Quantum-Safe Strategies for Software Developers

🔐Word o’ the Day | Year | Decade: Crypto-agility, Baby! Yesterday morning, I did a fun fireside chat with Bethany Gadfield - Netzel at the FIA, Inc. Expo in Chicago. We talked about cyber resilience, artificial intelligence, Rubik’s cubes, and that thing called quantum! A question came up at the end, “What can firms actually do today to begin transitioning to post-quantum cryptography?” So thought I would take the opportunity to share my thoughts more broadly on this important, but not super well understood, topic: 1. Don’t wait. The clock for quantum-safe cryptography is already ticking. NIST released its first set of post-quantum standards last year (https://lnkd.in/esTm8uPw) and CISA put out a “Strategy for Migrating to Automated Post-Quantum Discovery and Inventory Tools” last year as part of its broader Post Quantum Cryptography (PQC) Initiative (https://lnkd.in/evpF4umv). h/t Garfield Jones, D.Eng.! 2. Inventory & prioritize. Map all cryptographic usage: what keys, certificates, protocols, and data streams exist today? Which assets hold long-lived value and are at risk of “harvest-now, decrypt-later”? Build a migration roadmap that prioritizes highest-risk systems (e.g., financial settlement platforms, inter-bank links, legacy encryption). 3. Establish crypto-agility. Ensure your architecture supports swapping algorithms, updating certificates, & layering classical + post-quantum primitives without a full system rebuild. This kind of flexibility is key for resilience. 4. Pilot and migrate. Use the new NIST-approved algorithms; experiment first on less time-sensitive systems, validate performance and interoperability, then scale to mission-critical applications. NIST’s IR 8547 report provides a framework for this transition. 5. Vendor & supply-chain alignment. Ask your vendors & service providers: “What’s your PQC transition plan? When will you support NIST-approved post-quantum algorithms? Are your update paths crypto-agile?” If the answer isn’t clear or (as a former boss of mine used to say) they look at you like a “pig at a wristwatch,” you’ve got a potentially serious third-party risk. 6. Board and Exec engagement. Position this not as an IT problem but a fiduciary risk and resilience imperative. The transition to quantum-safe cryptography is multi-year and multi-layered—waiting until it’s urgent means it will be too late.

𝗗𝗮𝘆 𝟴: 𝗗𝗮𝘁𝗮 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗮𝗻𝗱 𝗣𝗼𝘀𝘁 𝗤𝘂𝗮𝗻𝘁𝘂𝗺 𝗥𝗲𝗮𝗱𝗶𝗻𝗲𝘀𝘀 In today’s hyper-connected world, data is the new currency and the perimeter, and it is essential to safeguard them from Cyber criminals. The average cost of a data breach reached an all-time high of $4.88 million in 2024, a 10% increase from 2023. Advances in 𝗾𝘂𝗮𝗻𝘁𝘂𝗺 𝗰𝗼𝗺𝗽𝘂𝘁𝗶𝗻𝗴 further threaten traditional cryptographic systems by potentially rendering widely used algorithms like public key cryptography insecure. Even before large-scale quantum computers become practical, adversaries can harvest encrypted data today and