Making Existing Software Quantum Safe: Lessons Learned

In the era of quantum computing, Shor's algorithm running on quantum computers (QCs) can break asymmetric encryption algorithms that classical computers essentially cannot. QCs, with the help of Grover's algorithm, can also speed up the breaking of symmetric encryption algorithms. Though the exact date when QCs will become "dangerous" for practical problems is unknown, the consensus is that this future is near. Thus, one needs to start preparing for the era of quantum advantage and ensure quantum safety proactively. In this paper, we discuss the effect of quantum advantage on the existing software systems and recap our seven-step roadmap, deemed 7E. The roadmap gives developers a structured way to start preparing for the quantum advantage era. We then report the results of a case study, which validates 7E. Our software under study is the IBM Db2 database system, where we upgrade the existing cryptographic schemes to post-quantum cryptography (using Kyber and Dilithium schemes) and report our findings and learned lessons. The outcome of the study shows that the 7E roadmap is effective in helping to plan the evolution of existing software security features towards quantum safety.