DigiCert recently sponsored a Ponemon survey that revealed 61% of IT leaders are concerned their organizations are unprepared to address the security implications of quantum computing, and 74% worry that advanced attackers could conduct “harvest now, decrypt later” attacks.

You may already know that post-quantum cryptography (PQC) is the answer to quantum computing’s threats. But if you’re like the leaders we surveyed, you’re overwhelmed by the logistics of implementing PQC within your organization.

One of the many challenges we see IT leaders struggling with is how to approach key management in a PQC world. How do you manage the many tasks involved in shepherding private keys through their lifecycle?

Managing all these processes with today’s cryptography is already hard enough. But the problem gets magnified when you transition to quantum-safe keys. It’s not just the size of a large-scale transition—you also have to consider the types of devices and machines that need keys, the growth of cryptography as the primary mode of securing machines and data, and the size of the keys themselves.

Let’s take a look at these challenges and what you need to do to overcome them.

Challenge #1: Expanding key sizes

A 2048-bit RSA key is 256 bytes. While that number may sound large, it's actually a small amount of storage. The sizes of quantum-safe keys depend on the type and strength of algorithm being used, but they’re roughly ten times the size of an RSA key.

The amount of storage in quantum-safe keys is still trivial. But the increased size becomes a problem when embedded devices have limited secure storage. And since certain stateful, hash-based keys will teeter into gigabyte territory when they make the quantum-safe transition, finding adequate storage space will become an even bigger challenge.

Challenge #2: Making IoT devices quantum safe before quantum-safe keys are available

Device manufacturers typically design IoT devices to have a long service life. Why? Well, think about the alternatives. Requiring patients to undergo annual surgery to replace a pacemaker isn’t feasible because it puts them at physical risk. (Just try telling anyone, “We need to replace the private key” as a reason for surgery—good luck with that.)

Similarly, any robotic lawnmower that forces you to drop into Home Depot to replace its private key will lose market share very quickly because no one in their right mind wants to spend their Saturday dealing with that (that’s why they got a robotic lawnmower to begin with).

These devices are built to last for years—decades, even. But when cryptographically relevant quantum computers (CRQCs) arrive in the next five to ten years, they’ll put every IoT device at risk. That means any device being shipped out now needs to be quantum safe.

Quantum-safe keys are on the horizon, but they’re not yet available, which creates a sort of chicken-egg scenario. The only way to hatch the egg is to make the device fields upgradeable so quantum-safe keys can replace the current keys when the time comes. In other words, you need to make sure these devices all have quantum-safe mechanisms in place that allow future upgrades without requiring a mass recall.

Challenge #3: The number and scale of private key replacements

We already know that every machine—everything from traditional physical servers or PCs to mobile or IoT devices, websites, online apps made up of microservices, containers, and cloud instances—needs a unique machine identity. And all those machine identities (aka digital certificates) need corresponding private keys for these machines to safely exchange information.

The number of existing digital certificates is massive. Every single machine, including every device, software package, and library, is associated with a unique private key, and all of them will need to be replaced when QRQCs arrive.

And that number isn’t fixed. As organizations build more microservice-based apps, spin up new cloud instances, and add more embedded devices across their environments, the number of certificates with corresponding private keys will just continue to grow.

The size and scale of the transition is one of the biggest management challenges. The answer? A unified management platform that can:

• Discover all your keys—even the ones you don’t know about
• Manage all of them from a single pane of glass
• Automate their lifecycles

A solution like this doesn’t just simplify the complexities inherent in these challenges for your current population of keys and certificates. It will also provide you with the cryptographic agility you need to replace those keys with larger, more complex quantum-safe keys when the time comes.

The latest developments in digital trust

Want to learn more about topics like PQC, crypto-agility, and certificate lifecycle management? Subscribe to the DigiCert blog to ensure you never miss a story.