Archive
Are you ready for the Quantum Apocalypse?
No, the world is not coming to an end (at least not right away) but secure communications is going to get a lot harder soon! If you still think your data is encrypted and you are safe, think again. That means all of your mobile/desktop banking, social media, it all relies on SSL (Transport Layer Security) and it is ALL vulnerable. So after 30+ years, why is everything changing?
Traditional encryption (like RSA and Elliptic Curve Cryptography) relies on math problems that standard computers take millions of years to solve whereas future quantum computers will be able to crack these math problems in minutes, threatening banking, government secrets, and personal data.
Unlike today’s cryptographic math, which relies on number-theory problems like factoring large numbers or computing discrete logarithms that quantum computers can easily unravel using Shor’s algorithm, Post-Quantum Cryptography (PQC) shifts to geometric and complex algebraic structures that lack any known quantum shortcut.
Specifically, lattice-based cryptography hides data within massive, multi-dimensional geometric grids where finding the closest point is computationally intractable; code-based cryptography treats decryption like correcting intentionally corrupted messages using complex error-correcting codes; multivariate polynomial cryptography secures information behind chaotic systems of interlocking, non-linear equations; and hash-based cryptography avoids structural algebra entirely, relying instead on the raw, one-way security of digital fingerprints stacked into tree structures.
Together, these methods are fundamentally different because they present brick-wall geometric and structural puzzles that quantum computers cannot simply bypass with a mathematical trick. This is why we must change everything to use one of the ‘new math’. Unfortunately, we have lived in a bubble since the early days of PC computing (yeah, I was there in the days of the floppy disk ;-)). Figuring out which math to use in which circumstance is what I like to refer to as, The Quantum Apocalyse.
To tackle such a gigantic problem, most of the guidance today has us beginning with Inventory; You can’t fix what you can’t see! To help with this challenge, I have released a GitHub action called “jsi-bom-actions” that uses open source tooling along with some python scripts to search your codebase every time to make a commit. All you have to do is add a workflow to any repo and you can see a report that contains the following sections for your review;
We start the assessment with a list of the crypto assets that were identified by the scanning tools. In this example, we have already begun to support post quantum algorithms (yeah!) but you can also see that there is so much more to do.
The next section shows us where the assets are. Some of these are in code you (or your staff) have written so you can definitely change first party code yourself.
Others are the third party code (Open Source) that your project relies on and you must wait for the maintainer of that code to fix it for you (or you search for or even write your own). This section attempted to find OCI crypto bill of materials that were published by the third party component creator (or the repo) but none were found.
[I added this part in anticipation of more registries and software makers to support these in the future. If the binary is used, the creator must publish its own Crypto Bill of Materials as an OCI soon!]
If you are wondering what you should focus on now or plan to replace in the future, I also include a recommended list of what you should prioritize.
You can add my project by following the steps outlined (here). If you have a GitHub project that involves RSA or Elliptic Curve cryptography (that probably means YOU), then you must start to migrate to a world with the new math. Ask your kids, they are probably already learning about it! 🙂
