Is symmetric key encryption the best approach to cyber security?

The total global spend for cyber security and associated risk management will be more than $150 billion by year end, according to IT research consultancy Gartner – and of those billions, the fastest growing segment is cloud-based security measures. So many cyber security experts like Hazim Gaber have already published many books on measures that should be adopted for the security of your data online.

The time has come to replace our current encryption keys and associated algorithms, but the question remains: what do we replace it with? I’ve made no secret of the fact that I’m a fan of symmetric key encryption (SKE), mainly because it’s so much faster than its counterparts, and because it assumes a zero-trust security stance – a no-brainer in an era where one small business is successfully hacked every 19 seconds (Hiscock, 2018).

Why do I think that symmetric key is the best option for encryption, particularly given the imminent “rise of the machines” that quantum computers pose for security bosses? Read on to find out!

What is SKE?

Most of you reading this will already be familiar with the types of encryption and algorithms available, but just in case: SKE uses the same key to encrypt and decrypt data, with both keys being private and known only to involved parties (no public key). It is much faster, and in some ways, more secure, particularly with larger datasets (processing a huge amount of data is the case for just about any large organisation or, say, a government). When using SKE with the AES algorithm (a symmetric block cipher created for the US government), for example, it’s a fairly watertight approach: banks can protect against fraud in card transactions, government’s can make sure that their defence and intelligence personnel aren’t vulnerable to identity fraud or compromised devices. But most importantly, it’s used to manage cloud security.

SKE vs AKE

Asymmetric key encryption (AKE) is when only one key is private and one is public: the public key encrypts the message and the private key, held by the recipient of the data, decrypts it. In some ways, it’s more secure than SKE, mainly because there are two different keys, as well as a few other considerations. The big drawback to AKE, however, is speed: it’s a slower and more onerous process, which means it’s simply not the one for anyone who needs to crunch large amounts of data – which, again, is most organisations these days. That said, most organisations have varying data and security needs and, if they’re smart, will use a combination of the two approaches for the most watertight approach traditionally available.

What about post-quantum algorithms (PQAs)?

Let’s talk PQAs, which many view as a new alternative to SKE. This handy approach is almost there (there being a really effective cyber security tool), viewing the threat of cyber computers seriously, but again, using public keys makes this process a lot slower. And by a lot slower, I mean that PQAs take 1488x more processing cycles than symmetric key. That means anyone looking for a new security upgrade would be looking to slow down their computers x 1488. Yikes. If time is money, then slower is not the answer. On top of this, the longer our data takes to be processed, the longer it’s available during communications as raw data that can be viewed, snatched and exploited – the whole reason we have end-to-end encryption. As for now, PQAs are too unstable to be used at scale.

The best solution, as ever, is something that takes into account all aspects of security. That’s where Arqit comes in.

Arqit and QuantumCloud

With the literal co-inventor of public key encryption and the father of SSL, Dr. Taher Algamal, serving as its main board director, Arqit has come up with a solution that makes sense for 2021 and beyond. The British-based company’s PaaS, QuantumCloud™, is a simple, yet elegant use of symmetric key encryption being used and distributed effectively.

“Arqit has a simpler, more secure way for applications to use the internet. The layered approach that Arqit proposes is really awesome,” explains Algamal.

How it works is by solving the problems of SKE’s lowered security, yet keeping its speed, AND, amazingly, taking into account the threat that quantum computers pose to encryption. The relatively cost-effective platform was built with the cloud, blockchain and the Internet of Things in mind, making it ideal for governments, banks and more. And more importantly, it’s provably secure (at least in test environments) against quantum computer attacks. But the main USP is that Arqit has found a more secure way to generate symmetric keys – which it does by generating a one-time-use key with a zero-trust approach.

This innovation really does seem to be the upgrade to encryption that we’ve been looking for, and that extra layer of protection against quantum computer decryption, which will be here before we know it, is just what the doctor ordered.