Commvault has extended post quantum cryptography support in its platform as the clock ticks – or doesn’t tick – down to the inevitable cracking of current crypto algorithms.
The New Jersey-based data protection and management firm had already incorporated the post quantum algorithms endorsed by the US’s NIST standards body last year into its Commvault Cloud platform, simultaneously implementing a crypto agility framework.
It has now added the Hamming Quasi-Cyclic algorithm, which was designated as an alternative to ML-KEM (FIPS 203), the main algorithm for general encryption with key encapsulation, by NIST earlier this year.
The organization referred to HQC as “backup defense in case quantum computers are someday able to crack ML-KEM. Both these algorithms are designed to protect stored information as well as data that travels across public networks.”
But, NIST explained, it wanted to have an alternative based on different maths should ML-KEM prove to be vulnerable. So while the ML-KEM algorithm is built around “a mathematical idea called structured lattices, the HQC algorithm is built around another concept called error-correcting codes”.
Stop the harvest now
Commvault will roll out HQC through its platform, meaning it will be immediately available to Commvault Cloud customers running CPR 2024 (11.36) or later.
This might appear a bit previous as most quantum specialists reckon a machine capable of cracking existing encryption would need 10,000 qubits. No one is near that capacity at present. IBM this week outlined plans to build a 10,000-qubit system by 2029, according to reports, following advances in fault-tolerance but this would equate to 200 logical qubits.
But the perceived threat is “harvest now, decrypt later,” where attackers hijack data, including long-term IP and national secrets, to decrypt once they have suitable systems. The scary part being that the wider world might not know who has developed such a system and when.
Bill O’Connell, Chief Security Officer at Commvault said in a statement. “By integrating new algorithms like HQC and advancing our crypto-agility framework, we are providing our customers with the tools to navigate this complex landscape with confidence. Our goal is simple and clear: as quantum computing threats emerge, we intend to help our customers keep their data protected.”
