Why do we still use RSA 2048 when we know that quantum computers can crack RSA as fast as classical computers can create the key?
Providers, governments, APTs, etc. can sniff all the traffic and as soon as the day comes when quantum computers are mass-capable, all the traffic in the world, including past traffic, is public and the world burns.
Are there any security measures to prevent this and what are they?
There are several factors in play here:
First, it's not like we have much of a choice: public-key cryptosystems are standardized and widely available, change in this field is slow. We definitely need PK cryptography to secure the internet. The standardized PK protocols we have are unfortunately vulnerable to quantum computers.
Second, because the threats of quantum computers are still distant. Right now, RSA and elliptic curves are probably still secure. Recent years have shown advances in connecting more qubits, but we're still very far off from a general-purpose quantum computer that could be used to accelerate an attack on PK cryptography.
Third, because of forward secrecy, but this is a weak defense in the quantum context. In an interactive context such as TLS, RSA isn't used as an encryption algorithm but rather for authentication. The actual communication is instead encrypted using a symmetric cipher, and the ephemeral symmetric key is negotiated via a key exchange protocol. Symmetric ciphers like AES are not threatened by quantum computers. Unfortunately, common key exchange protocols like Diffie-Hellman or ECDH are a kind of PK crypto and are also vulnerable to quantum computing.
Fourth, because post-quantum cryptosystems are fairly young and have seen less analysis. For RSA and elliptic curves, we have a pretty good idea of the advantages and problems. For protecting communications right now, they are the best bet. In particular, current methods are perfectly suitable for ensuring the integrity and medium-term confidentiality of messages. But when a threat model has a horizon of decades, using one of the proposed post-quantum cryptography techniques could be more appropriate. Such long term choices are a bet about what happens first: do attackers first obtain practical quantum computers, or do they first learn about an exploitable flaw in one of the proposed post-quantum algorithms?
Quantum is the Y2K of our generation. The difference here is that no one knows the deadline this time. It was hard enough to get governments and businesses to spend money and effort fixing a problem when they knew the deadline; here it's too easy for a politician or executive to kick the can because we can't give them an actual deadline. (Another analogous situation is climate change).
At some point there will be a global scramble to update all the world's encryption to be Quantum safe, an effort which will make Y2K feel like a Windows update by comparison. But that day won't come until RSA has been verifiably broken and there have been real world consequences. Until then we will all go along happily playing with 2-digit years, er I mean prime factors.
