Cryptographically Relevant Quantum Computer

Description

A Cryptographically Relevant Quantum Computer (CRQC) is a quantum computer with sufficient power and stability to break widely used public-key cryptographic algorithms, such as RSA and Elliptic Curve Cryptography (ECC), by running Shor's algorithm. In the context of 3GPP, CRQC is a critical consideration for the security architecture of 5G-Advanced and 6G networks, as the advent of such machines would render current security mechanisms obsolete. 3GPP specifications 22.870 and 33.703 address the threat posed by CRQC and outline strategies for migrating to post-quantum cryptography (PQC).

The threat model of CRQC is based on the fact that quantum computers can solve certain mathematical problems exponentially faster than classical computers. Specifically, Shor's algorithm can factor large integers and compute discrete logarithms, which are the basis for RSA and ECC. A CRQC would therefore be able to decrypt intercepted communications, forge digital signatures, and compromise authentication protocols. The timeline for the emergence of CRQC is uncertain, but experts estimate it could be within the next 10 to 20 years. However, the risk is exacerbated by the "harvest now, decrypt later" strategy, where adversaries may record encrypted data today to decrypt it once a CRQC becomes available.

In 3GPP, the response to CRQC involves the adoption of post-quantum cryptographic algorithms that are resistant to quantum attacks. These algorithms are being standardized by NIST and other bodies, and include lattice-based, code-based, and hash-based schemes. 3GPP specifications define how these algorithms can be integrated into the 5G security architecture, including the 5G-AKA authentication protocol, the IPsec and TLS protocols used for network domain security, and the application-layer security mechanisms like COSE. The specifications also address the need for cryptographic agility, allowing networks to switch algorithms without major architectural changes.

The architecture for mitigating CRQC threats involves several layers. At the core network, the Security Anchor Function (SEAF) and Authentication Server Function (AUSF) must support PQC algorithms for authentication and key agreement. At the radio access network, the UE and gNodeB must negotiate and use PQC for radio interface security. Additionally, the specifications cover the management of quantum-safe keys, including key generation, distribution, and storage. The 3GPP Security Assurance Specifications (SCAS) are updated to include testing for PQC implementations.

The introduction of CRQC considerations in 3GPP Release 20 reflects the proactive approach of the standards body to future-proof mobile networks. As quantum computing advances, the transition to PQC will be a multi-year effort, requiring coordination across vendors, operators, and regulators. 3GPP's work on CRQC ensures that 5G and 6G networks will be ready to withstand the quantum threat, protecting user data and network integrity for decades to come.

Purpose & Motivation

The concept of CRQC exists to frame the security challenges posed by quantum computing and to drive the development of quantum-resistant cryptographic solutions. The primary motivation is to protect sensitive information and communication infrastructure from the threat of quantum-enabled attacks. Current cryptographic algorithms, which rely on the computational difficulty of certain mathematical problems, will become vulnerable once a CRQC is built. This would have catastrophic consequences for privacy, financial transactions, and national security.

3GPP's work on CRQC is motivated by the need to ensure that mobile networks remain secure in the quantum era. The limitations of previous approaches include the lack of quantum-resistant algorithms and the absence of a migration strategy. By addressing CRQC in its specifications, 3GPP provides a framework for the gradual adoption of post-quantum cryptography, ensuring interoperability and backward compatibility. This proactive stance is essential because the transition to PQC will take many years, and networks deployed today must be capable of being upgraded.

Furthermore, the inclusion of CRQC in 3GPP Release 20 highlights the importance of international collaboration in cybersecurity. Quantum threats are global, and standards like 3GPP play a crucial role in harmonizing responses across different regions and industries. The work on CRQC also aligns with efforts by other standards bodies, such as IETF and ETSI, to develop and standardize PQC algorithms.