The new post-quantum cryptography executive order. Plus: What is Q-Day, really?
This episode delves into Q-Day, the anticipated future when quantum computers can break public key cryptography, and the U.S. Executive Order accelerating the transition to post-quantum cryptography. Experts discuss why Q-Day is a gradual process rather than a sudden event, the critical importance of "crypto-agility" as a long-term strategy, and the necessity for organizations to begin immediate discovery and planning to secure data against "collect now, decrypt later" threats. The discussion also touches upon the broader, transformative benefits of quantum computing beyond just security.
The discussion centers on the impending Q-Day, defined as the moment quantum computing capabilities become powerful enough to break existing public key cryptography, which secures everything from websites to financial transactions. The consensus is that Q-Day is not a singular event like Y2K, but rather a gradual, pervasive process unfolding in waves. This “collect now, decrypt later” threat, where adversaries harvest encrypted data today to decrypt it with future quantum computers, is already a significant risk.
A recent U.S. Executive Order, “Securing the Nation Against Advanced Cryptographic Attack,” mandates a government-wide acceleration of the transition to post-quantum cryptography (PQC). Key aspects include:
- Leadership and Guidance: The Office of Management and Budget (OMB) and National Cyber Director will lead the strategy, with technical guidance from NIST, NSA, and CISA.
- Accountability: Agencies must appoint a lead for PQC migration efforts.
- Accelerated Timeline: The target for quantum safety is moved up to late 2030/early 2031 from the previous 2035.
- Broader Impact: Federal contractors will be required to comply through updated acquisition regulations.
- Key Stakeholders: The order emphasizes working with international partners to adopt similar standards (ideally NIST standards for interoperability) and engaging critical infrastructure operators (water, power, financial, IT, telecom, healthcare) due to the long lifespan of their sensitive data.
Organizations are urged to take immediate action, recognizing that encryption transitions historically take many years. IBM advises governments to follow a three-phase approach:
- Plan: Develop roadmaps, assess readiness, integrate PQC into national cybersecurity strategies, and prioritize data based on sensitivity and lifetime.
- Act: Initiate tangible actions, including pilots (e.g., by 2027) and setting clear migration deadlines.
- Motivate: Educate all organizations, including critical infrastructure and private entities, on necessary actions and available resources.
The advent of quantum computing, alongside advancements in AI, presents a “tsunami of stuff” for cybersecurity professionals. While foundational cybersecurity principles remain, the pace of change demands faster adaptation. A critical first step is discovery: understanding what cryptographic artifacts exist across an organization’s hardware, software, and third-party vendor ecosystems. This includes creating a cryptographic Bill of Materials (CBOM). The complex supply chain of modern software means even if an organization secures its own systems, vulnerabilities can exist within its vendors’ implementations.
The long-term goal is not just to implement PQC, but to achieve crypto-agility. PQC algorithms, developed through collaborative efforts and NIST competitions (with IBM as a key contributor), are more complex and not a one-to-one replacement for current encryption. Crypto-agility is defined as “the ability to change your cryptography as easily as a software upgrade.” This requires a fundamental transformation in operational approach, including:
- Designing architecture with future cryptographic changes in mind.
- Enhancing visibility into cryptographic deployments.
- Decoupling cryptography from applications.
- Automating certificate and key life cycles.
- Establishing robust governance for systematic changes.
Beyond the security risks, quantum computing offers immense benefits. It promises unprecedented capabilities for complex algorithmic tasks in finance, and revolutionizing natural sciences, particularly in healthcare (e.g., drug discovery, personalized medicine, protein folding). While AI often captures headlines, quantum computing is making quiet, significant leaps with broad applications that extend far beyond security.
To get started, organizations should:
- Initiate high-level conversations to acknowledge the transformational nature of this challenge.
- Deploy tools for cryptographic discovery to build a comprehensive cryptographic Bill of Materials.
- Develop a strategy and explore mitigation options. As emphasized: “Enterprises that are going to win are not the one that’s move fast. That’s the one that start early.”