## wpiea2021071-print-pdf

## Source details

**Canonical URL:** [wpiea2021071-print-pdf](https://www.imf.org/-/media/files/publications/wp/2021/english/wpiea2021071-print-pdf.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/wp/2021/english/wpiea2021071-print-pdf.pdf.md)
- [Structured JSON version](/-/media/files/publications/wp/2021/english/wpiea2021071-print-pdf.pdf.json)

---

### I. Executive summary and introduction
- The quantum revolution is underway, with the pace of innovations accelerating in recent years.
- Quantum computing: use of quantum physics to perform calculations intractable for even the most powerful classical supercomputers.
- If a fully functional quantum computer is built (or existing models are used to solve practical tasks beyond conventional limits), it would have profound implications for the global economy and the financial sector.
- Key risks:
  - Quantum computers could crack many cryptographic algorithms underpinning today’s cybersecurity.
  - Retroactive (“harvest now, decrypt later”) risks: currently captured and stored encrypted information may be decipherable once efficient quantum computers are created.
- Immediate preparatory steps urged now:
  - Raise awareness of potential risks.
  - Assess future and retroactive risks from quantum computers.
  - Develop plans to migrate current cryptography to quantum-resistant algorithms once standards are available.
  - Take an inventory of public-key cryptography used internally and by partners/third-party suppliers.
  - Build cryptographic agility to improve overall cybersecurity resilience.
- Historical note: past algorithm replacements—though simpler than a post-quantum transition—have been extremely disruptive and can take years or decades.

### II. What is quantum computing? (definitions, principles, milestones)
- Definitions and principles:
  - Uses phenomena such as superposition and entanglement.
  - Qubit: basic unit; represents both zero and one (superposition).
  - Entanglement: changing the state of one element affects other entangled elements instantly.
- Exponential state-space growth (numerical illustrations preserved):
  - Modeling a quantum computer with 54 qubits requires 2^54 = 18,014,398,509,481,984 traditional bits (about 18 quadrillion bits).
  - Modeling 72 qubits requires 2^72, about 5 Sextillion bits.
  - A 100-qubit quantum computer would require more bits than all atoms of planet earth.
  - A 280-qubit machine would require more bits than all atoms in the known universe.
- Quantum speedup and algorithms:
  - Grover’s algorithm: polynomial speedup (example: quantum 1,000 steps vs classical 1,000,000 steps).
  - Shor’s algorithm: exponential speedup (quantum time T vs classical 2^T).
- Recent milestones and industry activity:
  - 2019: Google’s 54-qubit Sycamore processor (53 qubits operational) executed a task in 200 seconds; Google estimated the most powerful digital supercomputer would take 10,000 years for the same task.
  - IBM contested Google’s estimate, claiming a modified Summit supercomputer could obtain similar results in about 3 days.
  - December 2020: University of Science and Technology of China’s Jiuzhang photon quantum computer performed a calculation in 200 seconds that would take a supercomputer 2.5 billion years.
  - As of January 2021, IBM deployed 28 quantum computers for public and commercial use through cloud services; IBM released a roadmap to produce a 1,000-plus qubit device called Quantum Condor by the end of 2023.
  - Microsoft Azure and AWS Bracket launched beta quantum cloud services; at least 87 known projects worldwide to build quantum systems using different core technologies.
- Error rates and quantum error correction:
  - Superposition and entanglement are fragile; interaction with environment produces computation errors.
  - No-cloning principle prevents copying qubit states; Shor’s 1994 proposal: use many physical qubits to create one logical qubit via quantum error correcting codes.
  - IBM’s quantum volume metric accounts for qubit count, error rate, and connectivity quality; IBM expects quantum volume to more than double every year.
  - Today's devices have error rates that are too high for many practical applications.
- Hardware categories and qubit implementations:
  - Two general categories: (i) gate-based quantum computers and (ii) analog quantum computers (e.g., quantum annealers).
  - D-Wave processor: experimental quantum annealer with over 5,000 qubits.
  - Implementations: superconducting qubits (Alibaba, IBM, Google, D-Wave, Rigetti), trapped ion qubits (IonQ), photonic quantum computers (Xanadu, University of Science and Technology of China).
- Near-term outlook:
  - Quantum computers expected to complement, not replace, classical computers.
  - Public access via cloud services already available; near-term applications likely hybrid quantum-classical.

### III. Potential benefits for finance and broader science
- Finance-specific advantages:
  - Simulation: Monte Carlo-based methods used to price financial instruments and manage risks could be performed almost in real time without unrealistic model simplifications.
  - Optimization: More accurate optimizations (portfolio allocation, capital allocation, ATM cash management, productivity) far faster and without heavy approximations.
  - Machine learning: Quantum speedup could accelerate ML tasks (neural networks, deep learning), mitigating the curse of dimensionality and enabling more complex and accurate analyses (credit scoring, fraud detection).
- Broader scientific and industrial impacts:
  - Precision modeling of molecular interactions, chemical reaction optimization, energy storage, material science, drug discovery, vaccines, weather forecasts, traffic routing, supply-chain optimization, and climate-change understanding.
  - Example: designing new catalysts to produce fertilizers more efficiently—a process which today accounts for over 2 percent of the world’s carbon emissions.
- Quantum networks and communications:
  - Quantum teleportation and quantum key distribution (QKD) enable secure, entanglement-based data transmission; long-distance secure communications experimentally confirmed.
  - China: quantum satellite experiments (launched 2016) and satellite-based QKD used by ICBC and the People’s Bank of China for exchanges between distant cities such as Beijing and Urumqi.
  - Netherlands: Delft University of Technology building a network connecting four cities with quantum technology.
  - U.S.: Caltech-led consortium demonstrated sustained, high-fidelity quantum teleportation across 44 kilometers of fiber in the Caltech Quantum Network and the Fermilab Quantum Network.
- Quantum sensing:
  - Advances in quantum radar, imaging, metrology, and navigation with greater precision and sensitivity.
  - DARPA’s Quantum-Assisted Sensing and Readout (QuASAR) program aims to develop measurement devices for biological imaging, inertial navigation, and robust global positioning systems.

