A Crise Y2Q: Por que Hackers Estão Roubando Dados Sem Valor

Right now, in data centers across Virginia, Frankfurt, and Singapore, invisible intruders are stealing garbage.

They are exfiltrating petabytes of encrypted traffic—VPN sessions, diplomatic cables, bank transfers, and trade secrets. If an analyst looked at this data today, it would look like white noise. It is mathematically indecipherable, locked behind RSA-2048 or Elliptic Curve encryption (ECC) that would take a conventional supercomputer the age of the universe to crack.

But the thieves aren’t trying to read it today. They are storing it in massive cold-storage facilities, waiting for a specific date on the calendar.

Experts call it Y2Q (Years to Quantum). The intelligence community calls it HNDL: “Harvest Now, Decrypt Later.”

The bet is simple: sometime between 2026 and 2030, a Cryptographically Relevant Quantum Computer (CRQC) will come online. When it does, it will turn that mountain of “worthless” encrypted data into an open book, instantly exposing the last decade of global secrets.

The Physics of the Collapse

To understand why a bank account is in danger, one must understand the math that protects it.

Most of the internet runs on Public Key Cryptography (like RSA). This relies on a mathematical trapdoor: it is incredibly easy to multiply two large prime numbers together, but almost impossible to take the result and figure out which two primes created it (Integer Factorization).

$N = p \times q$

If $p$ and $q$ are large enough (hundreds of digits long), finding them is a “Hard Problem” for classical physics. This asymmetry is the foundation of trust on the web.

Enter Shor’s Algorithm. In 1994, mathematician Peter Shor proved that a quantum computer could solve this prime factorization problem not in billions of years, but in hours.

The magic lies in Quantum Superposition and Interference.

• Classical Computers must try to factor numbers by trial and error (brute force), checking one possibility at a time.
• Quantum Computers utilize qubits that can exist in multiple states simultaneously. Shor’s algorithm uses a subroutine called “Period Finding.” It sets up a quantum register that contains a superposition of all possible inputs. By applying a Quantum Fourier Transform (QFT), the wrong answers destructively interfere (cancel each other out), while the correct answer (the period of the function) constructively interferes (amplifies).

This allows the computer to find the hidden structure of the prime factors in polynomial time. When a quantum computer with enough stable qubits (estimated around 4,000 logical qubits) comes online, RSA encryption won’t just be weakened; it will be 0% effective. It will be as if the password was sent in plain text.

The New Shield: NIST FIPS 203, 204, & 205

The sky isn’t falling—yet. For the last six years, the National Institute of Standards and Technology (NIST) has been running a global competition to find new math problems that even a quantum computer can’t solve.

In late 2024, NIST finalized the first three standards. These are the tools the industry will use to fight Y2Q.

1. FIPS 203 (ML-KEM): The Key Exchange

Formerly known as CRYSTALS-Kyber. This is the algorithm that will protect the “handshake” when a browser connects to a website (HTTPS). It replaces the Diffie-Hellman exchange. It is efficient, relatively fast, and has been battle-tested by cryptographers for years. It is designed to be a “Key Encapsulation Mechanism” (KEM)—it doesn’t encrypt large files directly, but rather safely transports the temporary symmetric key used for the session.

2. FIPS 204 (ML-DSA): The Digital Signature

Formerly known as CRYSTALS-Dilithium. This proves identity. It replaces RSA signatures and ECDSA. When an iPhone verifies an update is actually from Apple, it uses a signature. In the future, it will use ML-DSA. It offers a balance of security and performance but produces signatures significantly larger than current ECC standards.

3. FIPS 205 (SLH-DSA): The Backup

Formerly known as SPHINCS+. This is a stateless hash-based signature. It is slower and produces larger signatures than Dilithium, but it uses completely different math (Hash functions vs Lattices). It is the insurance policy. If a mathematician finds a fatal flaw in the newer “Lattice” math used by Kyber and Dilithium, the world can fall back to the brute-force reliability of hash-based signatures.

How It Works: The “Lattice” Trap

Both FIPS 203 and 204 rely on Lattice-Based Cryptography. This is the most important concept in modern security.

Imagine a massive, multidimensional grid (a lattice). If someone points to a specific intersection on a grid line and asks for the nearest other intersection, that is easy in 2D (graph paper).

