(Credit: Microsoft)
In 2024, Chinese researchers at Shanghai University determined that a quantum computer could crack popular encryption algorithms that VPNs, web browsers, and even government computers rely upon. That’s not a comforting thought, since most of our financial assets and personal information is accessible on the internet.
I was surprised, then, that Microsoft CEO Satya Nadella did not speak about quantum computing at this year’s Build conference. It got only a brief mention by another presenter toward the end of the keynote in the context of the new Microsoft Discover AI research tool. The lone session of the conference that has quantum computing in the title is “Accelerating Scientific Discovery With HPC, AI, and Quantum Computing.” That lumps the technology together with AI and high-performance computing rather than focusing squarely on the radical new computing model.
The conference’s press materials, however, revealed more than what we heard in the keynote. In them, you find this: “PQC [post-quantum cryptography] capabilities will be integrated into Windows Insiders, Build 27852 and higher and SymCrypt-OpenSSL version 1.9.0 and higher.” Insider builds are pre-beta versions of Windows that allow testers to explore new features, provide feedback, and report bugs. SymCrypt is Microsoft’s cryptography library for securing data on the OS as well as for Azure servers and Microsoft 365 apps. OpenSSL secures network (and particularly internet) traffic.
Microsoft Is Furthering the Quantum Problem and the Solution
Microsoft claims to have accelerated the progress of quantum computing so that it’s not decades but years away with its introduction of the Majorana 1 processor. It employs a novel, so-called topological phase of matter that supports "non-Abelian quasiparticles or defects,” according to a paper that Microsoft researchers published. So, it’s good to see that the company is working to protect users from quantum computing threats, even while simultaneously developing the technology.
Microsoft began publicizing its quantum computing protections in 2023 with its Quantum Safe program, which intended to harden the company’s entire portfolio against the threat of quantum computing breaking encryption.
One problem that it still needs to address is the “harvest now, decrypt later” strategy. In other words, bad actors can hoard your encrypted data until they get the quantum capability to decrypt it down the line. Microsoft is adopting Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) to tackle that threat, writes principal product manager Aabha Thipsay in a Microsoft Security Blog post. That’s not the only option for protecting against quantum threats, though; Module-Lattice-Based Digital Signature Standard (ML-DSA) implementation is also in the works.
A Long Road Ahead for Quantum Safety
Offering previews of support for post-Quantum cryptographic algorithms is all well and good, but it’s a long, hard slog from here to actual safety. Reaching that goal depends on application and web developers actually implementing the new technology. And that involves testing multiple cryptographic systems side-by-side since the companies need to continue to implement the widely supported standards alongside any new ones.
In the aforementioned security blog post, Thipsay writes, "The performance of PQC algorithms, compatibility with existing systems, and the desire for widespread adoption are fundamental factors that will determine the success of this transition."
I just hope that Microsoft can solve the issues of standards support, implementation, and performance before quantum computing breaks the security protocols we all rely on for securing our web-accessible data and information.