Quantum Computing and AppSec: Preparing for the Post-Quantum Threat

This introductory talk explains quantum computing for application security practitioners. The speaker, who has a science background, outlines how qubits differ from classical bits and why superposition and entanglement matter, without going deep into the physics. The talk then reviews encryption, separating symmetric from asymmetric schemes and showing how TLS uses both during a connection setup.

The central argument is that algorithms such as RSA and elliptic curve cryptography depend on problems a large quantum computer could solve, while Grover's search would weaken symmetric ciphers and hashes, making larger key sizes a partial remedy. Harvest-now, decrypt-later collection of sensitive traffic is presented as a current confidentiality risk, and the speaker stresses that timeline estimates keep shifting. The post-quantum section surveys NIST's standardization effort and the main algorithm families, including lattice-based, code-based, multivariate and hash-based schemes.

The closing section turns to practice. Organizations are advised to build a cryptographic inventory, assess which systems hold long-lived sensitive data, and design for crypto agility so algorithms can be swapped with less rework. Hybrid classical plus post-quantum deployment is suggested as a transition path. Challenges raised include larger keys, performance, legacy systems and convincing product teams to act on a distant risk. Audience questions on adoption and trust in standards closed the session.