Technology advisors are pushing organisations to adopt the post-quantum cryptography (PQC) approach to remain secure against attacks by quantum computers.
PQC refers to the development of cryptographic algorithms that are thought to be able to provide security against a cryptanalytic attack by a quantum computer.
The National Cyber Security Agency (NCSA) is set to release PQC guidelines by year-end for public and private organisations to enable them to prepare for the impact of quantum computing.
NATIONAL STRATEGY
The Institute of Public Policy and Development (IPPD) recommends a national-level collaboration on the matter as digital technology plays a crucial role in achieving the major milestones outlined in the 13th National Economic and Social Development Plan for 2023-2027.
"Cryptography has been used for a long time, primarily to protect data secrets and security, particularly during war. Currently it is applied in various ways such as ensuring the integrity of data, verifying data sources and providing digital signatures," said Soontorn Sirapaisan, research team leader of the National Electronics and Computer Technology Center (Nectec), during a seminar entitled "When Quantum Computers Chase You: Strategies for Improving Security".
The advent of quantum computers involves the use of quantum bits, or qubits, which process information in a very different way.
Unlike regular bits, which always represent either a one or a zero, a qubit can exist in a superposition of one and zero simultaneously until its state is measured. This enables quantum computers to process certain tasks exponentially faster than standard computers.
"Quantum computing is a breakthrough technology. Some tasks such as decryption that might take 100 years could be completed in minutes or seconds with quantum, which is easily achievable," said Mr Soontorn.
"However, it won't replace classical computing as quantum technology serves more complex problems and use cases, including simulation, mathematical modelling, cryptography and the training of AI models."
Leading global tech firms and academics are working on quantum technology to make it more practical for wider usage in the near future.
Sarun Sumriddetchkajorn, a board member and acting director of the IPPD under the Office of the National Economic and Social Development Council, said there are potential risks associated with quantum computers.
He said data encryption used in email, e-commerce, e-transactions and various files could be decrypted using quantum computers in the future, posing a threat to important information.
Mr Sarun highlighted the strategy of "quantum computing as a service" being offered by global tech leaders, signalling intense competition and faster development in this area.
He said the US Executive Office of the President directed agencies to mitigate the risk for vulnerable cryptographic systems.
The National Institute of Standards and Technology in the US is also working to standardise PQC.
Mr Sarun stressed the importance of related agencies, ranging from the Digital Economy and Society Ministry to the National Security Council, to join forces to drive the adoption of PQC.
He said the 13th national plan refers to important data ranges used for smart cities, smart electronic hubs, digital government, and high-value medical and wellness.
"Reskilling, upskilling and acquiring new skills related to quantum technology are important to increase the country's competitiveness," Mr Sarun said.
AVM Amorn Chomchoey, secretary-general of NCSA, said the PQC guidelines the agency is set to release would show users how to prepare and make an inventory of critical data, and prioritise confidential and high-value data, particularly high-impact information such as secret negotiations, diplomacy and international relations.
"We should be aware, although we should not panic," AVM Amorn said.
He stressed the importance of basic cybersecurity hygiene, as organisations should not wait for an attack by a quantum computer to take place.
Data leaks can happen at any time if organisations use simple passwords without encryption, said AVM Amorn.
CAPITALISING ON QUANTUM
Apart from security concerns, the country should consider how to leverage and capitalise on PQC-related opportunities, he said.
PQC is estimated to become prevalent within 2-6 years, said AVM Amorn.
Chalee Vorakulpipat, the principal researcher on Nectec's information security research team, said the agency is working on a new quantum random number generator and preparing data anonymisation for farmers using quantum safe cryptography, along with preparing a traceability system for the export of durian.
Ponsarn Charoenwattanachokchai, a senior solutions architect at Betimes Solutions, a local tech service provider, said organisations should prepare for PQC by building an inventory of critical data and cryptographic technology, as well as identifying internal standards and public key cryptography.
Organisations need to develop a plan for transitioning to PQC standards and selecting suitable tech vendors, said Mr Ponsarn.
He said in the future there would be several potential services that organisations would need to embrace PQC, ranging from consultancy to help them adapt to the PQC environment to the use of digital certificate-based PQC technology.