Getting Past the Post-Quantum Cryptography Discovery Phase
Most organizations haven’t sorted out their cryptographic estate enough to even know where they’d start with post-quantum cryptography (PQC).
The pressure is mounting for security leaders to get serious about their post-quantum cryptography (PQC) transition plans, but most organizations aren’t even ready to get ready for PQC.
Studies show that, yes, CISOs today do see PQC as a priority they’ve got to plan for. However, the bulk of organizations don’t have a detailed enough cryptographic inventory to help them sketch out a roadmap of where to get started.
“When it comes to post-quantum cryptography, every company, no matter which ones you talk to are kind of stuck in the discovery phase,” says Dr. Anurag Swarnim Yadav, founder and CTO of the startup QubitAC.
Recent numbers back up his observations. According to a July study by DigiCert, while 87% of organizations say they’re planning, testing, or implementing PQC, only 44% have developed transition plans or created inventories. That mirrors another study by Ponemon Institute that found only 43% of organizations have full visibility of their cryptographic estate. Those respondents reported that their inability to discover those assets and improve that visibility is their number one greatest concern about PQC migration.
Cryptography sits in web servers, certificates, VPNs, code signing, vendor products and all nature of assets in between. Getting every encryption use case ready for a post-quantum world will be a sweeping transition, and the latest research suggests developments in quantum computing are proceeding on a much faster timeline than originally anticipated. If an enterprise can’t enumerate all the cryptography impacted, it means they’re not toeing the start line for this footrace.
The Ticking PQC Clock
Getting all of those assets into post-quantum readiness will be a generational effort easily on par with the Y2K effort. Unlike with Y2K, however, there’s no set-in-stone deadline for post-quantum.
The closest thing is Q Day, the point when a cryptographically relevant quantum computer (CRQC) can break the public-key cryptography behind key exchange and digital signatures. The big problem with building a widespread sense of urgency is that nobody knows exactly when Q Day will arrive.
Yadav says estimates for when Q Day will come run from 2030 to 2040 and beyond, but his own bet is that attackers could pull it off by 2029 based how the research is shifting. The expected window until Q Day arrives keeps compressing as quantum researchers perfect their craft. Last year, Google researchers calculated that breaking 2048-bit RSA encryption would take a quantum computer 20 times smaller than they had estimated in 2019. And in March Google set a 2029 target for its own PQC migration, influenced by such research and recent progress in quantum hardware.
Global governments are also starting to get firm about their own timing expectations for PQC transition in the run-up to Q Day. NIST finalized its PQC transition roadmap in late October, and a June executive order requires federal high-value assets and high-impact systems to move key establishment to post-quantum algorithms by 2030 and digital signatures by 2031. The United Kingdom’s National Cyber Security Centre recommends that large organizations complete discovery and assessment and build an initial migration plan by 2028, then finish migrating by 2035.
Even if we don’t know exactly when Q Day will come about, the math behind what will happen after that day is well understood. Public-key cryptography lets two parties who have never met agree on a secret and prove who they are. It works because some math is easy to run forward and impractical to reverse. RSA relies on the difficulty of factoring huge numbers, while elliptic curve cryptography and Diffie-Hellman key exchange rely on a related problem called the discrete logarithm.
Quantum computers use subatomic particles instead of transistors to represent data. This gives them an edge in how they process the ones and zeros of computing. Cryptography experts for years have warned that a sufficiently advanced enough quantum computer could use that edge to factor huge numbers and solve discrete logarithms at a rate of efficiency unheard of from even the most advanced classical super computers.
Worthless Now, Priceless Later
There’s also a more immediate deadline that’s brewing from what attackers are likely doing today to prepare for Q Day. It’s fairly trivial for the bad guys to vacuum up high-value encrypted traffic today with the promise that they might have a chance to decrypt it at a later date. For long-lived information like financial or health details, or secret sauce intellectual property, the long-game of this harvest now, decrypt later (HNDL) is worth the effort for future-minded criminals.
“The data is worthless to attackers right now, but becomes priceless later,” Yadav explains. He offers credit card numbers as a classic example. They stay valid for years, so a cache of encrypted numbers harvested now could still be good if Q Day lands inside that window.
