Home » Interview PQC with Prof. Dr. Hänggi – Part 1
Interview PQC with Prof. Dr. Hänggi – Part 1
With the rapid advances in computer technology, post-quantum cryptography is becoming increasingly important. Esther Hänggi, Professor at the Lucerne University of Applied Sciences and Arts (HSLU), is an expert in this field and has extensive specialist knowledge. On the occasion of the joint research project between essendi it AG and the HSLU, we spoke to her about the challenges, opportunities and prospects of post-quantum cryptography.
Post-quantum cryptography attempts to develop algorithms that cannot be broken even by a quantum computer. The security is based on mathematical problems that are thought to be impossible for a quantum computer to solve quickly.
Terminology
Quantum technology, quantum cryptography, post-quantum cryptography – these are all current buzzwords in IT. However, many people don’t really understand the differences between the terms. Can you briefly explain the different terms?
Yes, you have to distinguish between different “quantum” topics.
Today, quantum technology refers to technologies that actively exploit quantum physical effects.
This includes quantum computing, i.e. the use of quantum physics to perform calculations more efficiently. For example, quantum computers can break many of the cryptographic algorithms currently in use.
Quantum cryptography uses properties of quantum physics for security. The best-known example is quantum key distribution, which is used to create eavesdropping-proof communication channels. In a nutshell, security is based on the fact that quantum particles cannot be “looked at” (measured) without changing. This means that attackers can be detected. Quantum cryptography is often grouped with quantum communication.
Then there is quantum sensing, which uses quantum physics to make better or more precise measuring devices. This can be used, for example, to measure very weak magnetic fields, electric fields or temperature differences.
Post-quantum cryptography is something else. It is a subset of cryptography that does not use quantum physical phenomena. It is therefore not really one of the quantum technologies mentioned above. Post-quantum cryptography is only related to quantum physics in that it attempts to develop algorithms that cannot be broken by a quantum computer. The security is based on mathematical problems that are thought to be impossible for a quantum computer to solve quickly. However, the algorithms are “classical”, i.e. not quantum mechanical. Therefore, post-quantum algorithms do not require a quantum computer or even special hardware.
For all these topics, there are research groups that study the theory (e.g. develop the algorithms for computing or prove the security of quantum cryptography) and those that build the devices. These include physicists, but now also many engineers. These can be found both in universities and in industry.
Cryptography that is secure against quantum computers is called “quantum secure” or “quantum safe”. This includes post-quantum cryptography, but also quantum key distribution and, finally, symmetric cryptographic algorithms – i.e. encryption functions that are used when two parties already share a key, and hash functions.
Information about the project
What made you focus on the research area of the impact of post-quantum cryptography on certificate management solutions?
At the University of Applied Sciences, our goal is to bring research topics from a purely academic environment into the business world. In this respect, it was a stroke of luck that essendi it approached us. We already have research activities on this topic and now, together with essendi it, we can apply this to a real business use case. So it’s a perfect fit!
Who are the research partners?
Basically all interested parties, i.e. universities, manufacturers and government agencies. At the moment, however, a lot of public bodies are working on post-quantum cryptography, as the necessary standards are being developed and recommendations or guidelines are being made as to where and how they should be used.
How did the collaboration between HSLU and essendi it come about?
When essendi it opened its branch in Altdorf, Switzerland, Sarah Zügel, CEO of essendi it AG, contacted the Lucerne University of Applied Sciences and Arts and we exchanged ideas. In the meantime, we have already carried out several joint student projects and innovation projects.
How does the cooperation work? How are responsibilities, coordination, etc. organised?
It works very well! We at the university focus more on academic developments and implement prototypes or test systems. essendi is responsible for determining which technical and business requirements are relevant. For example, what are the technical requirements of potential customers, what performance requirements do they – and therefore the essendi xc product – have. Based on this, we define together what exactly we want to implement or test.
We regularly exchange ideas and compare notes on what is interesting and whether we should adapt something.
Focus of research
What specific aspects of certificate management are you looking at in relation to post-quantum cryptography?
Both technical and process aspects.
On the technical side, for example, how long it will take to create or verify a signature with the new algorithms and how this will affect the establishment of secure connections with TLS. How large the new certificates will be. And how the performance requirements of essendi xc can be met.
In terms of processes: for example, what transition options are available. Can different algorithms be used in parallel? How can systems be converted step by step without something suddenly not working anymore?
Are there any particular challenges or problems related to certificate management that could arise from the introduction of post-quantum cryptography? Can solutions be easily integrated into essendi xc?
Basically, post-quantum algorithms can be integrated into a certificate management solution. Although “post-quantum” contains the word “quantum”, post-quantum algorithms do not require a quantum computer or any other physical hardware. They are “normal” algorithms that work in a similar way to previous algorithms. They are simply based on mathematical problems that are thought to be impossible for quantum computers to solve quickly.
However, some of the new algorithms have slightly different properties. They take more or less time to compute, or have different key lengths. Depending on the situation and the machine the system is running on, this may not be a problem at all, or it may be a very big problem. We are trying to look into that.
One challenge that certainly arises is the question of how best to switch to “quantum-safe” algorithms. Very few systems can simply be turned off and then rebuilt. So you have to support both the old and the new world, at least for a while. And the systems you use have to be able to run both at the same time.
Thank you for the insights into the post-quantum cryptography research project that we have gained in this first part of the interview.
The second part of the interview will focus on the technical challenges of implementing these technologies and what companies can do today to prepare for them.
Prof Esther Hänggi
Our guest author, Prof Esther Hänggi, teaches Information Security Fundamentals and Quantum Computing at the Lucerne University of Applied Sciences and Arts and conducts research in these areas together with industry partners.
