Post-quantum migration gets harder when every user holds a key

Post-quantum migration gets harder when every user holds a key In this Help Net Security interview, Christopher Smith, CEO of Quantus, discusses what cryptographic inventories turn up in banks and hospitals, including default passwords and admin keys still held by former employees. He explains where post-quantum key sizes break old size assumptions in IPsec, SSH, TLS and libp2p, why migrating user keys makes blockchains hard to upgrade, and what a silent quantum break would look like from outside. He also gives the argument for funding work whose payoff stays invisible. When your team walks into a bank or a hospital and asks them to inventory every place cryptography lives in their estate, what turns up that nobody knew was there? Give me the strangest thing you have found. Usually we find that security teams know where the bodies are buried in their own backyard, so to speak. The most common “AHA” is a default password nobody knew was there, or a hidden admin key that is sometimes still held by a former employee. Another example is password hashes sitting on user devices. On one asset-recovery job, we got into a client’s late father’s password manager by extracting the password hash from the laptop’s cache and running a custom cracker against it. The new algorithms bring larger keys and signatures. Where has that extra size broken something engineered decades ago, a packet size, a memory ceiling, a chip that had exactly enough room and no more? Many systems impose max-message-sizes that are not strictly part of the protocol as a sanity check or a bound on resource consumption. It varies from system to system, but IPsec, SSH, TLS can carry small-size assumptions and sometimes don’t have friendly error messages when these assumptions are violated. Libp2p, a widely used peer-to-peer networking library, had several such assumptions that had to be updated when we moved it to post-quantum primitives. Cryptographic agility gets used as the destination. What does it cost to build, and has any organization you have worked with reached it, or is everyone still one algorithm deep? Well, it really depends. In essence, it’s one abstraction layer, but to cover everything, it sometimes has to be inserted in many places, and this might cross product or organizational boundaries, which naturally adds friction. With AI-assisted coding, the technical hurdle is smaller than it was, but blockchains remain among the hardest systems to update. Most blockchains have some form of account abstraction that makes the technical part of the upgrade easier, but migrating user keys is much harder, because it requires every user to act. If a government lab or a private team reached a break and said nothing, what would the first observable signal be, and would anyone in your industry recognize it as such? Has a claimed sighting ever crossed your desk? We haven’t seen anything like that. Unfortunately, if someone cracks your keys remotely, you don’t get a memo explaining how they did it. A recent hardware wallet compromise is a useful example. The attack was widespread and a forensics team found a weak RNG, which explained it, but if that evidence hadn’t turned up, a math-level break would only be evident via the absence of any other explanations, which is not conclusive. The typical modern software stack is many layers deep and there’s always a chance the attacker found something defenders and forensic teams missed. If you have the capacity, it’s sometimes worth rewriting critical parts of your system to have zero dependencies to avoid some of these attack vectors. The secret development of a cryptographically relevant quantum computer would be a similar case. Attackers don’t have to make contact with the victim or the victim’s devices. They can work from data available on public services. If a quantum attacker hit many keys across many systems and vendors all at once, it might raise suspicions that it was a math-break. But unfortunately we won’t be certain it is possible until someone publicly breaks a key, and we won’t be certain it is impossible until mathematics advances to the point where we have full security proofs of our cryptosystems (proving P != NP, for instance). Give me the argument that has worked in a real board meeting for funding something whose payoff is invisible if everything goes right. It’s like pricing insurance: it comes down to quantifying the downside of not migrating and the cost of migration. Capital allocators are used to the concept of risk management, and cryptographic failure is quantifiable, although many decision makers haven’t thought very deeply about what the numbers are. One venture firm re-evaluated its entire portfolio after realizing how hard the blockchain migration problem is. They had evaluated the quantum threat previously but hadn’t considered how long it could take for user keys to migrate, given the constraints of some popular systems. If you wait for someone else to lose money to quantum, it will be too late. You need to run faster than the bear, not just faster than your friends. Download report: How security controls perform in practice