Risks of Failing to Prepare for Post-Quantum Cryptography
Hi !
The emergence of quantum computers capable of breaking certain cryptographic mechanisms currently in use represents a significant challenge for organizations. Although such systems are not yet widely available, governments, standards bodies, and industry leaders increasingly view the transition to Post-Quantum Cryptography (PQC) as a strategic necessity. Organizations that fail to prepare now face growing risks related to confidentiality, integrity, regulatory compliance, and business continuity.
This is why conducting an inventory of assets that use any form of cryptography is one of the most important first steps in preparing for the transition to post-quantum cryptography.
For most organizations, the greatest challenge of a PQC migration is not replacing cryptographic algorithms themselves, but identifying all the places where cryptography is used. Cryptography is often pervasive across IT environments while remaining poorly documented.
- Identify Assets Vulnerable to Quantum Attacks Several widely used asymmetric cryptographic algorithms are expected to become vulnerable to sufficiently powerful quantum computers, including:
- RSA
- ECDSA
- ECDH
- Diffie-Hellman
Without an inventory, an organization cannot determine:
- Which systems rely on these algorithms;
- Which sensitive data they protect;
- What dependencies exist on third-party suppliers and services.
- Prioritize Risks
Not all systems have the same level of criticality.
For example:
| Asset ! Sensitivity | PQC Priority | |
|---|---|---|
| Public website | Low | Medium |
| Corporate VPN High | Very High | |
| PKI infrastructure | Critical | Critical |
| HR applications | High | High |
| Archives containing personal information | Very High | Critical |
A thorough inventory makes it possible to develop a realistic and risk-based migration roadmap.
- Identify Exposure to the “Harvest Now, Decrypt Later” (HNDL) Threat
Certain information must remain confidential for many years, including:
- Personal information
- Medical records
- Intellectual property
- Research data
If the required confidentiality period extends beyond five, ten, or even twenty years, these assets may already be at risk. Organizations should therefore identify the cryptographic mechanisms protecting such information and prioritize their modernization efforts.
- Assess Crypto-Agility
An inventory also helps answer critical questions such as:
- Can the cryptographic algorithms be changed through configuration?
- Are they hard-coded into the application?
- Does the product already support post-quantum algorithms?
- Will an upgrade be sufficient, or will the product need replacement?
- Two applications that both use RSA may require dramatically different levels of effort to migrate.
A PQC inventory should extend far beyond TLS certificates and cover all major uses of cryptography. This approach provides the visibility necessary to assess migration complexity and prioritize remediation efforts.
Conclusion
A comprehensive inventory of all assets using cryptography is arguably the single most important action an organization can take to begin its post-quantum readiness journey. Organizations cannot protect, migrate, or modernize what they do not know exists. The objective is not simply to identify systems and devices, but also to understand the algorithms in use, the data being protected, the required confidentiality period, and each system’s ability to evolve toward post-quantum standards. This visibility forms the foundation of a realistic and effective PQC migration strategy.
Cheers.