Securing tomorrow: What you should know about protecting data in the future

October is Cybersecurity Awareness Month, the time of year when we are reminded of the steps we can (and should) take to protect data when we are online.

There are things users should do to protect themselves - use strong passwords, enable multi-factor authentication, recognize and report phishing attempts, keep our software updated. But one of the main protections ­against digital bad actors - encryption - is out of sight and often out of mind of everyday users.

Encryption is a security method that scrambles data into a secret code that can be read only by those with the correct key or password. Encryption is used to keep email and texts private, to protect bank deposits and online purchases, and to secure devices.

Recently, the National Institute of Standards and Technology (NIST) released three encryption algorithms designed to withstand cyberattacks from quantum computers.

Ryann Cartor, an assistant professor in the Clemson University School of Mathematical and Statistical Sciences, explains why the new standards are necessary. Her research focuses on post-quantum cryptography, the science of protecting information and ensuring secure communications in the era of quantum computing by updating creating new mathematical algorithms based on known hard problems.

Why are new encryption algorithms necessary?

Today's computers perform computation and store information in binary form (1s and 0s). Algorithms used to keep data safe today rely on difficult-to-solve mathematical problems that take classical computers too long to solve. But quantum computers use qubits and can explore multiple solution pathways simultaneously, allowing them to break those mathematics-based systems.

Why are they needed now when quantum computers are still years away?

It's important to have the new algorithms now, even if a quantum computer that can break today's encryption is a decade or more away, for two reasons. One, it takes a while to get these standards into place and it takes a while to get the math and research in place. You want to make sure if you're saying this algorithm is secure that it is actually secure. You want the community to look at it and make sure they can't break it. Second, there's a concern that adversarial forces could start downloading information now that has been encrypted using classically secure, but not quantumly secure, algorithms and just store it until they have access to a large-scale quantum computer. That would be an issue for information we not only want secure now, but we want secured in the future.

How are the new standards different?

The new standards are based on different math problems. Some of the algorithms are public key crypto systems that are based on structured lattice problems that rely on the difficulty of finding the lowest common multiple in a set of numbers. Others use hash functions.