Quantum Ready or - Not - What 1,000 Codebases Reveal About Cryptographic Risk

The talk opens with the quantum threat to public-key cryptography. It covers how Shor's algorithm breaks factoring and discrete logarithms, how Grover's search weakens symmetric keys, and why "harvest now, decrypt later" and "trust now, forge later" matter today. Using Mosca's inequality, the speaker argues that data with long shelf lives makes migration urgent even while large quantum machines remain out of reach.

The research team scanned a set of popular open-source projects with static rules that built a cryptographic bill of materials. They counted only first-party code to avoid inflating results and filtered false positives. The transcript says the sample was cut from a planned 1,000 repositories to 100 because of cloud costs. About 85,000 cryptographic usages were found, roughly a third of them classical public-key. Post-quantum algorithms made up about 0.04 percent of usages, though around a fifth of repositories had started some placeholder work. Estimates of quantum-critical usage ranged from 35 to 44 percent, depending on whether regex rules or an LLM did the classification.

The main takeaway is that migration is a graph problem rather than a grep problem. Teams need to find where cryptography lives, map the data and systems it protects, prioritize, mitigate, and then re-measure. The speaker also warns that broken hashes such as MD5 and SHA-1 stayed in use for years after their weaknesses were known, so quantum-vulnerable code may follow the same pattern.