In 1994, the mathematician Peter Shor published an algorithm showing that a large enough quantum computer could factor the numbers that protect most of the world’s encrypted traffic. For three decades that machine did not exist, and the warning stayed largely academic.
Quantum computing vendors now publish roadmaps that place a cryptographically relevant machine before 2030, and regulators have set deadlines to retire vulnerable cryptography during the 2030s. Governments, banks and hospitals face a further problem: anything encrypted and transmitted today can be recorded and kept until a machine exists to read it.
Dr James Grieve, Senior Director of Quantum Communications at the Technology Innovation Institute in Abu Dhabi, is working on a defence whose security comes from the laws of physics. His team builds quantum key distribution systems, which use particles of light to create and share encryption keys.
The institute runs a 3-node quantum network at the Abu Dhabi Global Market campus on Al Maryah Island, alongside the Abu Dhabi Quantum Optical Ground Station, which links the UAE to satellite-based quantum key distribution. Before joining TII, Grieve spent 7 years at Singapore’s Centre for Quantum Technologies, where his work included a fibre-based quantum key distribution collaboration with Singtel.
In conversation with GEC Newswire, he explained why the name post-quantum cryptography misleads, why regulation alone cannot have quantum computing, and why the next 5 years will decide whether quantum networks move beyond pilot projects.
Researchers and specialists still mainly discuss quantum security, while post-quantum vendors insist every organisation must be quantum ready now. How will the subject reach a wider audience, and are the vendors right?
The conversation is less developed and less urgent than the one around AI security, and that is correct. The security threats attached to AI, and to the mass digitisation of everything in society, are operational threats. They are messy, complex, and fast moving. I saw a statistic somewhere about what percentage of cyber threats were attached to this kind of operational activity, and it was all of them. In the AI space, many different vendors hold inference in various places and share data back and forth, and it is extremely hard to control where information goes in that ecosystem. Companies must react to that and make sure they keep some control over where everything is going, and that is a pressing concern for them right now.
The threats that post-quantum cryptography and quantum networking address are different. With post-quantum cryptography, we are talking about a system-wide upgrade, which means retiring and replacing the entire cryptographic architecture of the world’s digital economy. It is a noticeably substantial change, and it needs to happen.
Why does the name post-quantum cryptography cause so much confusion?
The name ties it to a threat, even though nothing about it is quantum. It is just mathematics. Because I am a quantum physicist, I am constantly explaining why post-quantum is different from quantum. Post-quantum cryptography is a reaction to quantum technology, and an important one. The quantum threat is the threat to our digital crypto systems from large-scale quantum computers that can run Shor’s algorithm on a number large enough to matter in cryptography. You will see the term cryptographically relevant quantum computer used for this machine, and it is very much coming. At this point there are very few significant technical blockers to building it. There is a lot of scaling still to do, but every year, and particularly in the last couple of years, we have seen major milestones that have cleared the way.
How soon could such a machine arrive?
Nobody knows, and predicting the future is notoriously hard. What we can say is that some of the leading companies in quantum computing have published roadmaps suggesting they might build something cryptographically relevant before 2030. These companies have an incentive to draw up aggressive roadmaps. I am not saying they are lying, only that they are optimistic by nature when they make them. Still, the fact that somebody is optimistically quoting 2029 for these machines should be very alarming for everybody else. That is also why regulators are creating phased roadmaps that require organisations to stop deploying obsolete cryptography as soon as possible and migrate, with vulnerable crypto systems fully retired sometime in the 2030s. That is sensible, and it responds to the threat.
Why do post-quantum vendors insist that organisations act at once?
They are responding to what is called store now, decrypt later. Ciphertext, the encrypted material transmitted today, can be siphoned off and stored indefinitely. Our networks were built on the assumption that we had robust cryptography, so nobody really cares where information travels on the internet. We know where it starts and where it ends, and we do not care how it gets there. That makes it easy to record traffic as it passes through, so the attack surface is everything. Store now, decrypt later recognises that at least some of the information transmitted today may still matter in the future, which is why the migration needs to be under way at once.