But imagine this grid has 1,000 dimensions. And imagine the challenger adds a specified amount of random “noise” to the point, so it doesn’t sit perfectly on a line. Asking the computer to find the original grid point is called the Learning With Errors (LWE) problem.

$\mathbf{b} = \mathbf{A}\mathbf{s} + \mathbf{e}$

• $\mathbf{A}$ is a public matrix (the map).
• $\mathbf{s}$ is the secret vector (the answer).
• $\mathbf{e}$ is the error (the noise).

Finding the secret $\mathbf{s}$ given only the public $\mathbf{A}$ and the noisy result $\mathbf{b}$ is incredibly hard. It is categorized as an NP-Hard problem. Even for a quantum computer, it is computationally exhaustive. Shor’s algorithm (which destroys RSA) is useless against Lattices because it relies on finding “periods” (repeating cyclic patterns) in numbers. Lattices used in cryptography are designed to be “unstructured” in a way that prevents this periodic exploitation.

The Infrastructure Nightmare

So, simply updating the software should suffice? Unfortunately, no. The migration to Post-Quantum Cryptography (PQC) is going to be a messy, expensive headache for every CTO on the planet. The problem is physics: Quantum-resistant keys are heavy.

The Size Problem Current encryption keys are tiny. An ECC public key is just 32 bytes. It fits easily into a single TCP data packet.

• A Kyber-1024 (FIPS 203) key is 1,568 bytes.
• A Dilithium-5 (FIPS 204) signature is 4,595 bytes.

This might not sound like much in the age of gigabit fiber, but in the micro-world of network handshakes, it is a massive bloat.

1. Packet Fragmentation: These keys often exceed the standard MTU (Maximum Transmission Unit) of 1500 bytes. This means every handshake now requires multiple packets. If a router drops the second fragment, the entire connection fails.
2. The “HelloRetryRequest” Loop: In TLS 1.3, the Client sends a “ClientHello” packet to start the connection. If the PQC key is too big to fit in this initial hello, or if the server doesn’t support the specific hybrid group offered, the server sends a “HelloRetryRequest,” forcing a second round-trip. This adds significant latency to every new connection.
3. Hardcoded Middleboxes: Thousands of legacy firewalls, load balancers, and IoT devices have hardcoded limits on header sizes. If a client sends a 4KB header, these “middleboxes” might flag it as a DoS attack or buffer overflow attempt and drop the connection.
4. Performance Penalty: Verifying these signatures takes more CPU power. For a server handling millions of connections (like Google or Cloudflare), this CPU overhead translates to millions of dollars in electricity and new hardware.

The “Harvest Now” Reality Check

The most chilling aspect of Y2Q isn’t the future; it’s the present.

If a bank or a government agency transmits data today, and that data needs to remain secret for more than 5 years, it is already compromised.

• Social Security Numbers? Compromised.
• Trade secrets for a 2030 product launch? Compromised.
• Diplomatic cables regarding nuclear policy? Compromised.

This is why the White House issued NSM-10, mandating that all federal agencies begin the migration to PQC immediately. They know the harvest is happening. Intelligence agencies are currently building massive “Data Lakes” of encrypted traffic. They don’t need to read it now. They just need to hold it until the key turns.

What Developers Must Do

If an IT leader hasn’t started planning, they are already behind. The transition will take years, not weeks.

1. Inventory Crypto Assets: You can’t fix what you don’t know. Use scanning tools (like CBOMs - Cryptography Bill of Materials) to find every instance of RSA, ECDSA, and Diffie-Hellman in the codebase.
2. Test Hybrid Modes: Don’t switch to PQC cold turkey. Use Hybrid Encryption (e.g., X25519 + Kyber). This combines the proven security of classical algorithms with the quantum resistance of the new ones. Ideally, the KEM is derived from both key exchanges. If Kyber turns out to have a mathematical flaw (which happens in new crypto), the classical layer still protects the data against classical attacks.
3. Check The Supply Chain: AWS, Cloudflare, and Signal are already rolling out PQC support. If a VPN or database provider hasn’t mentioned “FIPS 203” on their roadmap, start asking questions.

The door to the quantum future is opening. The only question is whether the locks will be changed before the thieves walk right in.