"Harvest Now, Decrypt Later” - Addressing Quantum-Safe Crypto...
Evaluates harvest Now, Decrypt Later” - Addressing Quantum-Safe Crypto and evaluates key implications for security practitioners.
Summary
Overview: Post-quantum cryptography is being deployed to defeat a computer that doesn't exist yet - and the rush is opening a wide, purely classical attack surface today. This talk walks three implementation attack vectors against NIST's lattice standards (ML-KEM / FIPS 203, ML-DSA / FIPS 204): (1) memory corruption at the deserialization boundary, culminating in remote code execution through a hybrid TLS 1.3 key exchange; (2) compiler-induced timing side channels, where "constant-time" source becomes var
Key Topics: iable-time binary and yields a chosen-ciphertext key-recovery oracle; and (3) fault injection against ML-DSA's signing state machine on a low-cost ChipWhisperer. No quantum computer is required for any of them. The talk closes with the limits of hybrid cryptography as a defense and the live release of LatticeScope, an open-source timing-leak detector and lattice-aware fuzzer for auditing compiled PQC binaries.
Related talks
Microsoft Security Response Center (MSRC)·52 min
Engineers explore architecture and security mechanisms for BlueHat v18 || Record Now, Decrypt Later - Future Quantum Computers Are a Present Threat.
Videos·44 min
Presenters detail vulnerability discovery and exploitation in Addressing privacy: GDPR, Cloud, and You by Chris Esquire.
RSAC Cybersecurity·58 min
Presenters detail vulnerability discovery and exploitation in Webcast: Addressing the Challenges of Privacy in IoT.