Unraveling the Pentagon’s quantum problem

Getty Images / J Studios

Defense agencies have just five years to comply with Executive Order 14412. The work starts with spreading awareness.

HONOLULU— Preparing for a quantum computer attack means two things: knowing exactly which systems will need to be upgraded and making sure everyone understands how serious the risk is to sensitive data protected by standard encryption.

“Our adversaries are using quantum. How advanced are their capabilities? We don't totally know. But the reality is that that presents some threats, and the challenge with, you know, post-quantum cryptography is this idea of ‘harvest now, decrypt later,’” said Matt McFadden, vice president of cyber for GDIT, during a panel discussion at the TechNet Info-Pacific conference here. “The reality is, with ‘harvest now, decrypt later,’ our adversaries can be harvesting data for a really, really long time,” and eventually a quantum computer will be able to break the standard encryption used today.

Post-quantum cryptography , or the mathematical algorithms needed to secure networks and systems from attacks using quantum computers, is a challenge each military service must tackle. But the White House put a timeline on it for federal agencies—by Dec. 31, 2030—for high value assets and high-impact systems “to use PQC for key establishment” in an executive order issued June 22. The deadline “to use PQC for digital signatures” is 2031.

“It’s just this one more threat vector that we have to be concerned about as we develop our resilient architecture,” said Col. Tassika Davis, Pacific Air Forces Command’s director of cyber operations and warfighter communications. “Now, we need to make sure that our architectures are cryptographically agile, so that we can shift and move and continue, and not degrade mission capability, while we are also providing the most current defense capabilities.”

To do that takes mapping the whole IT ecosystem as it is, “looking at it from the entire threat picture, and then planning against that,” she said.

It sounds simple but just knowing what exactly needs to be protected is a key, yet challenging first step, GDIT’s McFadden said during the panel.

“It's hard to migrate when you don't know what you have. So, really, the first step in this process is really having a comprehensive inventory,” he said, including certifications for apps, devices, and networks. “One of the things you realize pretty fast is like you're very reliant on third-party providers…you’ve got to really work together with the system owners, the third-party suppliers, your supply chains, and basically build that governance team to help drive” compliance and crypto agility , or the ability to combat quantum cyber threats.

Securing systems for a post-quantum threat becomes more complicated when the platforms that need to be upgraded don’t stay in one place for long.

“Ships are being extended more than they have been. There are crises that are popping up everywhere. And we used to be in a period of [ maintenance ] availabilities, which means we had about nine months to a year to do modernization. Now you’ve got 45 days,” said Capt. Victor Taylor, Pacific Fleet’s director of communications and information systems, during the panel. “So, how do I break up these big pieces of modernization into modular…shorter windows? How do I execute the configuration management? How do I have the teams to do it at scale at multiple locations? And then how do I schedule it with all the dynamic changes that are occurring? And so, if we think we're going to do that with our old processes, that's not the case.”

And part of the Pentagon and military services upgrading their high-value systems to withstand a quantum attack will be making sure individuals are aware of the quantum threat.

“The first thing is to acknowledge that it's a real problem. Like Q-Day isn't a thing that's going to be beyond our retirement. Q-Day is going to be a thing that happens …definitely within the next five years,” Peter O’Donoghue , Quantum Sky’s chief technology officer, told Defense One after the panel. “So, then you need to plan for it. You need to actually fund it.”

The Pentagon released a post-quantum cryptography strategy earlier this year. And its implementation “could be added to the Pentagon’s existing network modernization,” O’Donoghue said.

But how organizations upgrade their systems will vary—and take awareness, he said.

“There's no one-size-fits-all [solution], but I think each department, each agency needs to actually understand what the risk is and start buying it down and taking action. Like sitting on your hands and going into a kind of analysis paralysis is not the answer. Denying it is definitely not the answer either,” O’Donoghue said.