What is the industry overlooking in its preparations?
A large-scale quantum computer running Shor’s algorithm is a threat we can define. We know what it looks like, so we can design post-quantum algorithms that we believe will resist it. Shor’s algorithm running on a big quantum computer is the best-case scenario for modern cryptography, and there are worse cases. We know this machine is coming, we know it is not here yet, and we can estimate when it will arrive.
That is unusual in the history of cryptanalysis. Usually, when cryptography is compromised, nobody warns you. Peter Shor published his algorithm in 1994, so we have had a great deal of warning, and the machines are still not ready. That is why everyone has reacted so slowly.
Many things could happen between now and then that would completely change the conversation. Shor’s algorithm is a factoring algorithm, and nobody has proved that an efficient classical factoring algorithm cannot exist. Somebody could discover an algorithm that efficiently breaks our security on hardware that already exists.
I am not saying it is likely, but it is possible. We should understand black swan events could occur before this machine arrives, and that they would either speed up the timeline or collapse it completely.
Quantum still seems confined to research labs, much as AI once seemed like science fiction. As quantum moves into the mainstream, will we learn from the experience with AI, where many argue guardrails should have been in place from the start?
I do not want to suggest that regulation is unimportant, but it matters more in AI than in quantum computing. AI gathers copious amounts of data and uses statistics to extract value from it, which can then be applied to create new capabilities in every domain. That is not true of quantum computing. A quantum computer does not analyse data at scale. Quantum computers are about doing hard mathematics on insignificant amounts of data. The concerns you might have about large datasets are still part of the conversation, but they are less relevant and are not the main driver.
Quantum computing is also more specialised. It speeds up certain calculations and will give us quite specific capabilities. It will not replace any of our classical, or conventional, computing. Quantum computers will work alongside those systems. In each calculation, there will be one piece where the problem becomes completely intractable for a regular machine, and the quantum computer will calculate that piece. The rest will still need a massive Nvidia compute centre. We still need to regulate quantum computing, but it is a less sweeping advance than AI, because it speeds up specific pieces of a problem instead of affecting everything.
Could regulators simply restrict who uses quantum computers, or which algorithms they run?
Shor’s algorithm is only one concern. A quantum computer could do other things that threaten cryptography in principle, and that area has not been explored enough yet. This is my caution for the post-quantum cryptography community, although people there are aware of it. They are designing algorithms to protect our systems against a particular model of the threat. It is a good-faith effort: people work out what a quantum computer could do in general and design systems that can withstand those general capabilities. Even so, we are still making assumptions.
Think about the transistors that gave birth to all our digital computers. Nobody back then would have guessed that the internet and AI would become their killer applications. In the same way, we should be careful about predicting the killer application of quantum computers, because we do not know it yet.
The second issue is access. Quantum computers will certainly be offered as a service, so you might decide to ban certain algorithms and introduce some kind of know-your-customer checks to control who uses them. The problem is a technique called blind quantum computing, which gives you a provable way to hide the calculation. It is a capability unique to quantum, with no equivalent in classical machines, and it lets you run a calculation on a quantum computer in such a way that the operator cannot, even in principle, know what it is. At that point you could restrict access to an exceedingly small list of authorised users and make everyone else queue, but it shows that regulation alone will not solve the problem.
If regulation cannot solve the problem, what will?
We have migration, with post-quantum algorithms and libraries, and a set of 3 standardised algorithms has now been released, including ML-KEM. It is particularly important that we get all of that done. Quantum also gives us the chance to do better, because we can build encryption systems that use quantum mechanics itself. You sometimes hear this called quantum cryptography, which is inaccurate. The cryptography stays mathematics, and the quantum part is the key distribution. We can run algorithms on quantum networks that create and distribute provably secure encryption keys, which you then use for encryption. That allows you to build networks that can withstand any kind of computer, quantum or otherwise.
