Technology

Public key crypto is used to set up a secure network connection, but it’s not used to encrypt the data that flows on that connection. Quantum snooping would require an eavesdropper to intercept every bit on a connection, from initiation onward. And decrypting it would probably not be a real-time affair.

It depends.

The attack type that is currently being considered is what is called Store Now Decrypt Later (SNDL). The idea is that some hypothetical future attacker could have a copy of all of your Internet traffic data for the past decade and such an attacker could utilize a not yet invented, but theoretically possible, quantum computer to break the encryption.

This is why systems are changing over to post-quantum encryption, because even if there are not quantum computers yet. The assurance that factoring prime numbers will be hard forever is no longer the case and the difficulty of factoring prime numbers underpins a lot of classical encryption.

A way of encrypting data in the past was to use the RSA keypair to exchange a symmetrical key, which is a system where both parties encrypt/decrypt data using a shared key. This allowed for a secure connection from RSA and also fast and computationally cheap encryption using a symmetrical algorithm. An attacker that has recorded traffic secured in this manner only needs to crack the RSA keypair to obtain the symmetrical key afterwards they can decrypt the traffic as if they were a participant. This kind of attack only requires the quantum computer to factor a single key.

More modern systems use methods which would create ephemeral keys which are used and discarded. They use a system of key exchange that allows both parties to create a shared key even when a listening party has access to all of the traffic between them. The RSA keypairs are only used to authenticate the two parties to one another, afterwards they use Diffie-Hellman (or Elliptical Curve Diffie-Hellman) to generate the shared key to encrypt the next packet.

Crypto systems like the one Signal employs takes this concept a step further using a double ratchet system, if this kind of thing is interesting to you ( https://www.youtube.com/watch?v=DXv1boalsDI )

Both links are from Computerphile on YT, they do good videos on Computer Science and Mathematics topics.

It also needs to factor in a threat models. Maybe this is important for governments or giant conglomerates, but an average hacker isn't going to have their hands on a quantum computing rig to just use. Until its use becomes widespread on a consumer level it will be mostly used by corporations and governments. I think it will be a while before a criminal organization has one, but maybe I am wrong.

Quantum is much cooler than the current LLM circlejerk.

I mean, they specifically point to post-quantum cryptography and advise people to move towards it in the article:

Google said: “We’ve adjusted our threat model to prioritise post-quantum cryptography migration for authentication services – an important component of online security and digital signature migrations. We recommend that other engineering teams follow suit.”

The issue here is not that there aren't solutions; it's that organizations are not interested in taking the time and effort to move towards them. I've been beating this particular drum at my org for about a year, and I've gotten zero traction. This is a concern because moving to New encryption means taking all the data you've got, decrypting it, and re-encrypting it. That's not fast when you're talking hundreds of terabytes.