The article explains quantum readiness and post-quantum cryptography (PQC), describing the risks from future Cryptographically Relevant Quantum Computers (CRQCs), the Harvest Now, Decrypt Later threat, and the need to inventory and migrate vulnerable asymmetric cryptography. It summarizes NIST’s selected PQC standards, migration timelines and recommendations (prioritize TLS/SSH key exchange upgrades and inventorying), and describes Wiz’s “Wiz for Post-Quantum Cryptography Security Framework” and tools to detect and manage at-risk encryption. #NIST #OpenSSH
Keypoints
- Cryptographically Relevant Quantum Computers (CRQCs) do not yet exist to break current public-key cryptography, but the risk (Q-Day) and Harvest Now, Decrypt Later attacks motivate early preparation.
- NIST announced PQC standards on August 13, 2024: CRYSTALS-Kyber (ML-KEM), CRYSTALS-Dilithium (ML-DSA), Sphincs+ (SLH-DSA), with FALCON (FN-DSA) as a backup in progress.
- Governments set migration timelines (US federal migration by 2035 and TLS 1.3 support by 2030); other jurisdictions (UK, EU, Japan, Canada, Australia) have similar 2030–2035 targets or intermediate deadlines.
- Recommended migration approach: (1) inventory cryptographic use, (2) prioritize migrating TLS/SSH key exchange functionality (mitigates HNDL), and (3) migrate remaining uses and keys.
- PQC support is defined as using NIST standards (via negotiation or hybrid cryptography); hybrid deployments (PQC + classical) are common to retain safety while standards mature.
- Wiz provides a PQC security framework and ACDI/CBOM capabilities—detecting TLS termination, key management issues, secret scanning, host configuration auditing, and a free pqc-tester (wiz.io/pqc-tester).
MITRE Techniques
Indicators of Compromise
- [Domain ] examples referenced in context of testing and scans – wiz.io/pqc-tester, cloudflare.com (Cloudflare top-1M list)
- [File/Software ] software versions and distributions relevant to PQC readiness – OpenSSH 10.0 (mlkem768x25519-sha256 default), OpenSSH 9.0 (sntrup761x25519-sha512 default)
Read more: https://www.wiz.io/blog/preparing-for-post-quantum-cryptography