store it for future decryption. Sensitive data encrypted with traditional algorithms may be vulnerable to retrospective attacks once quantum computers are available. As quantum technology evolves, the need for stronger data protection grows. Google Quantum AI recently demonstrated advancements with its Willow processors, which 𝗲𝗻𝗵𝗮𝗻𝗰𝗲𝘀 𝗲𝗿𝗿𝗼𝗿 𝗰𝗼𝗿𝗿𝗲𝗰𝘁𝗶𝗼𝗻 𝘂𝘀𝗶𝗻𝗴 𝘁𝗵𝗲 𝘀𝘂𝗿𝗳𝗮𝗰𝗲 𝗰𝗼𝗱𝗲. These breakthroughs underscore the growing efficiency and scalability of quantum computers. To address these threats, Enterprises are turning to 𝗮𝗴𝗶𝗹𝗲 𝗰𝗿𝘆𝗽𝘁𝗼𝗴𝗿𝗮𝗽𝗵𝘆 to prepare for Post Quantum era. Proactive Measures for Agile Cryptography and Quantum Resistance: 1. 𝗔𝗱𝗼𝗽𝘁 𝗣𝗼𝘀𝘁-𝗤𝘂𝗮𝗻𝘁𝘂𝗺 𝗔𝗹𝗴𝗼𝗿𝗶𝘁𝗵𝗺𝘀 Transition to NIST-approved PQC standards like CRYSTALS-Kyber, CRYSTALS-Dilithium, Sphincs+. Use hybrid cryptography that combines classical and quantum-resistant methods for a smoother transition. 2. 𝗗𝗲𝘀𝗶𝗴𝗻 𝗳𝗼𝗿 𝗔𝗴𝗶𝗹𝗶𝘁𝘆 Avoid hardcoding cryptographic algorithms. Implement abstraction layers and modular cryptographic libraries to enable easy updates, algorithm swaps, and seamless key rotation. 3. 𝗔𝘂𝘁𝗼𝗺𝗮𝘁𝗲 𝗞𝗲𝘆 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 Use Hardware Security Modules (HSMs) and Key Management Systems (KMS) to automate secure key lifecycle management, including zero-downtime rotation. 4. 𝗣𝗿𝗼𝘁𝗲𝗰𝘁 𝗗𝗮𝘁𝗮 𝗘𝘃𝗲𝗿𝘆𝘄𝗵𝗲𝗿𝗲 Encrypt data at rest, in transit, and in use with quantum resistant standards and protocols. For unstructured data, use format-preserving encryption and deploy data-loss prevention (DLP) tools to detect and secure unprotected files. Replace sensitive information with unique tokens that have no exploitable value outside a secure tokenization system. 5. 𝗣𝗹𝗮𝗻 𝗔𝗵𝗲𝗮𝗱 Develop a quantum-readiness strategy, audit systems, prioritize sensitive data, and train teams on agile cryptography and PQC best practices. Agile cryptography and advanced data devaluation techniques are essential for protecting sensitive data as cyber threats evolve. Planning ahead for the post-quantum era can reduce migration costs to PQC algorithms and strengthen cryptographic resilience. Embrace agile cryptography. Devalue sensitive data. Secure your future. #VISA #PaymentSecurity #Cybersecurity #12DaysofCyberSecurityChristmas #PostQuantumCrypto

Recent research from Shanghai University demonstrated quantum annealing attacks on RSA encryption. But here's what you really need to know about our quantum-ready future: The Current Landscape: - NIST finalized quantum-resistant standards - Two approved signature methods: ML-DSA & SLH-DSA - One key exchange method: ML-KEM - DWave quantum annealer cracked 50-bit RSA 🔍 Breaking Down Our Quantum-Safe Tools: 1. ML-DSA (Dilithium) - The "speed champion" for signatures - Efficient for most enterprise uses - Smaller signatures than alternatives - Based on lattice cryptography - Already being implemented by Google 2. SLH-DSA (SPHINCS+) - The "security champion" - Incredibly small keys (32-64 bytes) - Larger signatures (17KB) - Based on hash functions - Perfect for high-security needs 3. ML-KEM (Kyber) - The