### IV. Potential risks and cryptographic impact
- Primary systemic risk: threat to modern cryptography with far-reaching implications for financial stability and privacy.
- Cryptography categories and quantum impact (preserve numeric and technical detail):
  - Symmetric-key cryptography:
    - Current standards recommend AES with 256-bit keys (AES 256).
    - Breaking a 256-bit AES key with brute force would require trying 2^256 combinations—estimated more than 7 billion years for a classical supercomputer (CISA, 2019).
    - Grover’s algorithm may reduce complexity by half (2^n to 2^(n/2)), but would still take millions of years to break AES 256 with known methods; AES 256 and similar symmetric methods are considered quantum resistant for now.
  - Hash functions:
    - Believed to be quantum resistant under determined conditions.
    - Grover’s algorithm reduces reversal time from 2^n to 2^(n/2); longer hash outputs like SHA-3 family (typically 256-bit outputs) are considered quantum safe for now.
  - Public (asymmetric) keys:
    - Vulnerable: a fully functioning quantum computer can break asymmetric keys in a few hours using Shor’s algorithm and related optimizations (Gidney et al., 2019).
    - Researchers believe future optimizations could allow quantum computers to break today’s public keys in less time than it takes to generate them using classical computers (Monz et al., 2016 and Anschuetz et al., 2018).
- Critical security services underpinned by public-key cryptography:
  - Authentication/authorization, privacy/confidentiality, and integrity.
  - Digital certificates and digital signatures rely on asymmetric keys; forging signatures would enable spending others’ funds or masquerading as any entity.
- Examples of affected systems and prevalence:
  - Online/Mobile Banking: attackers using quantum computers may compromise public keys for standard Internet protocols and eavesdrop on communications; could forge transactions by compromising authentication/authorization schemes.
  - CBDC and blockchain networks: attackers may extract valid wallet keys from publicly available records, allowing appropriation of users’ credits and tokens.
  - ATMs and private networks: can be tapped; public-key encryption weaknesses could enable forging of transactions.
  - Business-to-business point-to-point networks, VPN communications, and recorded encrypted data are vulnerable to full channel compromise and retroactive decryption.
  - HTTPS is used by 96 percent of Internet websites (Google Report, 2020).
- Trajectory and uncertainty:
  - Quantum computing is characterized as an existential threat to many business sectors that rely on asymmetric cryptography for day-to-day operations (ETSI, 2020).
  - Symmetric encryption and hashing are quantum-safe today if longer keys are used, but advances in quantum computing and algorithmic improvements may eventually target advanced symmetric cryptography and cryptographic hashing functions.
- Historical migration experience:
  - Past replacements of widely deployed cryptographic algorithms suggest it takes at least a decade to replace a widely deployed cryptographic algorithm (National Academies of Sciences, 2019).
  - Migration to quantum-resistant algorithms likely to be much more complex due to ubiquitous use of public keys and legacy systems without software updates.
- Current readiness:
  - More than 50 percent of organizations, including government agencies, admit running outdated software.

### V. Recommended way forward (actionable guidance and framework)
- High-level recommendations:
  - For financial regulators: raise awareness about quantum-related risks across the financial sector.
  - For financial institutions:
    - Assess both future and retroactive risks from quantum computers, including information already captured or being captured now that could be decrypted later.
    - Develop migration plans to transition current cryptography to post-quantum (quantum-resistant) algorithms once standards become available.
    - Inventory all uses of public-key cryptography internally and across partners/third-party suppliers to identify components that will require transition.
    - Build cryptographic agility to facilitate future algorithm replacements and improve cybersecurity resilience.
- Migration framework stages (ETSI, 2020 framework):
  - Inventory compilation:
    - Identify cryptographic assets (hardware and software) and processes affected.
    - Manage business process, allocate budget, and ensure accountability.
    - Costs could be significant: financial, temporal, organizational, and technical.
  - Preparation of the migration plan:
    - Decide whether an asset will be migrated or retired; sequence migration given asset interdependencies.
    - If backwards compatibility is required, applications may have to support both classical and quantum-safe algorithms via individual, hybrid, or other approaches depending on cryptographic agility.
    - Provisions for cryptographic agility should be considered for any new or updated cryptography; vulnerabilities in quantum-safe algorithms may require switching or patching.
  - Migration execution:
    - Implement the migration plan and include mitigation management.
    - Conduct exercises to simulate and test the migration plan; these exercises can uncover missing inventory elements.
    - Emergency migration may be required if a viable quantum computer is immediately available to attack public keys.
- Cryptographic agility:
  - Build cryptographic agility to permit smooth changing or upgrading of cryptographic algorithms or parameters to improve cybersecurity resilience.
- Long-term measures:
  - Consider implementation of quantum cryptographic methods to reduce cybersecurity risks.

### VI. Standards, timelines, and industry initiatives
- Standards development:
  - NIST is running a competition for a quantum-safe encryption algorithm, targeting to announce a winner by 2024 (NIST, 2020).
  - ETSI is spearheading deployment of quantum-safe standards in Europe (ETSI, 2015, 2017, 2020), informing ITU and IETF activities.
- Industry actions:
  - IBM announced in November 2020 plans to add quantum-safe cryptography to its cloud services.
- Multilateral and regulatory roles:
  - Regulators should work with industry experts to understand privacy and regulatory implications (e.g., Gramm-Leach-Bliley Act, 1999; GDPR, 2018).
  - IMF roles: raise awareness of member countries about financial stability risks, promote quantum-safe standards and practices, encourage multilateral collaboration, and at the bilateral level encourage authorities to develop encryption migration plans in financial sector surveillance.

