryption algorithms used by virtually everyone.
pg. 1

5. Cryptography Organizations typically rely on these algorithms:
Asymmetric encryption relies on a public key and private key that can only be broken through the factoring of very large prime numbers. Breaking the keys is so difficult that VPNs, Internet traffic (SSL/TLS) communication, online shopping, block-chain and banking all rely on this type of encryption.
Symmetric encryption uses the same key to both encrypt and decrypt the data. In this form of encryption, outside of implementation errors, the only known way to break it is through a brute force attack that would take so long it would be infeasible.
Quantum computers could crack these methods:
Researchers have found at least one known method (Shor’s Algorithm) for quantum computers to break asymmetric encryption in a reasonable time period.
Symmetric algorithms are considered to be “quantum-resistant”.
pg. 1

6. 2018 Gartner Hype Cycle for Emerging Technologies
Timing of Impacts
Gartner’s Annual Hype Cycle Says Quantum Computing Will Reach a “Plateau of Productivity” Within 5 to 10 Years
2018 Gartner Hype Cycle for Emerging Technologies
pg. 1

7. Timing of Impacts Today Projected - 2023 Projected – 2025 thru 2028
Gartner’s Annual Hype Cycle Says Quantum Computing Will Reach a “Plateau of Productivity” Within 5 to 10 Years
Today
Projected
Projected – 2025 thru 2028
pg. 1

8. Enhancement Methodology
Assumptions:
Data encryption using current
cryptographic standards will be
at risk once Quantum Computers
reach ~4000 qubits.
The confidentiality, integrity &
availability of non-”Quantum
Resistant” encrypted data will in
jeopardy.
It could take 2-4 years for organizations
to become Quantum Proof once new
standards become available.
Symmetric algorithms (shared key) of 265
bits or larger are considered Quantum
Resistant and are considered safe for the
foreseeable future.
Asymmetric encryption algorithms of less
than 256 Bits are also at risk.
1) Identify Organizational Risk From Quantum Computing
2) Define Technologies That Use Symmetric and Asymmetric Encryption
3) Analyze if Encryption Levels are “Quantum Resistant” including vendors/ 3rd parties
4) Create an Improvement Strategy and Timeline to Address Identified Gaps
pg. 1

9. BPI/BITS Quantum Risk Calculator
The Bank Policy Institute (BPI) BITS membership has been organizing response efforts regarding the quantum computing risk to cryptography issue since 2015.
The “Quantum Risk Calculator” referenced below was recently released to the BPI/BITS membership to raise awareness on related risk factors – Sample Seven and Forty Year Risk Models from the Risk Calculator follow on the next page.
This tool is based on the U.S. National Institute of Standards and Technology created a Quantum Computing “When to Prepare Model” developed in 2016
The calculation says that your organization should start making steps to prepare now if X + Y is greater than Z where:
X = How long does my encryption need to be secure (x years)? 
Y = How long will it take to re-tool my existing infrastructure with a quantum-safe solution (y years)? 
Z = How long will it be until a large-scale quantum computer is built (z years)? 
pg. 1

10. BPI/BITS Quantum Risk Calculator
7 Year Retention
40 Year Retention
pg. 1

11. Sample High Level Strategy & Timeline
Steps to Prepare for Post-Quantum Computing:
Scope Assessment – Evaluate and inventory encryption technologies including internal, external and partner ecosystems.
Mitigation Strategy – Update and enforce encryption standards, increase symmetric/asymmetric key sizes and remove weak key ciphers from the environment.
Scale Infrastructure – Identify and scale infrastructure requiring increased computing power to support computational needs of advanced encryption.
Data Retention – Ensure policies and procedures are in place to manage and remove encrypted data when it is no longer required.
Quantum Proof Planning – Actively follow updates from NIST an Quantum Computing Industry leaders, update policies/procedures to support new and developing Quantum Computing requirements.
Quantum Proof Implementation – Implement new Quantum resistant products, technologies and methods.
pg. 1

12. Thank You! www.theclearinghouse.com
BANK POLICY INSTITUTE- BITS Washington, D.C Pennsylvania Ave, NW Suite #720 North Tower Washington, D.C