Is a quantum revolution around the corner? We asked quantum security expert and entrepreneur Michele Mosca.
For over 20 years, Michele Mosca has worked in cryptography. Today, he’s a quantum computing and cryptography expert who conducts research at the University of Waterloo’s renowned Institute for Quantum Computing, and owner of two quantum-themed companies. He’s the perfect person to ask about keeping businesses secure in the quantum future.
We sat down with Dr. Mosca to discuss potential quantum technologies, the security threat quantum computers pose to information security, and the benefits of working in the unique Waterloo innovation ecosystem and as part of Waterloo’s globally-significant quantum technology community.
*This transcript was edited for length and clarity.
Q: Can you give me a bit of a summary of your background?
MOSCA: My background is in mathematics. I came to Waterloo for a degree in mathematics and I accidentally stumbled upon cryptography. I’d heard of quantum crypto before, and quantum computing, but I really thought it was science fiction, I didn’t think it was a real thing.
Later, I encountered it again and dismissed it as a waste of my time. It’s quite ironic considering how things played out. But, I was encouraged to study it a bit more, and then I realized that I was wrong, that quantum computing was part of a whole new paradigm of physics, and there was no point continuing my work in cryptography if it wasn’t taking into account this emerging technology. So, I started working on quantum algorithms because that would redefine the rules of the game for cryptography.
I was recruited back to Waterloo in 1998. My work has always been rooted in security issues, the cryptographic foundations of all of our technologies, and now through a quantum lens.
I’ve studied the power of quantum computing, I’ve followed the technology as it evolves. From a cryptographer’s point of view we need to know when this technology is going to happen because it fundamentally changes what’s secure and what isn’t, and there’s some major work to be done to make sure all of our technologies, all of our critical infrastructures are secure against attacks by quantum computers. We have to do that before this quantum computing technology is available.
Q: What attracted you to Waterloo initially? What keeps you in Waterloo?
MOSCA: As an undergraduate I was attracted to the University of Waterloo because it had this very exciting, broad mathematics program. They let you do profound mathematics and explore potential applications.
As a Faculty member, this is the best place in Canada and one of the best places in the world to research cryptography. We have one of the top cryptography, computer science, and engineering groups in the world, and a history of being a driver of transformative changes globally.
Elliptic curve cryptography – Waterloo was really at the centre of making that a global standard. This was the right place in Canada and second to none globally in terms of moving towards quantum computing platforms. For many, many reasons, in terms of the talent pool, the potential mentors, and the culture, it was a top place to come to.
Q: What does “quantum” mean?
MOSCA: Quantum mechanics is just a mathematical language that explains the world around us. It’s really just a half page of very simple mathematical rules for expressing any physical theory. Two particles collide, and then what happens? The problem with the previous mathematical language, the classical theory, is that it wasn’t able to explain some very simple paradoxes we observed with the naked eye. Quantum mechanics made a lot of those paradoxes go away, and in the process it opened an entirely new avenue to understanding the world around us and created the potential for transformative new technologies.
Q: What makes Waterloo unique in quantum research, training, and business?
MOSCA: It’s a special place for a number of reasons. For one, we’ve been teaching quantum computing to our undergraduates for almost 20 years now. There’s hundreds – maybe thousands of students – who have come through this university, many of them are in the region, who know what quantum computing is.
I don’t think you’ll find another region with as much quantum-aware workforce. At the research level we have an unprecedented critical mass of people doing cutting-edge research across the spectrum. We’re not just focused on quantum theory, or the foundations, or implementation – we have a broad spectrum. You have access to the world’s top thinkers and their graduates. So, there’s potential to get access to cutting-edge talent, access to cutting-edge expertise, or to be connected to whoever is working on whatever quantum technology you’re interested in.
There’s also an emerging commercial and industrial ecosystem. There’s a growing list of startups – I’ve honestly started losing track – that are offering some kind of product or service in the quantum space. Finally, there is a strong culture of commercialization and innovation here.
Q: Why should businesses around the world care about quantum physics right now? How could quantum research or technology affect the business community in the short term?
MOSCA: Quantum science is fundamentally changing cybersecurity; it is fundamentally changing what is secure and what isn’t. It threatens, essentially, all of our critical infrastructure. That’s something you need to prepare for.
There’s a massive migration, that’s already started and there’s many years to go, to make sure our technologies, our systems, and our tools are secure once quantum computers are here. You don’t want this to be dramatic. You want it to be a non-event from a security perspective. And it’s doable, but you do need to plan ahead. It can be as simple as making sure the tools you’re using today have the ability to upgrade to ones that can resist quantum attacks in the future. It doesn’t necessarily mean a massive overhaul or buying cutting-edge technology today.
Our aim, from a cybersecurity perspective, is – if you act now – being quantum safe will be part of your lifecycle management. If you procrastinate it will be crisis management, which will come with all sorts of costs. You may or may not have to use quantum technology, but you definitely have to plan your path to quantum safety.
The other reason to care about quantum technology is it’s a very disruptive technology. It offers new capabilities that were previously not known or believed to be possible. These technologies aren’t 20 or 50 years away. Many of them are available now, and we expect more in the next 5, 10, or 15 years. They won’t be the full capacity of quantum, but we’re starting to capture a big chunk of what quantum technology can offer. And so, now is the right time to explore if and how it can help you achieve your objectives. The sooner you explore it, the sooner you’ll be able to take advantage of it.