### VII. Threats to financial sector operations (detailed examples)
- Online/Mobile Banking:
  - Compromise of public keys for Internet protocols enables eavesdropping, forging transactions, and counterfeit financial activity.
- Payment Transactions and Cash Withdrawals:
  - ATMs and private networks vulnerable to forging of transactions via public-key weaknesses.
- Business-to-Business Privacy:
  - Corporate point-to-point networks using public-key encryption are vulnerable to full channel compromise; captured information enables impersonation and future decryption of recorded secrets.
- VPN Communications:
  - VPNs used by staff typically use public-key encryption and are vulnerable to the same issues as B2B connections.
- Blockchain-based digital assets and password-protected web applications:
  - Rely on public-key cryptography; vulnerable to quantum attacks.
- Prevalence datum:
  - HTTPS is noted as the best known protocol, used by 96 percent of Internet websites (Google Report, 2020).

### VIII. Cryptography history, vulnerabilities, and annexed technical highlights
- Evolution and milestones:
  - 1976: Diffie-Hellman key exchange introduced asymmetric cryptography.
  - 1977: RSA public-key cryptosystem published.
  - 1997: DES was broken in a public competition.
  - 1999: Triple-DES became standard after DES was broken; NIST later adopted AES in the early 2000s.
- Algorithm-specific highlights and numeric parameters preserved:
  - AES: key sizes 128, 192, and 256 bits with 10, 12, and 14 rounds respectively.
  - DES: 56-bit key; cracked in 1998 using a machine that took 3 days to find the key (EFF, 1999).
  - Triple-DES (TDEA): introduced in 1995; NIST is deprecating Triple-DES by the end of 2023 (NIST, 2019).
  - RSA: current standard RSA 2,048-bit key would take "billions of years" for a digital computer to break (CISA, 2019).
  - MD5: produces a 128-bit hash digest; officially retired by NIST in 2011.
  - SHA-1: produces a 160-bit digest; deprecated by NIST in 2011.
  - SHA-2: digest sizes 224, 256, 384, or 512 bits with 64 or 80 rounds.
  - SHA-3 (Keccak): digest sizes 224, 256, 384, and 512.
- Implementation and side-channel risks:
  - Side-channel attacks often target software, firmware, and hardware implementations rather than underlying mathematics.
  - Heartbleed (CMU, 2014) cited as a devastating implementation vulnerability in OpenSSL.
  - Between 2011 and 2014, 17 percent of vulnerabilities in cryptographic libraries published by CVE were due to development-phase mistakes, while 83 percent were related to misuse or misconfiguration by hosting applications (Lazar et. al., 2014).
- Annex IV key algorithm highlights (selected):
  - Symmetric: Enigma, DES, Triple-DES, AES, Twofish.
  - Asymmetric: Diffie-Hellman, ElGamal, RSA, ECDSA, SIDH.
  - Hashes: MD5, SHA-1, SHA-2, SHA-3.

### IX. Technical glossary highlights (selected definitions from Annex I)
- Cryptanalysis: studies ciphertext to gain information about the original message.
- Cryptography: the science of transmitting secret information using public channels; involves transforming plaintext into ciphertext using keys.
- Cryptographic agility (crypto agility): property that permits changing or upgrading cryptographic algorithms or parameters.
- HTTPS: Web communication protocol used for secure communication; encrypts information sent between users and websites.
- Quantum computing: use of a non-classical model of computation transforming memory into quantum superposition of possible classical states.
- Quantum key distribution (QKD): secure communication method implementing a cryptographic protocol involving quantum mechanics to produce a shared random secret key.
- Qubit: basic unit of quantum information, a two-state quantum-mechanical system.
- Symmetric key vs Asymmetric cryptography: symmetric uses same key for encryption/decryption; asymmetric uses a pair of related keys (public/private).

*Source: wpiea2021071-print-pdf — IMF working paper (extracts, annexes, and references)*

### Annex I. Glossary of Technical Terms Used in the Paper .................................................. 18

### Annex I. Glossary of Technical Terms Used in the Paper

### Location
- Page: 18

### Context
- Annex I is the glossary of technical terms used in the paper.

*https://www.imf.org/-/media/files/publications/wp/2021/english/wpiea2021071-print-pdf.pdf*

### References..............................................................................................................

### wpiea2021071-print-pdf - References..................................................................................................

### I. INTRODUCTION
- The quantum revolution is underway, with the pace of innovations accelerating in recent years.
- Quantum computing: use of quantum physics to perform calculations intractable for even the most powerful classical supercomputers.
- Leading technological companies have developed working prototypes and provided cloud access; dozens of projects worldwide using different core technologies.
- If a fully functional quantum computer is built (or existing models are used to solve practical tasks beyond conventional limits), it would have profound implications for the global economy and the financial sector.
- Key risks highlighted:
  - Quantum computers could crack many cryptographic algorithms underpinning today’s cybersecurity.
  - Retroactive (“harvest now, decrypt later”) risks: currently captured and stored encrypted information may be decipherable once efficient quantum computers are created.
- Immediate preparatory steps for financial institutions and regulators:
  - Raise awareness of potential risks.
  - Assess future and retroactive risks from quantum computers.
  - Develop plans to migrate current cryptography to quantum-resistant algorithms once standards are available.
  - Take an inventory of public-key cryptography used internally and by partners/third-party suppliers.
  - Build cryptographic agility to improve overall cybersecurity resilience.
- Past algorithm replacements—though simpler than a post-quantum transition—have been extremely disruptive and can take years or decades; therefore, action is urged now.