In its recently finalized roadmap, the National Institute of Standards and Technology named HNDL as one of the main reasons the transition is so urgent. NIST mathematician and cryptographic expert Andrew Regenscheid says HNDL reframes the whole PQC timeline for critical information stores across industry and government systems.
“This information may need to remain secret for years, or even decades, into the future,” he explained in a NIST Q&A this summer. “For that kind of information, waiting until a cryptographically relevant quantum computer arrives is waiting too long.”
Easing Into PQC Requires a Roadmap
Considering that the most isolated cryptographic migrations can still linger for upwards of a decade or longer, even a conservative 2040 estimate for Q Day should be enough to have security experts scrambling to plan PQC transitions. The scale of changes needed will take significant planning and prioritization that will need to be phased in.
“Changing these algorithms is something that’s been done before. It’s a complex process that takes years,” Regenscheid said. “Based on our experience and the challenge of navigating the post-quantum world, we expect this process to be the most challenging one yet. The breadth of these systems and the complexity of the change will dwarf what we’ve done before.”
The destination, at least, is defined. In 2024, NIST finalized three post-quantum standards, one for key exchange (ML-KEM) and two for digital signatures (ML-DSA and SLH-DSA), built on math that’s expected to hold up against quantum computers. The harder job is finding every place RSA and elliptic curve cryptography still run, and planning how and when to swap out each use case. Because of HNDL, NIST suggests the first transition phases should be prioritized around data that is particularly sensitive or has to stay secure for a long time.
In a September study on PQC readiness, Frost & Sullivan analysts emphasized how important risk-based prioritization like this will be for PQC readiness.
“A non-compliant cryptographic asset supporting a low-value application may represent limited immediate risk, while the same technology supporting sensitive information or a critical business process could require urgent remediation,” they wrote.
Sorting through all the assets and ranking them depends on having a solid inventory on hand, though. This is why the discovery is so crucial. Frost &Sullivan concurred that the discovery process is proving to be trickier than many thought it would be.
“The inventory needs to extend beyond simply identifying algorithms to understanding the dependencies between cryptographic assets and business-critical applications,” they explained.
A Free First Step for Discovery
Tools — commercial and open source — designed to assist organizations in their PQC journey are already available. These tools have their own approaches and have varying levels of maturity. One such tool is AC Scanner, which Yadav and QubitAC co-founder Joseph Wilson demoed at Black Hat Arsenal last August. The free open-source tool is purpose-built to kickstart the inventory process, Yadav says. It’s a fast, lightweight tool that runs from command line, scans for outward facing TLS and SSH services, and creates an inventory for the IP range it’s pointed at.
“You start with nothing but a domain name and by the end you get a complete cryptographic bill of materials (CBOM),” Yadav says. The CBOM is an inventory of the algorithms, keys, certificates and protocols in use, and the scanner pairs it with two scores, one for overall security health and one for post-quantum readiness based on NIST’s post-quantum standards.
It also doubles as an outside check on HNDL exposure. Every encrypted session starts with a key exchange, where the two sides agree on a secret. If a public-facing endpoint still uses a classical exchange, traffic an attacker records today could be unlocked later by a quantum computer. A hybrid exchange that adds post-quantum math protects that traffic, provided the client uses it too, and the scanner reports which kind each endpoint offers.
Classical endpoints are the ones most exposed to HNDL, and Yadav sees AC Scanner as giving organizations a starting point for making HNDL-aware transition plans.
Of course, any security professional will be quick to point out that a scan is just an informational snapshot. It’s what happens after that information is in hand that really counts. Scanning tools can kickstart discovery, but organizations need to follow up what they find with a migration plan and start executing on it. NIST’s Regenscheid says the sooner organizations can get to these plans, the better.
“Given how long these transitions take, the organizations that start planning and begin moving to post-quantum products and services now will be in a far stronger position later,” he says, stating that this is an opportunity to modernize a lot of the process. “Many steps must occur in sequence, which is why an early start is crucial.”
Originally published on Dark Reading