future of secure key exchange - Replacement for current RSA/DH - Strong performance characteristics - Currently being tested in Chrome The Reality Check: - Current 2048-bit RSA remains safe... for now - Quantum capabilities doubling every ~6 months - "Harvest now, decrypt later" attacks are real - We have standards - implementation is key 🎯 Smart Next Steps for Leaders: 1. Identify systems using pre-quantum crypto 2. Plan for larger signature storage needs 3. Consider hybrid classical/quantum-safe approaches 4. Build quantum-safe requirements into new projects 5. Watch market leaders' implementation strategies Why This Matters: - Quantum computing access is expanding - Standards are set - action is needed - Early adoption = competitive advantage - Security compliance will require updates The Bottom Line: We're not facing a quantum apocalypse, but we are in a critical transition period. The organizations that thrive will be those that understand quantum isn't just coming - it's already being built into tomorrow's security standards. 💭 Questions for Leaders: - How are you planning your quantum-safe transition? - Have you identified your most vulnerable systems? - Which NIST standard aligns with your security needs? #Cybersecurity #QuantumComputing #Encryption #InfoSec #TechLeadership

Quantum computing is advancing rapidly, bringing unprecedented processing power that threatens traditional encryption methods. The "collect now, decrypt later" strategy underscores the urgency of preparation, adversaries are already harvesting encrypted data with the intent to decrypt it once large-scale quantum computers become viable. Fortinet is leading the way in quantum-safe security, integrating NIST PQC algorithms, including CRYSTALS-KYBER, into FortiOS to safeguard data from future quantum-based attacks. "A recent real-world demonstration by JPMorgan Chase (JPMC) showcased quantum-safe high-speed 100 Gbps site-to-site IPsec tunnels secured using QKD. The test was conducted between two JPMC data centers in Singapore, covering over 46 km of telecom fiber, and achieved 45 days of continuous operation." "The network leveraged QKD vendor ID Quantique for the quantum key exchange, Fortinet’s FortiGate 4201F for network encryption, and FortiTester for performance measurement." This is not just a theoretical concern, organizations are already deploying quantum-safe encryption solutions. As quantum computing capabilities advance, organizations must adopt quantum-resistant security architectures and take proactive steps now to safeguard their sensitive information against future quantum-enabled attacks. These proactive methods include: -adopting hybrid cryptographic approaches, combining classical and PQC algorithms, ensuring interoperability and a phased transition -implementing crypto-agile architectures, for seamless updates to encryption mechanisms as new quantum-resistant standards emerge -leveraging PQC capable HSMs and TPMs -evaluating network security architectures, such as ZTNA models -ensuring