### II. WHAT IS QUANTUM COMPUTING?
- Definitions and principles:
  - Quantum computing uses phenomena such as superposition and entanglement.
  - Qubit: basic unit; represents both zero and one (superposition).
  - Entanglement: changing the state of one element affects other entangled elements instantly.
- Exponential state-space growth and illustrative numerical examples:
  - Modeling a quantum computer with 54 qubits requires 2^54 = 18,014,398,509,481,984 traditional bits (about 18 quadrillion bits).
  - Modeling 72 qubits requires 2^72, about 5 Sextillion bits.
  - A 100-qubit quantum computer would require more bits than all atoms of planet earth.
  - A 280-qubit machine would require more bits than all atoms in the known universe.
- Quantum speedup and algorithms:
  - Grover’s algorithm: polynomial speedup (example: quantum 1,000 steps vs classical 1,000,000 steps).
  - Shor’s algorithm: exponential speedup (quantum time T vs classical 2^T).
- Recent milestones and industry activity:
  - 2019: Google’s 54-qubit Sycamore processor (53 qubits operational) executed a task in 200 seconds; Google estimated the most powerful digital supercomputer would take 10,000 years for the same task.
  - IBM contested Google’s estimate, claiming a modified Summit supercomputer could obtain similar results in about 3 days (not shown in practice).
  - December 2020: University of Science and Technology of China’s Jiuzhang photon quantum computer performed a calculation in 200 seconds that would take a supercomputer 2.5 billion years.
  - As of January 2021, IBM deployed 28 quantum computers for public and commercial use through cloud services; IBM released a roadmap to produce a 1,000-plus qubit device called Quantum Condor by the end of 2023.
  - Microsoft Azure and AWS Bracket launched beta quantum cloud services; at least 87 known projects worldwide to build quantum systems using different core technologies.
- Error rates and quantum error correction:
  - Superposition and entanglement are fragile; interaction with environment produces computation errors.
  - No-cloning principle prevents copying qubit states; Shor’s 1994 proposal: use many physical qubits to create one logical qubit via quantum error correcting codes.
  - IBM’s quantum volume metric accounts for qubit count, error rate, and connectivity quality; IBM expects quantum volume to more than double every year.
  - Today's devices have error rates that are too high for many practical applications.
- Hardware categories and qubit implementations:
  - Two general categories: (i) gate-based quantum computers (similar architecture to classical logical gates) and (ii) analog quantum computers (e.g., quantum annealers).
  - D-Wave processor: experimental quantum annealer with over 5,000 qubits.
  - Implementations: superconducting qubits (Alibaba, IBM, Google, D-Wave, Rigetti), trapped ion qubits (IonQ), photonic quantum computers (Xanadu, University of Science and Technology of China).
- Near-term outlook:
  - Quantum computers expected to complement, not replace, classical computers.
  - Public access via cloud services already available; near-term applications likely hybrid quantum-classical.

### III. POTENTIAL BENEFITS OF QUANTUM COMPUTING
- Main areas of advantage for finance: simulation, optimization, and machine learning (ML).
- Simulations:
  - Monte Carlo-based methods (used to price financial instruments and manage risks) are computationally intensive; quantum computing could perform such simulations almost in real time without unrealistic model simplifications.
- Optimization:
  - Quantum computers could perform more accurate optimizations (portfolio allocation, capital allocation, ATM cash management, productivity) far faster and without heavy approximations.
- Machine learning:
  - Quantum speedup could accelerate ML tasks (neural networks, deep learning), mitigating the curse of dimensionality and enabling more complex and accurate analyses (credit scoring, fraud detection).
- Broader scientific and industrial impacts:
  - Precision modeling of molecular interactions, chemical reaction optimization, energy storage, material science, drug discovery, vaccines, weather forecasts, traffic routing, supply-chain optimization, and climate-change understanding.
  - Example: designing new catalysts to produce fertilizers more efficiently—a process which today accounts for over 2 percent of the world’s carbon emissions.
- Quantum networks and communications:
  - Quantum teleportation and quantum key distribution (QKD) enable secure, entanglement-based data transmission; long-distance secure communications experimentally confirmed.
  - China: quantum satellite experiments (launched 2016) and satellite-based QKD used by ICBC and the People’s Bank of China for exchanges between distant cities such as Beijing and Urumqi.
  - Netherlands: Delft University of Technology building a network connecting four cities with quantum technology.
  - U.S.: Caltech-led consortium demonstrated sustained, high-fidelity quantum teleportation across 44 kilometers of fiber in the Caltech Quantum Network and the Fermilab Quantum Network.
- Quantum sensing:
  - Advances in quantum radar, imaging, metrology, and navigation with greater precision and sensitivity.
  - DARPA’s Quantum-Assisted Sensing and Readout (QuASAR) program aims to develop measurement devices for biological imaging, inertial navigation, and robust global positioning systems.

