By: Cleo Xu ‘26
CSC 600 is an independent study course offered at Phillips Academy Andover. This course allows students to design their own project by drawing skills learned from previous courses in both computer science and mathematics. Students spend a significant amount of time self-studying and reading through papers and documentations. At the end of the course, students turn in their final product either by making a presentation or writing a paper or blog, some of these papers have been published in scientific journals and presented at conferences.
Have you ever thought about who or what might be looking at your personal information while you stare at the screen? Or what might be protecting you from those dangerous leaks? Probably not that often–to use Conor’s words: “We take security almost as a granted—when it really isn’t…[T]here is a lot of work that goes on behind the scene to ensure, or at least try to secure…our digital lives, which then translate to our real lives.”
In order to understand Conor’s work, let’s first look at what cryptography is and how it works.
Computer encryption allows two separate parties to arrive at the same common key without any prior knowledge of the precise information of each one’s private key beforehand. This common key can be easily accessed by the public, and encryption is done by manipulating this public key with the private keys. The product of mixing the private and common key is then exchanged between the two parties, followed by another round of manipulation with the public key again and their original private key. Eventually, both you and the person or website you are “communicating” with would end up with the same key—usually a prime number. The manipulation mentioned before can take various forms, such as multiplication and mod functions, and prime factorization is often an important step to trace back to the private keys you started with. As it is rather difficult to factor a large prime number, this method of encryption remains safe—that is, until Peter Shor came along. Peter Shor came up with the Shor’s algorithm, which “effectively trivializes factoring large prime numbers.” What previously grew exponentially as a function of the prime number, now grows logarithmically, which can result in a significant amount of reduction in time, or to put it in Conor’s terminology: “the difference between the heat death of the universe and tomorrow.” Once we could take comfort in knowing that Peter Shor’s algorithms need to be run by a quantum computer, but with the rise in quantum computing,, the “heat death” of online security might not be such a long wait after all.
With recent developments and breakthroughs in both the theory and the making of quantum computers, Post-Quantum Cryptography (PQC)—a field that focuses specifically on securing online data from quantum computers—has gained more attention from the public. In order to understand the threat quantum computers may pose, let’s take a detour. What separates a quantum computer from a traditional computer is that it uses a “qubit” instead of a “bit”, which due to the physical phenomenon“superposition”, can take on the value of 1 and 0 at the same time. Coupled with the even stranger phenomen “entanglement”—where two or more qubits are linked such that knowing one would tell you the information of the other—quantum computers can explore several paths at once, providing Shor’s algorithm the perfect medium to wreak havoc on the online world.
With problems comes solutions, as one hopes, and one could thank the National Institute of Standards and Technology (NIST) to make such a hope into reality. NIST held a contest for programmers worldwide to design an effective way to undermine quantum computers and Shor’s algorithm, and in July 2022, NIST announced the winner with several shortlists. (Some of the algorithms are Crystal-kyber, Classic McEliece, and SIKE. For more details, check out Conor’s paper). The reason why NIST offers such a diverse toolbox of different PQC algorithms is that, “the cryptography community understands there’s no single ‘silver bullet’ algorithm”, capable of solving every problem. The journey of PQC continues, and there might be a chance for you to hop onto it too—here is when Conor’s work comes into play.
Although most PQC algorithms are still under development, organizations such as the Open Quantum Safe project have provided resources to experiment on those algorithms. For his project, Conor chose to use Chromium, which to a large degree dictates the general standard when it comes to browser security. Chromium itself has the transport-layer security (TLS) algorithm, which allows browsers to fetch data safely. There is also the Open SSL—how you would implement the TLS algorithms—and its “child”, the BoringSSL. In Connor’s words, “The intent of these ‘SSL’ libraries is to provide reliable implementations of the various cryptographic algorithms required for TLS, but right now TLS doesn’t include anything post quantum.” So Conor has decided to write the code that allows people with very little coding experience to add PQC algorithms into Chromium.
The complete code can be found in his paper.
If you are not a CS person like myself, no worries, it turns out Chromium has gone post-quantum since Conor finished his CS 600 project. Here is the procedure, directly taken from Conor’s paper:
“The future seems quantum-proof, or is it? There is still a long time before the heat death of the universe, and a lot can happen between tomorrow and then. It’s an endless battle between better and faster quantum computers and the countless programmers who scratch their heads to come up with the counter algorithm to ensure the safety of our online lives. So really, a lot of things are happening at once, have happened before, and will happen after, when you use google or buy something from Amazon. More likely than not, “people smarter than either you or me”, would solve the problems even before we became aware of it, but it certainly doesn’t hurt to start learning more about digital security and begin to respect for the amount of work that goes in to ensure we can continue living our lives as it is. For the future, Conor is hopeful. “The inclusion of post-quantum capabilities in Chromium marks an incredible step towards future-proofing the internet. As awareness grows and standardization continues, we can expect a seamless transition to a web world protected against the potential threat of quantum computing.”
So between the heat death of the universe and tomorrow, read Conor’s paper, be more mindful with your digital lives, and subscribe to Andover Science & Tech Review!