Your ability to take advantage of that quantum computer depends on how much effort you put into exploring how it will be applied. Finding the applications, designing the quantum circuits, and optimizing them. That exercise can take several years, so if you start five years earlier you’ll be five years ahead of your competition in being able to reap that quantum advantage. On the flip side, if your competitors do and you don’t you’ll be five years behind them. It’s an ounce of investment to take advantage of this amazing new resource in the future.
Q: Helping companies prepare for quantum code-breaking is a big part of what your business does, right? Can you tell us a bit about evolutionQ?
MOSCA: The goal is to maintain security in a world with quantum computers. Given my unique or unusual path into this field, I came from the world of cryptography – making and breaking codes – and I saw my mentors, and how long it took them, to take elliptic curve cryptography from an idea to practical application. And I saw, and I understood, that it’s not so easy – you can’t just say “that’s a much better way of doing things – let’s do it.” No, it takes years and years of development, of standardization, you have to look at interoperability and there’s a lot of challenges to taking an idea and turning it into a robust, real world product. You really have to do it properly, because if you rush to apply new crypto it will be full of bugs that will be exploited by hackers.
Coming from that background, we knew this was a long-track transition and even an ounce of prevention will be worth a lot in terms of making our future infrastructure secure. So, evolutionQ is about helping enterprises, helping organizations, get from their current quantum-vulnerable state to a quantum-safe position at an appropriate point in time, in a timely and cost-effective way. You want to do it in time, you want to do it well, and you don’t want to spend a lot more resources than needed.
Q: Would it be accurate to say that any company using cryptography – from banks and insurance to things like mobile networks and connected cars – should be very concerned?
MOSCA: It’s anyone who relies on technology, which is essentially everyone. Everyone should be doing something. At the very least, they should be asking their vendors “what are we doing about this? Are my systems going to resist a quantum attack?”
Q: Apart from hiring evolutionQ, what should businesses do to prepare for potential quantum security issues?
MOSCA: On the defensive side of security, they have to evaluate where they sit in terms of security in general, and their risk governance in general. If they’re even asking the questions they’re probably already reasonably mature. Are they looking at the threats facing them today and future threats, and appropriately taking them into account? Too many enterprises, they just don’t worry about the future threats until they’re present threats, and that’s a massive problem, especially if you’re looking after critical infrastructure.
What we encourage organizations to do, and they can do it with our help or without, is understand their dependency on cryptography. And then when they realize what pieces are quantum vulnerable, whoever looks after their security should outline a roadmap to quantum resilience.
It’s all pretty simple stuff, and they only need to engage companies like evolutionQ when and where they need the help. The extent to which they need to hire more people really depends on their circumstances – it might suffice for them to send one or two of their team members to one of our workshops, or take one of our courses, or they might be able to do it by reading the appropriate materials, but they have to have their own internal processes for managing risk and articulate their plan. It they start with the end-goal of “here’s a threat, we want to have a convincing plan” and just work backwards from there, and then it will become apparent when they need someone’s help.
Q: Mike Lazaridis, one of the founders of Blackberry, often refers to the “quantum revolution” that is, in many ways, reminiscent of the revolution that took place after the transistor was invented. How will new quantum technologies revolutionize the world? What kind of businesses or products could you imagine coming out of quantum technologies?
MOSCA: Just to put the vastness of that question into context, it’s not like we’ve invented a new app or a new widget. If you develop the app or the widget you probably have a good reason, you should have some idea what the market need for it is. This is a whole new platform for inventing technologies. It’s like discovering wireless communication over 100 years ago. What is that going to be good for? We certainly didn’t know 100 years ago. The first applications were just scratching the surface. It’s a really important question, but the fact that we don’t have a laundry list of 100 or 1000 concrete products, applications, and so on, with their full market analysis, is not at all surprising.
In the longer term, we know quantum computers are very good at simulating other quantum systems. What quantum systems do I care about? Well, the macroscopic behaviour of chemicals and materials – “is this wire superconducting at a high temperature?” – are determined at the quantum level.
It’s hard to discover new materials because it’s hard to predict, by just tweaking the design of a material or chemical, what its macroscopic behaviour will be. You could say “just try it,” but what if I want to try a trillion configurations? Even if it’s just a dollar each – and it’s typically a lot more to design, synthesize, and test a new material – you can’t because it’s a trillion dollars. You want to be able to simulate that on a computer. It’s impossible to simulate some of these materials on a conventional computer, but a quantum computer can help us simulate these new materials.
Quantum algorithms can also help with optimization – in things like machine learning – and then there’s all the tools developed to try to build a quantum computer. They lead to, for example, more sensitive sensors. So, there’s all the usual application of the tools you develop. You try to do a moonshot, like a quantum computer, and along the way you develop all kinds of knowledge and technology.
Q: Going back to an earlier question, do you think locating in Waterloo provides an advantage to companies looking to lead in these potential future technologies?
MOSCA: Yes. The whole aim was to develop an ecosystem of people who understand the technology and can help with the different pieces. If you’re trying to build something, for example, there’s people who understand the physics and engineering around building quantum devices or using quantum devices. You’re going to need software systems to use quantum tools, these are new software systems and we have people who are experts on that.
There’s a growing ecosystem of all the people who understand the IP issues around quantum, and so on. That’s the advantage of the ecosystem – you’re surrounded by all the complementary expertise you need, and the talent pool that you can hire into your organization. This is also a great place to figure out how quantum computing can help your business.
What are the applications? Start preparing your business to take advantage of them.
Waterloo has a unique quantum ecosystem. With world-class theory, experiment, and commercialization organizations within 5km (3mi), Waterloo leads in expertise, talent, and the resources to commercialize quantum products.