### IV. POTENTIAL RISKS OF QUANTUM COMPUTING
- Primary systemic risk: threat to modern cryptography with far-reaching implications for financial stability and privacy.
- Cryptography categories and quantum impact:
  - Symmetric-key cryptography:
    - Current standards recommend AES with 256-bit keys (AES 256).
    - Breaking a 256-bit AES key with brute force would require trying 2^256 combinations—estimated more than 7 billion years for a classical supercomputer (CISA, 2019).
    - Grover’s algorithm may reduce complexity by half (2^n to 2^(n/2)), but would still take millions of years to break AES 256 with known methods; AES 256 and similar symmetric methods are considered quantum resistant for now.
  - Hash functions:
    - Believed to be quantum resistant under determined conditions.
    - Grover’s algorithm reduces reversal time from 2^n to 2^(n/2); longer hash outputs like SHA-3 family (typically 256-bit outputs) are considered quantum safe for now.
  - Public (asymmetric) keys:
    - Vulnerable: a fully functioning quantum computer can break asymmetric keys in a few hours using Shor’s algorithm and related optimizations (Gidney et al., 2019).
    - Researchers believe future optimizations could allow quantum computers to break today’s public keys in less time than it takes to generate them using classical computers (Monz et al., 2016 and Anschuetz et al., 2018).
- Critical security services underpinned by public-key cryptography:
  - Authentication/authorization, privacy/confidentiality, and integrity.
  - Digital certificates and digital signatures rely on asymmetric keys; forging signatures would enable spending others’ funds or masquerading as any entity.
- Figure references in source (not reproduced here): depiction of types of cryptographic algorithms and selected risks to the financial sector.

### V. RECOMMENDED WAY FORWARD (summary of actionable guidance)
- For financial regulators:
  - Raise awareness about quantum-related risks across the financial sector.
- For financial institutions:
  - Assess both future and retroactive risks from quantum computers, including information already captured or being captured now that could be decrypted later.
  - Develop migration plans to transition current cryptography to post-quantum (quantum-resistant) algorithms once standards become available.
  - Inventory all uses of public-key cryptography internally and across partners/third-party suppliers to identify components that will require transition.
  - Build cryptographic agility to facilitate future algorithm replacements and improve cybersecurity resilience.
- Rationale:
  - Algorithm transitions—even simpler historical ones—have been disruptive and protracted; early preparation is imperative.

*Source: wpiea2021071-print-pdf - References..........................................................................................................*

### 1. Online/Mobile Banking. Using a quantum computer, an attacker may compromise

### wpiea2021071-print-pdf - 1. Online/Mobile Banking. Using a quantum computer, an attacker may compromise

### Major threats to financial sector operations
- Online/Mobile Banking
  - Using a quantum computer, an attacker may compromise public keys for standard Internet protocols and eavesdrop on any communications between users and financial institutions.
  - An attacker may compromise the authentication and authorization schemes, whether it’s session-token or public-key based, enabling forging of transactions and counterfeit financial-system activity.
  - In the case of central bank digital currencies (CBDC) and blockchain networks, attackers may extract valid wallet keys from publicly available records, granting them the ability to appropriate users’ credits and tokens.
- Payment Transactions and Cash Withdrawals
  - ATMs connected through private networks can be tapped; attackers can exploit public-key encryption weaknesses to forge transactions using the same venues applicable to online or mobile banking.
- Business-to-Business Privacy
  - Corporate point-to-point networks using public-key encryption are vulnerable to full channel compromise. Captured information enables impersonation of users or servers via man-in-the-middle attacks.
  - Forged certificates could allow attackers to add their own resources to enterprise networks.
  - Attackers can record currently encrypted data and decrypt it once a quantum computer is available, revealing trade secrets in the future.
- VPN Communications
  - VPN connections used by staff of financial institutions to access internal resources typically use public-key encryption and are vulnerable to the same issues as business-to-business connections.
- Other affected applications
  - Blockchain-based digital assets such as Bitcoin or Ethereum and password-protected web applications rely on public-key cryptography. HTTPS is noted as the best known protocol, used by 96 percent of Internet websites (Google Report, 2020).

### Technological trajectory and cryptographic risks
- Quantum computing is characterized as an existential threat to many business sectors that rely on asymmetric cryptography for day-to-day operations (ETSI, 2020).
- Symmetric encryption and hashing are quantum-safe today if longer keys are used, but:
  - Advances in quantum computing and algorithmic improvements (e.g., ongoing refinements to Shor’s algorithm) may reduce required quantum hardware capabilities and could eventually target advanced symmetric cryptography and cryptographic hashing functions.
- Historical migration precedents and timelines
  - Past replacements of widely deployed cryptographic algorithms suggest it takes at least a decade to replace a widely deployed cryptographic algorithm (National Academies of Sciences, 2019).
  - Migration to quantum-resistant algorithms is likely to be much more complex due to ubiquitous use of public keys and legacy systems without software updates.
- Current readiness
  - More than 50 percent of organizations, including government agencies, admit running outdated software.

### Standards, timelines, and ongoing initiatives
- Standards development
  - NIST is running a competition for a quantum-safe encryption algorithm, targeting to announce a winner by 2024 (NIST, 2020).
  - ETSI is spearheading deployment of quantum-safe standards in Europe (ETSI, 2015, 2017, 2020), informing ITU and IETF activities.
- Industry actions
  - IBM announced in November 2020 plans to add quantum-safe cryptography to its cloud services, on top of the current standards.

### Migration framework and operational recommendations (ETSI, 2020 framework)
- Overall guidance
  - Financial institutions should develop plans to migrate current cryptography to quantum-resistant algorithms and build cryptographic agility.
- Framework stages
  - Inventory compilation
    - Identify the set of cryptographic assets (both hardware and software) and processes affected by quantum computing.
    - Manage the business process, allocate a budget, and ensure accountability.
    - Costs could be significant, including financial, temporal, organizational, and technical provisions.
  - Preparation of the migration plan
    - Decide whether an asset will be migrated or retired; sequence migration given asset interdependencies.
    - If backwards compatibility is required, applications may have to support both classical and quantum-safe algorithms via individual, hybrid, or other approaches depending on cryptographic agility.
    - Provisions for cryptographic agility should be considered for any new or updated cryptography; vulnerabilities in quantum-safe algorithms may require switching or patching.
  - Migration execution
    - Implement the migration plan and include mitigation management.
    - Conduct exercises to simulate and test the migration plan; these exercises can uncover missing inventory elements.
    - The framework assumes an orderly, planned migration, but immediate availability of a viable quantum computer used to attack public keys could require emergency migration and quick simultaneous execution of key measures.
- Cryptographic agility
  - Build cryptographic agility to permit smooth changing or upgrading of cryptographic algorithms or parameters to improve cybersecurity resilience.
- Long-term measures
  - Over the longer term, there may be a need to implement quantum cryptographic methods to reduce cybersecurity risks.

