Harvest attackers won't wait for post quantum standards

The speaker, who works on secure shell and VPN encryption products, argues that quantum computers pose a near-term risk to public key cryptography. Attackers can record encrypted traffic today and decrypt it once capable machines exist, so the key exchange needs protection first, with signature algorithms following. The talk contends that quantum key distribution is impractical at internet scale, which makes post-quantum algorithms the realistic option because they run on existing protocols such as TLS, IPsec and SSH.

Timelines for migration have been shrinking, and the presenter pointed to recent government mandates and standardisation work. Because post-quantum algorithms are new and less scrutinised, the recommended approach is hybrid key exchange, which pairs a classical algorithm with a post-quantum one so that either can protect the session. Regions favour different algorithms, and authentication keys are much harder to make hybrid. Practical notes covered OpenSSH 9.0 support, the TLS 1.3 requirement for post-quantum key exchange, and the value of short-lived credentials.

The closing advice is to start with an inventory of which data must stay confidential for years, such as medical records, then plan for legacy TLS 1.2 systems and embedded devices that are hard to upgrade. Organisations should prepare an emergency migration plan and, where possible, enforce hybrid key exchange now. Audience questions covered data at rest versus data in transit, size constraints on small devices, and the CNSA 2.0 guidance.