I do not make this statement lightly. Quantum key distribution makes no assumption about the computing power of the attacker. That means it is safe against an attacker with a quantum computer, and against any computer humans will ever build, because the reasoning behind the system’s security makes no reference to what can be computed. That is a capability we do not have now. It will not solve every problem. Quantum key distribution is a hardware solution, which makes it specialised. You can use it to secure links between data centres or backbones between cities, but you cannot use it to secure every application running inside the network, so you would still need algorithmic security. What it gives you is what the industry calls defence in depth: a technological backstop where, at some point, an attacker hits a physics wall, because some of the cryptographic material in the system rests on a diverse set of assumptions.
From a scientist’s perspective, what would a world with both artificial general intelligence and quantum computing mean for humanity?
I am not qualified to talk about AGI. I will be excited to see it when it comes, and I hope it does not kill us all. I am optimistic, and it looks remarkably interesting.
Quantum mechanics is the best model of reality we have today. The job of physics is to predict. It gives you a simplified model of whatever system you are studying and predicts how the real system will behave. Quantum mechanics has been spectacularly successful at that and has never been wrong. As a young experimentalist, I found it a bit depressing to be in the lab and realise that nothing I could measure would surprise my theoretician colleagues, because they could predict everything perfectly. The gap is gravity. Quantum mechanics does not describe it, and the two theories do not connect at all. This does not mean there are results we cannot explain, because the energy ranges involved do not overlap, but bringing the two together is the famous open problem in physics. Human physicists have grappled with it for a long time, and with some help from AGI we may get there. Given what today’s limited AI tools are achieving with open mathematical problems, it would be exciting to see what they could do with problems in physics.
Physics is a model, so you can imagine an AI equipped with one. It could use the model to make predictions and then design and run experiments to test them, much as we do. Quantum computers run on quantum mechanical principles, and the most efficient way to simulate quantum physics, in fact the only tangible way, is with a system that has that physics built into it. An AI equipped with such a system could predict far better than we can, which could lead to all kinds of insights. Beyond that, I would not guess.
In practical terms, how quickly will quantum adoption happen? Is this the quantum equivalent of the pre-ChatGPT era?
Some technologies are available right now. Leaving post-quantum cryptography aside, since many countries already have a fully specified roadmap for it, I hope organisations will follow that roadmap, meet their obligations, and get the work done. Then we can stop worrying, though not completely.
In computing, some vendors claim that today’s quantum computers already deliver an operational or economic advantage in limited, specific use cases. I do not know how robust those claims will prove to be. Somebody claims a quantum advantage, and a week later someone with an Nvidia data centre shows the same task can be done slightly faster with an optimised approach, so there is a cat-and-mouse game going on. Still, we see more of these claims every year, even every month.
In sensing, quantum sensors already outperform classical sensors, so that is a present reality. We are seeing adoption in magnetic navigation, for example, where a quantum sensor combined with clever algorithms allows navigation without GNSS signals. My colleagues in TII’s quantum sensing team are working on this now.
In communications, quantum key distribution can already provide something different, and I would argue meaningful. The difficulty is that it offers a level of security for which the killer use cases are not obvious. Some do make sense, such as very long-lived data in healthcare or government, where information must stay safe for a long time. We can create value there today, so the task is to show that the costs are outweighed by the benefits. As technologists, we are working to bring down the cost of these systems and make them easier to deploy. One project, which we call the last mile key carrying solution, aims to build a radically cheaper system that we think will expand the range of uses for the technology.
We already see small-scale adoption of quantum networks in many places. Leaving aside the remarkable example of China, Europe has many small metropolitan networks that are gradually growing and gaining momentum, and there are a few in North America and Southeast Asia. In the UAE, we have several small networks at proof-of-concept scale. One is a 3-node network at the ADGM campus on Al Maryah Island, which we hope will be the start of something larger and more interesting. Over the next 5 years, I expect quantum networking to start rolling out, and we are working actively towards that on the technology side. For that to happen, organisations need to start engaging with this technology today.
