Chinese researchers say they used a quantum computer from Canadian-founded firm D-Wave Systems to attack encryption, but, experts say, it’s no cause for panic. Here’s what you need to know.  

The claim: Cryptographic codes protect all kinds of important information and systems, from state secrets to the global flow of payments. Researchers at Shanghai University said their experiments using D-Wave’s technology showed “better realistic attack capabilities,” despite the fact that quantum computers have made slow progress in cracking encryption.

The paper, published in the Chinese Journal of Computers in May, started to whiz around the web after the South China Morning Post covered it last week. But quantum and cybersecurity experts say the coverage so far has been way overblown.

The evaluation: “It’s not something we lose sleep over regarding whether codes are going to be broken,” said Barry Sanders, scientific director of the University of Calgary-led Quantum City initiative. 

Some common encryption standards rely on a particular kind of math problem called “factorization,” essentially working back from a number to figure out which prime numbers were multiplied together to produce it. (In 3 x 5 = 15, the three and five are the primes.)

Quantum computers promise much faster processing, and the ability to solve problems that today’s most powerful machines cannot. One application could be running Shor’s algorithm, which is designed to find primes quickly and thus break current encryption. 

That’s not what the Chinese researchers did. Instead, they used a process called optimization, something that D-Wave’s quantum computers are particularly good at, which finds the most efficient way to solve a problem. For example, a logistics company might use it to find the quickest delivery route that uses the smallest amount of fuel. 

The Shanghai scientists made a “technical advance” in optimization, according to Sanders. But their math was at such a small scale that there’s “no conceivable threat” to encryption.

The reality check: D-Wave played down the paper’s significance. “Based on our assessment, this research does not represent a new fundamental breakthrough in capability,” said Trevor Lanting, the firm’s chief development officer. 

D-Wave has sold the use of its quantum computers to large firms like Volkswagen and NTT Docomo, which use them for tasks like plotting bus routes and managing cell phone traffic; cryptography is not a major area of focus. “Breaking modern encryption would require quantum processors many orders of magnitude larger than today’s scale, so there will be no threat to encryption for many years,” Lanting said.

D-Wave has faced significant financial challenges in recent years, and went public in February 2022. Long based in Burnaby, B.C., it disclosed plans to move its executives offices to Palo Alto, Calif., last June.

It’s unclear how the Chinese scientists were able to access a D-Wave quantum computer for their research. Company spokesperson Bianca Gorospe said it “only has physical systems in Canada, the U.S. and Germany,” while China is not among the countries from where D-Wave’s cloud service can be accessed.

Shanghai University professor Wang Chao, the paper’s lead author, did not respond to a request for comment.

Don’t panic: There’s no evidence that the Chinese researchers’ approach can crack the codes we use today, said Michele Mosca, CEO of EvolutionQ, a cybersecurity firm. “Don’t panic, this is probably not it,” he said. “But if it were legit, would you be ready?”

That question of readiness is a good one. Most governments and companies aren’t yet prepared for when quantum computers do become powerful enough to break the encryption they’re using, Mosca argued. Some organizations are adopting “quantum-safe” cryptography, designed to withstand the attacks from those stronger machines. 

Mosca, who’s also a University of Waterloo professor, said firms need to be ready to switch their codes quickly, and should protect critical systems with multiple layers of cybersecurity defences that use different technologies. And they shouldn’t wait until there’s a public breakthrough, because a hostile state probably won’t disclose if—and that remains a big if—they’ve broken encryption.

Technology control: Chinese scientists have recently driven significant advances in quantum technologies, prompting concerns from the U.S. and its allies, which have attempted to coordinate their spending and policies in the field. 

In July, Canada introduced new rules requiring firms to get government permits before exporting quantum computers and the semiconductors that fill them. The technology “could be used by countries and entities of concern to access and compromise sensitive information in Canada’s possession,” the order warned. 

Global Affairs Canada did not directly respond to questions about the Chinese researchers’ use of a D-Wave computer, and declined to disclose if the department has issued any export permits for quantum technologies.