Post-quantum cryptography begins to enter corporate roadmaps
Although quantum computers capable of breaking current systems are not yet a general operational reality, migrating cryptography can take years.
News summary
Quantum computing continues to advance and, with it, interest in post-quantum cryptography grows. The risk is not that all current encryption will stop working tomorrow, but rather that large organisations need time to identify where they use cryptography and replace it in an orderly manner.
The first step is so-called crypto-agility: knowing which algorithms, certificates, and protocols depend on systems that might require a future transition. In a modern company, cryptography appears in web connections, VPN, devices, applications, digital signatures, backups, and third-party services.
There is also the scenario known as “harvest now, decrypt later”. An attacker could store encrypted information today in the hope of being able to read it in the future. This is particularly relevant for data that must remain confidential for many years.
For most SMEs, the priority is not to immediately replace their entire infrastructure. It is more reasonable to keep systems updated, avoid obsolete cryptographic technologies, and ask critical providers for information regarding their future compatibility plans.
The challenge will be especially significant for equipment with long lifecycles, such as industrial devices or embedded systems. If a product is to remain operational for a decade, it is advisable to consider from now on how its cryptographic components will be updated.
Preparing in time allows a potential urgent change to be turned into a planned evolution.
A simple action consists of asking strategic providers which standards and algorithms they use and whether their products support cryptographic updates. Recording these responses creates an initial map of dependencies. It is not necessary to know all the mathematical details to start managing the transition risk.
What is entering corporate roadmaps
Quantum computing keeps advancing, and with it interest in post-quantum cryptography is growing. The risk is not that today's encryption will stop working overnight, but that large organisations need time to identify where they use cryptography and replace it in an orderly way.
The first step is so-called crypto-agility: knowing which algorithms, certificates and protocols depend on systems that may need a future transition. In a modern business, cryptography appears in web connections, VPNs, devices, applications, digital signatures, backups and third-party services.
Why it isn't only a future problem
There is a scenario known as “harvest now, decrypt later”: an attacker could store encrypted information today hoping to read it in the future. This matters most for data that needs to remain confidential for many years.
The challenge will be especially significant for equipment with long lifecycles, such as industrial devices or embedded systems: if a product will remain in service for a decade, it is worth thinking now about how its cryptographic components will be updated.
What to review
Most SMEs do not need to replace their entire infrastructure at once:
- Keep systems updated and avoid obsolete cryptographic technologies.
- Ask critical vendors which standards they use and whether they plan post-quantum compatibility.
- Identify which data needs to remain confidential for many years.
- Record vendor responses to build an initial picture of dependencies.
Frequently Asked Questions
- Should I change my encryption systems now?
- For most SMEs it isn't urgent; the priority is keeping systems updated and asking critical vendors about their future compatibility plans.
- What does harvest now, decrypt later mean?
- It is the practice of storing encrypted information today with the intention of trying to decrypt it in the future using more advanced computing power.
- What is crypto-agility?
- It is the ability to know which cryptographic algorithms and protocols an organisation uses, so they can be replaced in an orderly way when needed.
Concepts mentioned in this article: Backup
Seintec can help you inventory cryptographic dependencies and include post-quantum readiness within your technology strategy without making premature investments. Contact us if you want to understand which parts of your business should start preparing.
Contact SeintecRelated service
Cybersecurity
We shield your business so it never stops.