### Regulatory, privacy, and multilateral actions
- Privacy and regulation
  - Quantum computing raises important privacy risks; regulators should work with industry experts to understand these risks.
  - Existing regulations referenced include the United States Gramm-Leach-Bliley Act (Gramm-Leach, 1999) and the European General Data Protection Regulation (GDPR, 2018), which may require further scrutiny to ensure quantum-resistant encryption of data exchange and storage.
  - Because quantum computers represent retroactive risks, the time for action is now.
- Role of regulators and the IMF
  - Regulators can raise awareness of current and forthcoming risks and challenges.
  - IMF roles:
    - Raise awareness of member countries about financial stability risks from quantum computers.
    - Promote quantum-safe standards and practices.
    - Encourage multilateral collaboration on common standards and protocols to ensure interoperability.
    - At the bilateral level, encourage authorities to develop encryption migration plans in financial sector surveillance, for example as part of dialogues on operational resilience of financial institutions, markets, and infrastructure.

### Technical glossary highlights (selected terms as defined in the text)
- Cryptanalysis: studies ciphertext to gain information about the original message.
- Cryptography: the science of transmitting secret information using public channels; involves transforming plaintext into ciphertext using keys.
- Cryptographic agility (crypto agility): property that permits changing or upgrading cryptographic algorithms or parameters.
- HTTPS: Web communication protocol used for secure communication; encrypts information sent between users and websites.
- Quantum computing: use of a non-classical model of computation transforming memory into quantum superposition of possible classical states.
- Quantum key distribution (QKD): secure communication method implementing a cryptographic protocol involving quantum mechanics to produce a shared random secret key.
- Qubit: basic unit of quantum information, a two-state quantum-mechanical system.
- Symmetric key vs Asymmetric cryptography: symmetric uses same key for encryption/decryption; asymmetric uses a pair of related keys (public/private).

*Source: wpiea2021071-print-pdf*

### 1977. After DES was broken in a public competition in 1997, it was replaced as standard by

### 1977. After DES was broken in a public competition in 1997, it was replaced as standard by

### Evolution and milestones in cryptography
- Until the mid-1970s cryptography relied on symmetric keys, requiring senders and receivers to share keys in advance.
- 1976: Whitfield Diffie, Martin Hellman, and Ralph Merkle introduced the Diffie-Hellman key exchange enabling asymmetric cryptography and key agreement over a public channel.
- 1977: Rivest, Shamir and Adleman (RSA) extended the public-key concept with publishable public keys and secret private keys.
- Asymmetric/public-key cryptography enabled use cases including key exchanges, digital signatures, non-repudiation, authentication, and underpins digital currencies and blockchain technologies.
- 1997: DES was broken in a public competition.
- Triple-DES was introduced in 1995 as an interim response to DES weaknesses.
- 1999: Triple-DES became standard after DES was broken.
- Early 2000s: NIST adopted Advanced Encryption Standard (AES), retiring Triple-DES as the standard replacement to DES.

### Quantum computing: threat and opportunity
- Asymmetric/public-key cryptography is the most vulnerable to quantum computing.
- Early 1980s: Richard Feynman identified difficulties in simulating quantum mechanical systems on classical computers and proposed quantum computers as a solution.
- 1994: Peter Shor published an algorithm enabling much faster prime factorization using quantum properties, threatening the security foundations of most asymmetric cryptography.
- Quantum mechanics also enables unbreakable key distribution approaches:
  - 1980s–1990s: IBM researchers proposed Quantum Key Distribution (QKD) leveraging photon polarization; QKD can be impenetrable because eavesdroppers cannot intercept without interfering.
  - QKD experimental systems have been implemented since the 1990s but are "very far from commercial use."

### Modern cryptographic algorithms and vulnerabilities (Annex III summary)
- Three main algorithm types: symmetric keys, asymmetric (public) keys, and algorithmic hash functions (hashing).
- AES:
  - NIST selected AES in 2001 to replace Triple-DES.
  - AES key sizes: 128, 192, and 256 bits with 10, 12, and 14 rounds respectively.
  - Cryptanalysis attempts (e.g., Biryukov et al., 2010) proposed attacks reducing strength for some variations, but these were deemed impractical or non-threatening to AES overall.
  - A side-channel attack in 2009 reduced AES key strength slightly; Biryukov et al. (2010) reported reductions of AES 192 and 256 bit keys to strengths of 176 and 22.9 bit keys respectively for certain attacks.
- RSA:
  - Published in 1977; widely used for confidentiality and digital signatures.
  - Earlier cryptanalytic concerns included known-plaintext or related-plaintext attacks (Durfee, 2002), but proper key sizes and best practices make RSA resilient to classical attacks.
  - It would take "billions of years" for a digital computer to break the current standard RSA 2,048-bit key (CISA, 2019).
- Hash functions:
  - MD5:
    - Produces a 128-bit hash digest.
    - Lenstra et al. (2005) demonstrated a hash-collision attack; MD5 was officially retired by NIST in 2011 but remains widely used.
  - SHA-1:
    - Produces a 160-bit digest; deprecated by NIST in 2011.
    - A full collision attack demonstrated in 2017 (Stevens et al., 2017).
  - SHA-2:
    - Produces digest sizes 224, 256, 384, or 512 bits with 64 or 80 rounds.
    - Still a valid standard, though specific variations (e.g., SHA-512/224 and SHA-512/256) faced reduced strength via differential cryptanalysis (Dobraunig et al., 2016).
  - SHA-3 (Keccak):
    - Selected through NIST competition completed by 2015; digest sizes 224, 256, 384, and 512.
    - Morawiecki et al. (2014) describe a preimage attack via rotational cryptanalysis reducing rounds for the SHA-3 512 bit variation, slightly reducing time and memory needed to break that variation.

