Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces the concept of rotation time as a measure of crypto agility, linking it to security risk tolerance in the context of quantum computing threats. By analyzing historical CVE data, the authors derive that rotation time tolerances are typically within hours to days, highlighting the urgency for organizations to adapt their cryptographic systems. The findings suggest that while crypto agility combined with hybrid encryption can enhance resilience against quantum attacks, it imposes significant technical and operational challenges to align with organizational risk tolerances.
Rotation time tolerances for crypto agility against quantum threats may only span hours to days, revealing a critical urgency for organizations to adapt their security measures.
Because of their ability to enable new forms of cryptanalysis, quantum computers pose a threat to the cryptographic algorithms that are widely used to secure contemporary computer systems. A practical quantum computer may emerge within the next ten years or so, but due to theorised "harvest now, decrypt later" style attacker behaviour, mitigations are necessary today. Recent advances in cryptography and security architecture show promise in supporting the design of systems that exhibit resilience against quantum-enabled cryptanalysis, however there is a key gap in the literature around the subject of deriving tolerances for such systems. In this paper, we introduce the concept of rotation time as a measure of crypto agility, and derive an approximation that links rotation time tolerance to security risk tolerance. Historical CVE data is used to calculate illustrative values for rotation time tolerance, which is found to be of the order of hours to days. This demonstrates that using crypto agility in conjunction with hybrid encryption is an effective approach for designing quantum-resilient systems, but may necessitate challenging technical and operational tolerances in order to meet organisational risk tolerances.