Quantum: Problem and solution for the next decade of data security?

In recent years, cybercrime has become a lucrative criminal enterprise and a tool of digital warfare, enabled by cyberattacks that cost companies and governments millions in damages. It compromises trade secrets, personal information, health records, and more. In 2024, half of businesses and around a third of charities within the U.K. reported having experienced some form of cybersecurity breach or attack.

Scary stuff, but how does it relate to the quantum industry? Quantum technology is poised to become a revolutionary new threat to data security, but ironically also a solution to better protect it. Quantum computers can solve certain problems exponentially faster than conventional computers, one of which is the factorization of large prime numbers that underpins one of the most commonly used encryption schemes used today.

But quantum technology also brings us new tools to defend against this threat. These “quantum-ready” data security solutions are being created to secure our data before the threat of encryption cracking by large-scale quantum computers becomes reality.

A post-quantum world

The day quantum computers can break current encryption methods is informally known as “Q-Day” or “Y2Q.” Opinions vary about when Q-Day will arrive—ranging from a few years to several decades. Some headlines even suggest it may have already occurred, and national security concerns may also lead countries to conceal their actual progress.

Ignoring the quantum threat entirely is increasingly seen as a significant risk. This has spurred investment and interest in “quantum-ready” cybersecurity solutions for both hardware and software. Beyond the threat from quantum computing, these “quantum-ready” solutions are also being aimed at users with long-standing data security vulnerabilities.

The first wave of disruption has already begun as we enter an era of “post-quantum cryptography” (PQC) algorithm adoption. This software-based approach to increasing security essentially changes the method of encryption to a problem that quantum computers should have just as much difficulty cracking as a classical computer. PQC solution providers and governments are raising awareness about the need for crypto-agility, and the market for dedicated quantum-ready platforms is already growing.

Upgrading to PQC, encryption is an important first step in defending against the quantum threat. However, long-term safety is expected to depend on quantum hardware, including quantum random number generators (QRNG; see Fig. 1) and quantum key distribution (QKD).

Playing dice with the universe

Exchanging virtual secrets relies on the production and exchange of keys. Once two parties share a key, it can be used to encode messages that only they can decrypt. In the modern era, random number generators (RNGs) create these keys for private and public use. The challenge is that if a key is generated predictably, a malicious third party can deduce the next key and imitate the trusted party. During the past few years, high-profile security breaches have occurred because of poor entropy (randomness) in the numbers used for encryption or, in some cases, even intentional backdoors.

Classical RNGs depend on deterministic processes. While a dice roll may seem to offer statistical randomness, the more you know about the dice, throw, and environment, the more predictable the outcome. Quantum physics, however, is full of nondeterministic and truly random phenomena, such as the number or time of photons emitted, detected, or deflected by a beamsplitter (see Fig. 2). Quantum random number generators (QRNGs) can harness this property to improve the quality of keys generated for cybersecurity.

Chipscale QRNG devices have already been commercialized by the consumer market, with ID Quantique partnering with SK Telecom to integrate their hardware into a line of Samsung smartphones, although these are currently only available in Korea. The newest model, the Galaxy Quantum 5, was released in September 2024. But competition for market share is increasing, and multiple startups are now entering the QRNG industry. These players are finding success within the security industry and areas like gambling and gaming. In the coming years, these players expect cryptography market demands to rise as industry standards become clearer.

Looking ahead, innovation to improve entropy, generation rates, and power consumption will continue. These differentiators already prompted significant stakeholder partnerships in 2024, such as Quantum Dice and BT. But QRNG alone does not offer complete protection from data hackers, and a more complex solution for key distribution may be required.

Quantum keys

Quantum key distribution (QKD) replaces the classical signal pulse with a quantum state of light. Quantum states cannot be cloned or read without disturbing the state, which allows the receiver of the message to detect tampering at a fundamental level. QKD-encoded messages can be sent over existing optical fiber networks, but they require specialized hardware to decode the message.

Quantum networks using QKD are being rolled out within multiple regions and cities, with companies such as ID Quantique and Toshiba deploying their products in pilot projects.

This technology still faces several hurdles. The current limitations on network scalability mean that its primary users are governments and certain financial institutions. The high cost of installing transmitter-receiver pairs, which can exceed a million dollars, remains a significant barrier. Nevertheless, as global efforts to enhance scalability continue, including the development of chipscale QKD, the potential market could grow, especially with trends like V2X and automotive autonomy.

In the near term, there are concerns about the limitations of QKD compared to PQC, particularly for immediate protection needs. Transitioning between cryptographic schemes is a lengthy process, and most experts agree that relying solely on QKD at this stage could be risky.

Furthermore, outside the quantum industry, there is an ongoing ethical debate about encryption, such as how data access rights should differ between law enforcement, government, and social media companies.

Single-photon detector hardware rivalry

Finally, another element of the quantum communications industry is the development of highly sensitive and ultralow-noise single-photon detector hardware to enable QKD systems. QKD systems today are split between semiconductor-based detectors such as single-photon avalanche diodes (SPADs), and superconducting detectors like superconducting nanowire single-photon detectors (SNSPDs).

ID Quantique currently offers both SPAD and SNSPD detectors for applications, including QKD. Meanwhile, the £1.5 million ($1.86M) Innovate UK MARCONI project aims to develop a novel SPAD and SNSPD solution to develop a scalable national QKD network for information security purposes. The SPAD solution will be a cheaper detector for short-range QKD, while the SNSPD will perform better for long-range communications.

It remains to be seen if SPADs and SNSPDs can truly complement each other in developing quantum communications networks in the long term or if players are simply hedging their bets.

Market outlook

Even ignoring the threat from quantum computers to encryption, existing cryptography technology is increasingly essential and outdated. Almost every industry would benefit from scrutinizing its crypto-agility, including post-quantum approaches.

But the hardware opportunity may be more limited. The adoption of QRNGs is growing, but the competition from incumbent hardware RNG in terms of size, cost, and ease of implantation is very high within the consumer electronics and automotive market. The greater hardware opportunity for both QRNG and QKD is likely limited to data centers in the medium term—a sector with big growth potential, but perhaps more limited than some would suggest from the perspective of quantum communications supply chain players.