### Implementation and side-channel risks
- Side-channel attacks target software, firmware, and hardware implementations rather than underlying mathematics; they are often easier to find and exploit.
- Heartbleed (CMU, 2014) is cited as a devastating implementation vulnerability in OpenSSL.
- Between 2011 and 2014, 17 percent of vulnerabilities in cryptographic libraries published by CVE were due to development-phase mistakes, while 83 percent were related to misuse or misconfiguration by hosting applications (Lazar et. al., 2014).

### Annex IV — Key algorithm highlights (selected entries)
- Symmetric algorithms:
  - Enigma: broken in 1932 by the Polish Cipher Bureau with French and British assistance.
  - DES: developed by IBM, published as U.S. federal standard in 1977; 56-bit key; cracked in 1998 by the Electronic Frontier Foundation using a machine that took 3 days to find the key (EFF, 1999).
  - Triple-DES (TDEA): introduced in 1995; still approved under conditions for sensitive unclassified data; new cryptanalysis (meet-in-the-middle) reduced key strength; NIST is deprecating Triple-DES by the end of 2023 (NIST, 2019).
  - AES: selected in the 1997 NIST program and introduced in 2001; see AES details above.
  - Twofish: AES finalist in 1997; cryptanalysis reduced rounds in some attacks (Moriai et al., 1999; Ferguson, 1999).
- Asymmetric algorithms:
  - Diffie-Hellman: first public-key exchange (Diffie et. al, 1976); susceptible to man-in-the-middle attacks; prime precomputation methods can weaken standard primes (Heninger, 2015).
  - ElGamal: based on Discrete Logarithm and Diffie-Hellman; attacks effective under certain key/length conditions and avoidable via configuration (Allen, 2008).
  - RSA: see RSA details above; attacks such as Håstad and Coppersmith apply in specific scenarios but best practices maintain security.
  - ECDSA: requires smaller keys and is faster; cryptanalysis candidates include Pohlig-Hellman, Pollard’s Rho, and Parallelized Pollard’s Rho; best practices in randomization and key selection mitigate these risks (Johnson et. al, 2001).
  - SIDH: developed as a quantum-safe candidate based on supersingular elliptic curve isogenies; side-channel and fault attacks may reduce key strength and further cryptanalysis is expected as adoption grows (Galbraith et al., 2016).
- Hash functions:
  - MD5, SHA-1, SHA-2, SHA-3: see hash section above for collision/preimage attacks, deprecations, and NIST selections.

*Source: IMF working paper (wpiea2021071-print-pdf) — ANNEX III and ANNEX IV excerpts*

### REFERENCES

### REFERENCES

### Topics represented in the references list
- Quantum computing experiments and demonstrations (e.g., "Quantum supremacy using a programmable superconducting processor" — Arute et al., 2019; "Quantum computational advantage using photons" — Zhong et al., 2020; "Realization of a scalable Shor algorithm" — Monz et al., 2016).
- Quantum algorithms and resource estimates relevant to cryptography and finance (e.g., "How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits" — Gidney and Eker, 2019; "Applying Grover’s algorithm to AES: quantum resource estimates" — Grassl et al., 2015; "Quantum Computing for Finance: State-of-the-Art and Future Prospects" — Egger et al., 2020).
- Post-quantum and quantum-safe cryptography research and standards (e.g., NIST 2019; NIST 2020; ETSI 2015; ETSI 2017; ETSI 2020; De Feo, Jao, and Plût, 2011; Galbraith et al., 2016).
- Cryptanalysis and classical cryptographic vulnerabilities (e.g., "New Directions in Cryptography" — Diffie and Hellman, 1976; "The first collision for full SHA-1" — Stevens et al., 2017; "Key Recovery Attacks of Practical Complexity on AES-256 Variants with up to 10 Rounds" — Biryukov et al., 2010).
- Practical security incidents, standards, and operational guidance (e.g., CMU 2014 OpenSSL TLS heartbeat; CISA 2019 "Understanding Encryption"; Google Report 2020 "HTTPS encryption on the web"; Gramm-Leach-Bliley Act, 1999; GDPR, 2018).
- Foundational texts and histories of cryptography and quantum information (e.g., Shannon 1938; Nielsen and Chuang 2010; Dooley 2018; Singh 1999; Macmillan 1971).

