Half a century after a paper rewrote the rules of digital security, the system it spawned is being rebuilt while the world prepares for a shift toward quantum computing. With Father’s Day on Sunday, the legacy of Whitfield Diffie and Martin Hellman, the “fathers of encryption,” is being reflected on at a moment when the cryptographic systems they helped create face one of their biggest challenges yet.

In 1976, a pair of researchers at Stanford published a paper that would end up underpinning almost everything we now do online.

Whitfield Diffie and Martin Hellman's New Directions in Cryptography introduced the idea of public-key cryptography – a method that helped solve of the thorniest practical problems in computing: how two people who had never met, and who shared no prior secret, could communicate securely over a channel that anyone might be listening in on.

The researchers didn’t know it then, but the breakthrough made secure online banking, e-commerce, encrypted messaging and the padlock icon in your browser bar possible. Every time you tap your card details into a website or send a message that only the recipient can read, the work done within that 1976 paper is being put to use. It’s one of the foundational inventions of the modern internet.

But at 50, the child of the “fathers of encryption” is entering a midlife crisis.

Quantum computing threatens modern encryption

The reason for that crisis is quantum computing. Public-key cryptography relies on some mathematical problems such as factoring enormous numbers being so hard that no computer could crack them within the lifetime of the universe. For decades, that’s held true.

But quantum computers, which can perform some calculations at speeds classical machines cannot match, could spoil that – and in so doing, could upend cryptography.

The annual Quantum Threat Timeline Report run by cryptographer Michele Mosca estimates the averaged expert probability of a code-breaking quantum machine emerging within a decade at between 28 and 49%. Cracking that code will result in a massive financial hit, reckons investment bank Citi, which has placed a multi-trillion-dollar price tag on the danger.

It estimates a single quantum-enabled attack disrupting one major US bank's access to the Federal Reserve's Fedwire system could put $2 trillion to $3.3 trillion of American GDP at risk.

Governments and security agencies are stepping up their response. In August 2024, the US National Institute of Standards and Technology finalised its first three post-quantum encryption standards, which are new algorithms designed to withstand attacks from quantum machines that may not yet exist at scale, but which security experts increasingly assume are coming.

The problem is that, while in theory we may have solutions, putting them into practice is tricky.

The digital economy is currently standing on cryptography that may one day be obsolete, and replacing it will not be easy. Moody’s has warned that the transition could take 10 to 15 years, while the US government has estimated $7.1 billion in migration costs for its non-national security systems alone.

Warning grows over “harvest now, decrypt later” threat

With that kind of eye-watering cost, it could be easy to bury your head in the sand and assume that it’s better to leave it. But researchers have warned of "harvest now, decrypt later" attacks, where adversaries hoover up encrypted data today, store it cheaply, and wait for a machine capable of unlocking it tomorrow.

That means any information that must remain secret for decades, such as state secrets, medical records, and financial histories, ought to be locked away as a preventive measure. Citi estimates that roughly a quarter of all bitcoin, some 4.5 to 6.7 million coins, sits in addresses already exposed to the quantum threat.

Diffie and Hellman, the fathers of the internet encryption we use today, are still alive to see how their invention is holding up. Their 1976 paper asked how strangers could trust one another across an untrusted network. Fifty years on, the question has not changed. Only the machines trying to break the answer have.

Unlock more exclusive Cybernews content on YouTube.