NEXT STORY: The Pentagon’s IT agency wants to bridge network gaps in the Pacific

盖蒂图片社/J Studios

国防机构只有五年时间来遵守第14412号行政命令。这项工作首先要从提高公众意识开始。

檀香山——应对量子计算机攻击意味着两件事：确切地知道哪些系统需要升级，以及确保每个人都明白受标准加密保护的敏感数据面临的风险有多严重。

“我们的对手正在使用量子技术。他们的能力究竟有多先进？我们并不完全清楚。但现实是，这确实带来了一些威胁，而后量子密码学的挑战在于‘先收集数据，后解密’的理念，”GDIT网络安全副总裁马特·麦克法登在TechNet Info-Pacific会议的小组讨论中说道。“事实上，有了‘先收集数据，后解密’的策略，我们的对手可以长时间地收集数据，”最终，量子计算机将能够破解当今使用的标准加密技术。

后量子密码学，即用于保护网络和系统免受量子计算机攻击的数学算法，是各军种都必须应对的挑战。白宫在6月22日发布的一项行政命令中，为联邦机构设定了时间表——到2030年12月31日——要求高价值资产和高影响力系统“使用后量子密码学进行密钥建立”。“使用后量子密码学进行数字签名”的最后期限是2031年。

“在我们构建弹性架构的过程中，这又多了一种需要关注的威胁来源，”太平洋空军司令部网络作战和作战人员通信主任塔西卡·戴维斯上校说。“现在，我们需要确保我们的架构在密码学上具有灵活性，这样我们才能灵活调整、转移和持续推进，在不降低任务能力的前提下，提供最先进的防御能力。”

她表示，要做到这一点，就需要绘制出整个 IT 生态系统的现状，“从整体威胁形势的角度来审视它，然后针对这种威胁制定计划”。

GDIT 的 McFadden 在小组讨论中表示，这听起来很简单，但要确切地知道需要保护什么，却是关键的第一步，也是具有挑战性的第一步。

“如果你不了解自己拥有什么，迁移就很难进行。所以，这个过程的第一步实际上是建立一个全面的清单，”他说道，其中包括应用程序、设备和网络的认证。“你会很快意识到，你非常依赖第三方供应商……你必须与系统所有者、第三方供应商、供应链密切合作，并建立一个治理团队，以帮助推动”合规性和加密敏捷性，或者说是应对量子网络威胁的能力。

当需要升级的平台不会长期停留在同一个地方时，保护系统免受后量子威胁就变得更加复杂。

“舰艇的服役期限比以往任何时候都长。危机层出不穷。过去，我们有大约九个月到一年的维护期来进行现代化改造。而现在，我们只有45天，”太平洋舰队通信和信息系统主管维克多·泰勒上校在小组讨论中说道。“那么，我该如何将这些大型现代化改造项目拆分成模块化的、更短的窗口期？我该如何执行配置管理？我该如何组建团队在多个地点大规模地开展工作？然后，我又该如何根据所有动态变化来安排进度？所以，如果我们认为可以用旧的流程来完成这些工作，那是不可能的。”

五角大楼和各军种正在升级其高价值系统以抵御量子攻击，其中一项措施就是确保个人意识到量子威胁。

“首先要承认这是一个真实存在的问题。Q日并非我们退休之后才会发生的事情。Q日肯定会在未来五年内发生，”量子天空公司首席技术官彼得·奥多诺霍在小组讨论结束后告诉Defense One。“所以，你需要为此做好规划，需要为此提供资金。”

五角大楼今年早些时候发布了一项后量子密码学战略。奥多诺霍表示，该战略的实施“可以纳入五角大楼现有的网络现代化计划中”。

但他表示，各个组织升级系统的方式各不相同，而且需要一定的意识。

奥多诺霍表示：“没有一劳永逸的解决方案，但我认为每个部门、每个机构都需要真正了解风险所在，并开始降低风险，采取行动。袖手旁观、陷入分析瘫痪并非解决之道。否认风险也绝对不是解决之道。”

下一篇报道：五角大楼信息技术机构希望弥合太平洋地区的网络差距