### Notable cited works (authors, year, and title as listed)
- Allen, Bryce D. 2008. “Implementing several attacks on plain ElGamal encryption.”
- Anschuetz, E., Olson, J., Aspuru-Guzik, A. and Cao, Y. 2019. “Variational quantum factoring”.
- Arute, F., Arya, K., Babbush, R. et al., 2019. "Quantum supremacy using a programmable superconducting processor."
- Bertoni Guido, Joan Daemen, Michaël Peeters and Gilles Van Assche. 2007. “Sponge Functions.”
- Biryukov Alex, Orr Dunkelman, Nathan Keller, Dmitry Khovratovich, Adi Shamir. 2010. “Key Recovery Attacks of Practical Complexity on AES-256 Variants with up to 10 Rounds.”
- Boaron Alberto, Gianluca Boso, Davide Rusca, Cédric Vulliez, Claire Autebert, Misael Caloz, Matthieu Perrenoud, Gaëtan Gras, Félix Bussières, Ming-Jun Li, Daniel Nolan, Anthony Martin, and Hugo Zbinden. 2018. “Secure quantum key distribution over 421 km of optical fiber.”
- Bouland, Adam, Wim van Dam, Hamed Joorati, Iordanis Kerenidis, Anupam Prakash. 2020. “Prospects and Challenges of Quantum Finance”.
- Burr William and Kathy Lyons-Burke. 1999. “Public Key Infrastructures for the Financial Services Industry."
- Cade, Chris, Lana Mineh, Ashley Montanaro, and Stasja Stanisic. 2020. "Strategies for solving the Fermi-Hubbard model on near-term quantum computers."
- CISA. 2019. “Understanding Encryption.”
- CMU. 2014: “OpenSSL TLS heartbeat extension read overflow discloses sensitive information.”
- Diffie Whitfield and Martin Hellman. 1976. “New Directions in Cryptography.”
- De Feo Luca, David Jao, and Jerome Plut. 2011. “Towards Quantum-Resistant Cryptosystems from Supersingular Elliptic Curve Isogenies.”
- Dobraunig Christoph, Maria Eichlseder, and Florian Mendel. 2016. “Analysis of SHA-512/224 and SHA-512/256.”
- Dooley, J.F. 2018. “History of Cryptography and Cryptanalysis. Codes, Ciphers, and Their Algorithms.”
- Durfee, Glenn. 2002. “Cryptanalysis of RSA Using Algebraic and Lattice Methods.”
- EFF. 1998. “Cracking DES: Secrets of Encryption Research, Wiretap Politics, and Chip Design.”
- Egger D. J. et al. 2020. “Quantum Computing for Finance: State-of-the-Art and Future Prospects,” IEEE Transactions on Quantum Engineering, vol. 1, pp. 1-24, 2020, Art no. 3101724.
- El Gamal Taher.1985. “A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms.”
- ETSI. 2015: “Quantum Safe Cryptography and Security. An introduction, benefits, enablers and challenges.”
- ETSI. 2017. “Quantum-Safe Cryptography; Quantum-Safe threat assessment.”
- ETSI. 2020. “CYBER; Migration strategies and recommendations to Quantum Safe schemes”.
- Ferguson, Niels. 1999. “Impossible differentials in Twofish.”
- Galbraith et. al. 2016. “On the Security of Supersingular Isogeny Cryptosystems.”
- Google Report. 2020. “HTTPS encryption on the web.”
- Gramm-Leach-Bliley Act. 1999. Financial Services Modernization Act of 1999.
- GDPR. General Data Protection Regulation, 2018.
- Gidney Craig and Martin Eker. 2019. “How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits.”
- Grassl Markus, Brandon Langenberg, Martin Roetteler, and Rainer Steinwandt. 2015. “Applying Grover’s algorithm to AES: quantum resource estimates.”
- Heninger, Nadia. 2015. “How Diffie-Hellman Fails in Practice.”
- Kothari, Robin. 2020. “Quantum speedups for unstructured problems: Solving two twenty-year-old problems”.
- Johnson Don, Alfred Menezes and Scott Vansto. 2001. “The Elliptic Curve Digital Signature Algorithm (ECDSA).”
- Lazar David, Haogang Chen, Xi Wang, and Nickolai Zeldovich. 2014. “Why does cryptographic software fail? A case study and open problems.”
- Lenstra Arjen, Xiaoyun Wang and Benne de Weger. 2005. “Cryptology ePrint Archive: Report 2005/067.”
- Martinis John, and Sergio Boixo. 2019. “Quantum Supremacy Using a Programmable Superconducting Processor.” Google AI Blog.
- Morawiecki Pawe, Josef Pieprzyk, and Marian Srebrny. 2014. “Rotational Cryptanalysis of Round-reduced Keccak.”
- Moriai Shiho, and Yiqun Lisa Yin. 1999. “Cryptanalysis of Twofish (II).”
- Monz, T., Nigg, D., Martinez, E.A., Brandl, M.F., Schindler, P., Rines, R., Wang, S.X., Chuang, I.L. and Blatt, R. 2016: “Realization of a scalable Shor algorithm”.
- National Academies of Sciences. 2019. “Engineering, and Medicine: Quantum Computing: Progress and Prospects.”
- Nielsen, M.A. and Chuang, I.L. 2010. “Quantum Computation and Quantum Information.”
- NIST. 2019. “Transitioning the Use of Cryptographic Algorithms and Key Lengths.”
- NIST. 2020. “Status Report on the First Round of the NIST Post-Quantum Cryptography Standardization Process.”
- Orus Roman, Samuel Mugel, and Enrique Lizaso. 2019. “Quantum computing for finance: overview and prospects.”
- Pednault, Edwin, John A. Gunnels, Giacomo Nannicini, Lior Horesh, and Robert Wisnieff. 2019. “Leveraging Secondary Storage to Simulate Deep 54-qubit Sycamore Circuits.”
- Shannon, C.E. 1938. “A symbolic analysis of relay and switching circuits.”
- Singh, S. 1999. “The Code Book: The Evolution of Secrecy from Mary, Queen of Scots to Quantum Cryptography.”
- Stevens Marc, Elie Bursztein, Pierre Karpman, Ange Albertini, Yarik Markov. 2017. “The first collision for full SHA-1.”
- Tang Lynda, Nayoung Lee, Sophie Russo. 2018. “Breaking Enigma.”
- Zhong, Han-Sen, Hui Wang, Yu-Hao Deng, Ming-Cheng Chen et al. 2020. “Quantum computational advantage using photons.”

*Source: wpiea2021071-print-pdf - REFERENCES*

---


_Source: https://www.imf.org/-/media/files/publications/wp/2021/english/wpiea2021071-print-pdf.pdf_