Step Zero -Identifying Quantum Attack Surface in Critical Infrastructure

The talk opens with the case for post-quantum readiness in critical infrastructure. The speakers argue that the main obstacle is not the math or the standards but finding where RSA and ECC sit inside banking APIs, certificate hierarchies, SWIFT authentication, vendor software, and legacy hardware. They cite a study of about 32,000 TLS handshakes where traffic-layer migration looked partial while identity-layer adoption showed none. They also stress that harvest-now, decrypt-later and harvest-now, forge-later collection is already happening, so the exposure exists before any cryptographically relevant quantum computer does.

The middle section introduces the Cryptographic Bill of Materials, a structured, JSON-based extension of the SBOM model that records algorithms, key sizes, roles, and the relationships between components. The speakers describe a maturity path from a flat algorithm list toward interoperable, machine-processable inventories. Discovery approaches are compared: network traffic capture, source and build analysis, and binary analysis. A live demo ran an open-source CBOM generator against an IoT firmware image. The output flagged an Ed25519 key used for package signing and an MD5 hash applied to a password file, and it noted a private key that is only generated at boot, which the tool cannot see.

The closing section covers prioritization. Assets are weighed by data shelf life, whether they protect confidentiality or signatures, system criticality, replaceability, and vendor maturity. The speakers recommend discovering, ranking, and swapping cryptography in a repeating loop, aiming first for crypto-agility so changes can happen quickly later. Their takeaway is that organizations should answer where their cryptography lives with evidence from inventories, not assumptions.