authentication and access controls are resistant to quantum threats. -identifying mission-critical and long-lived data, that must remain secure for decades. -implementing sensitivity-based classification, determine which datasets require the highest level of post-quantum protection. -conducting risk assessments to evaluate data exposure, storage locations, and current encryption standards. -transitioning to quantum-resistant encryption algorithms recommended by NIST’s PQC standardization efforts. -establishing data-at-rest and data-in-transit encryption policies, mandate use of PQC algorithms as they become available. -strengthening key management practices -developing GRC frameworks ensuring adherence to post-quantum security. -implementing continuous cryptographic monitoring to detect and phase out vulnerable encryption methods. -enforcing regulatory compliance by aligning with emerging PQC standards. -establishing incident response plans to handle quantum-driven cryptographic threats proactively. Fortinet remains committed to pioneering quantum-safe encryption solutions, enabling organizations to stay ahead of emerging cryptographic threats. Read more from Dr. Carl Windsor, Fortinet’s CISO!

🔑"𝐇𝐚𝐫𝐯𝐞𝐬𝐭 𝐍𝐨𝐰, 𝐃𝐞𝐜𝐫𝐲𝐩𝐭 𝐋𝐚𝐭𝐞𝐫" (𝐇𝐍𝐃𝐋) attacks intercept RSA-2048 or ECC-encrypted files, stockpiling them for future decryption. Once a powerful quantum computer comes online, they can unlock those archives in hours, exposing years’ worth of secrets. This silent threat targets everything from personal records to diplomatic communications. 🔐 📌 HOW CAN CYBERSECURITY LEADERS AND EXECUTIVES PREPARE? 🎯🎯𝐁𝐮𝐢𝐥𝐝 𝐂𝐫𝐲𝐩𝐭𝐨𝐠𝐫𝐚𝐩𝐡𝐢𝐜 𝐀𝐠𝐢𝐥𝐢𝐭𝐲: Ensure your systems can swiftly swap out cryptographic algorithms without extensive re-engineering. 𝐂𝐫𝐲𝐩𝐭𝐨-𝐚𝐠𝐢𝐥𝐢𝐭𝐲 𝐢𝐬 𝐭𝐡𝐞 𝐚𝐛𝐢𝐥𝐢𝐭𝐲 𝐭𝐨 𝐫𝐚𝐩𝐢𝐝𝐥𝐲 𝐭𝐫𝐚𝐧𝐬𝐢𝐭𝐢𝐨𝐧 𝐭𝐨 𝐮𝐩𝐝𝐚𝐭𝐞𝐝 𝐞𝐧𝐜𝐫𝐲𝐩𝐭𝐢𝐨𝐧 𝐬𝐭𝐚𝐧𝐝𝐚𝐫𝐝𝐬 𝐚𝐬 𝐭𝐡𝐞𝐲 𝐛𝐞𝐜𝐨𝐦𝐞 𝐚��𝐚𝐢𝐥𝐚𝐛𝐥𝐞. Designing for agility now will let you plug in PQC algorithms (or other replacements) with minimal disruption later. 🎯𝐈𝐦𝐩𝐥𝐞𝐦𝐞𝐧𝐭 𝐇𝐲𝐛𝐫𝐢𝐝 𝐂𝐫𝐲𝐩𝐭𝐨𝐠𝐫𝐚𝐩𝐡𝐲: Do not wait for the full PQC rollout. 👉 𝐒𝐭𝐚𝐫𝐭 𝐮𝐬𝐢𝐧𝐠 𝐡𝐲𝐛𝐫𝐢𝐝 𝐞𝐧𝐜𝐫𝐲𝐩𝐭𝐢𝐨𝐧 𝐍𝐎𝐖! Combine classic schemes like ECDH or RSA with a post-quantum algorithm (e.g. a dual key exchange using ECDH + Kyber). 🎯𝐌𝐚𝐢𝐧𝐭𝐚𝐢𝐧 𝐚 𝐂𝐫𝐲𝐩𝐭𝐨𝐠𝐫𝐚𝐩𝐡𝐢𝐜 𝐁𝐢𝐥𝐥 𝐨𝐟 𝐌𝐚𝐭𝐞𝐫𝐢𝐚𝐥𝐬 (𝐂𝐁𝐎𝐌): 👉𝐈𝐧𝐯𝐞𝐧𝐭𝐨𝐫𝐲 𝐚𝐥𝐥 𝐜𝐫𝐲𝐩𝐭𝐨𝐠𝐫𝐚𝐩𝐡𝐢𝐜 𝐚𝐬𝐬𝐞𝐭𝐬 𝐢𝐧 𝐲𝐨𝐮𝐫 𝐨𝐫𝐠𝐚𝐧𝐢𝐳𝐚𝐭𝐢𝐨𝐧: algorithms, key lengths, libraries, certificates, and protocols. A CBOM provides visibility into where vulnerable algorithms (like RSA/ECC) are used and helps prioritize what to fix. 🎯🎯���𝐥𝐢𝐠𝐧 𝐰𝐢𝐭𝐡 𝐍𝐈𝐒𝐓’𝐬 𝐐𝐮𝐚𝐧𝐭𝐮𝐦 𝐌𝐢𝐠𝐫𝐚𝐭𝐢𝐨𝐧 𝐑𝐨𝐚𝐝𝐦𝐚𝐩: Follow expert guidance for a structured transition. 𝐓𝐡𝐞 𝐔.𝐒. 𝐠𝐨𝐯𝐞𝐫𝐧𝐦𝐞𝐧𝐭 (𝐂𝐈𝐒𝐀, 𝐍𝐒𝐀, 𝐚𝐧𝐝 𝐍𝐈𝐒𝐓) 𝐚𝐝𝐯𝐢𝐬𝐞𝐬 𝐞𝐬𝐭𝐚𝐛𝐥𝐢𝐬𝐡𝐢𝐧𝐠 𝐚 𝐪𝐮𝐚𝐧𝐭𝐮𝐦-𝐫𝐞𝐚𝐝𝐢𝐧𝐞𝐬𝐬 𝐫𝐨𝐚𝐝𝐦𝐚𝐩, starting with a thorough cryptographic inventory and risk assessment. Keep abreast of NIST’s PQC standards timeline and recommendations.  National Institute of Standards and Technology (NIST) #𝐇𝐍𝐃𝐋 Cyber Security Forum Initiative #CSFI 🗝️ Now is the time to future-proof your encryption! 🗝️ 𝑌𝑜𝑢 𝑠ℎ𝑜𝑢𝑙𝑑𝑛'𝑡 𝑎𝑠𝑠𝑢𝑚𝑒 𝑡ℎ𝑎𝑡 𝑦𝑜𝑢𝑟 𝑑𝑎𝑡𝑎 𝑖𝑠 𝑠𝑒𝑐𝑢𝑟𝑒 𝑗𝑢𝑠𝑡 𝑏𝑒𝑐𝑎𝑢𝑠𝑒 𝑖𝑡 𝑖𝑠 𝑒𝑛𝑐𝑟𝑦𝑝𝑡𝑒𝑑...

