How to Prepare Systems for Post-Quantum Cryptography

Summary

The article explains quantum-related encryption risks, NIST’s post-quantum standards, and steps for preparing systems. It recommends inventorying vulnerable cryptography and prioritizing TLS and SSH key exchanges to reduce harvest-now, decrypt-later exposure.

Key points

The article says no quantum computer currently exists that can break encryption, but future capability and harvest-now, decrypt-later attacks make preparation worthwhile.
NIST published three post-quantum cryptography standards in August 2024: ML-KEM, ML-DSA, and SLH-DSA; FN-DSA is described as in progress.
The suggested migration sequence is to inventory cryptography, migrate TLS and SSH key exchanges, then address other cryptographic uses.
The article distinguishes key exchange from authentication: upgrading key exchange can protect captured traffic, while replacing authentication keys is a separate migration task.
In a scan of the top one million domains, the author reports that 84% supported TLS 1.3 and 45% supported post-quantum key exchanges.
Wiz describes inventory and detection capabilities for cloud cryptography, public-facing services, secrets, and host configurations; code scanning and software lifecycle tracking are listed as coming soon.

Article Details

Topic: Preparing for post-quantum cryptography migration, including quantum-related risks, NIST standards, inventory practices, and Wiz's PQC readiness capabilities.

Vendors

WizThis post will discuss what the risks are, what you can do to prepare for post-quantum cryptography, and what Wiz is doing.

Products

OpenSSHLet’s take a server with OpenSSH running as an example. Imagine you installed OpenSSH a few years ago and a dozen people created RSA key pairs for their authentication to it (let’s ignore that there are probably better Wiz for Post-Quantum Cryptography Security FrameworkIn order to help Wiz customers create an inventory for PQC migration, we’ve created the “Wiz for Post-Quantum Cryptography Security Framework” where we have added detections for relevant encryption.

Countries

Australiaby 2028, with full transition by 2035. Japan and Canada are also seeking full transition by 2035, while Australia is seeking to complete transition by 2030. The European Union is targeting that critical infrastructure Canadainventories and a migration plan must be completed by 2028, with full transition by 2035. Japan and Canada are also seeking full transition by 2035, while Australia is seeking to complete transition by 2030. The JapanNCSC has stated inventories and a migration plan must be completed by 2028, with full transition by 2035. Japan and Canada are also seeking full transition by 2035, while Australia is seeking to complete transition by