I've given talks about Post Quantum Cryptography the past few years and pretty much everyone has appreciated the heads up, for those that haven't made it to a talk here are the highlights of what you need to do to prepare for Quantum Computers. 1) Build organizational readiness: • Educate and align the C-suite on the urgency of quantum risk and make the business case for a multi-year investment, i.e. get budget. • Identify personnel responsible for migration execution across different teams, i.e. assign a point person for this project. 2) Discover what you have and assess if the systems are ready: • Get an inventory of you hardware and software assets to identify encryption protocols and categorize them (PQ ready, depreciated, really old). • Assess whether hardware assets have sufficient compute to support PQC algorithms (most systems will but the OS might not be ready) • Figure out which systems will require upgrades or replacements. • Identify vendors and partners that you use and discuss their PQC roadmaps, migration support capabilities. [This one is key, talk to your vendors, find out what they are doing, or not doing!] 3) Begin getting Quantum ready • Buy the hardware / software and replace or upgrade whatever does not support PQ cryptography • Test things! Run proof-of-concept deployments in controlled environments (i.e. your test environment) and use a hybrid approach that combine current and post-quantum algorithms. 4) Deploy Quantum ready solutions • Roll out your solutions / new hardware & software in phases, starting with your high priority systems (Duh). • Ensure configurations enforce quantum-safe algorithms by default and automatically block deprecated algorithms when possible (this will be harder than you might think). • Update your security policies to manage both current and quantum-safe network traffic as you transition. • For the old stuff you can't get rid of, use proxy solutions to make IoT devices (like hospitals, manufacturing, etc.) quantum-ready until they can be updated directly. Last but not least, be prepared to change encryption schemes going forward, what we call, Crypto Agility. 5) Keep patching your stuff • Now that you have a list of your hardware and software and what kind of encryption is uses, do this: • Monitor your inventory for vulnerabilities or new threats. Keep in mind that PQ standards are new and they will likely change over time. • Establish a process to replace or update vulnerable algorithms There, you've now just read my talk, but you missed all my jokes and fun stories, but you got the details / important take aways. 😃 😁 😀 If you want the Internal Control Questionnaire (#ICQ) I put together for some auditor friends, message me here and I'll send it to you.

🔐Europol PRIORITISING POST-QUANTUM CRYPTOGRAPHY MIGRATION ACTIVITIES IN FINANCIAL SERVICES ⚛️As post-quantum cryptography (PQC) becomes integrated into mainstream information technology (IT) products and services, financial services institutions must begin to execute their transition strategies. This document provides actionable guidelines to incorporate quantum safety into existing risk management frameworks by assessing the ‘Migration Priority’ based on the ‘Quantum Risk’ and ‘Migration Time’ of business use cases and highlighting opportunities for immediate execution. ⚛️A critical first step is to inventory all business use cases that rely on public key cryptography. This inventory enables the creation of a prioritised transition roadmap by assessing the Quantum Risk of each use case based on three parameters: 🟣 Shelf Life of Protected Data: How long the data remains sensitive. 🟣 Exposure: The extent to which data is accessible to potential attackers. 🟣 Severity: The business impact of a potential compromise. ⚛️When the Quantum Risk is assessed, organisations can prioritise actions based on each use case’s Migration Time, i.e., the complexity and timeline required to achieve Quantum Safety for a use case. As part of this activity, organisations will identify, for instance, actions that can be launched immediately and the use cases that require coordination with long-term asset lifecycles. 🟣 Solution Availability: Maturity of PQC standards, and their general availability in products and services. 🟣Execution Cost: The effort, cost, and complexity of implementing the quantum-safe solutions within the organisation. 🟣 External Dependencies: Execution complexity due to coordination required with third parties and their transition roadmaps (standardisation bodies, vendors, peers, regulators, and customers). ⚛️Examples of use cases that financial organisations can begin implementing today include: 🟣 Integration of post-quantum requirements into the long-term roadmap for hardware-intensive use cases aligned with financial asset lifecycles. 🟣 Enhancement of confidentiality protection for transactional websites. 🟣Identification and elimination of cryptographic antipatterns to reduce future technical debt. ⚛️These are examples of how financial institutions can take timely, structured steps toward an efficient and forward-looking transition to post-quantum cryptography. https://lnkd.in/d4qiS6X9