{"id":17409,"date":"2023-11-13T16:32:38","date_gmt":"2023-11-13T21:32:38","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=17409"},"modified":"2025-03-21T14:07:07","modified_gmt":"2025-03-21T18:07:07","slug":"key-takeaways-from-the-second-pki-consortium-post-quantum-cryptography-conference","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/key-takeaways-from-the-second-pki-consortium-post-quantum-cryptography-conference\/","title":{"rendered":"Key Takeaways from the Second PKI Consortium Post-Quantum Cryptography Conference"},"content":{"rendered":"\n

From how specific cryptographic algorithms work to how countries are working to face down looming quantum threats, the November 2023 conference covered many topics. We\u2019ve got 9 key insights and takeaways to share…<\/h2>\n\n\n\n

In early November, public and private cybersecurity and cryptography experts worldwide gathered in Amsterdam to share their insights and updates about quantum-resistant (quantum-safe) cryptography at the PKI Consortium<\/a>\u2019s latest conference. Some presentations focused on the technical details of PQC cryptographic algorithms and schemes, while others talked about the considerations surrounding the implementation of quantum-safe cryptography in specific environments.<\/p>\n\n\n\n

The PKI Consortium is a non-profit organization comprising 100+ public and private member organizations (governments, certificate authorities, auditors, service providers, consultants, etc.) from around the world. This event marked the PKI Consortium\u2019s second PQC conference, the first<\/a> of which was hosted in Ottawa in Ontario, Canada.  <\/p>\n\n\n\n

Since we figured most of our readers didn\u2019t get to make the trip to the Netherlands or want to get up as early as 3 a.m. to tune in remotely, we\u2019ve put together a breakdown of some of the key takeaways and lessons we learned from this year\u2019s sessions.<\/p>\n\n\n\n

Let\u2019s hash it out.<\/span><\/p>\n\n\n\n

What we’re hashing out…<\/p>

<\/polyline><\/svg><\/div>
  1. From how specific cryptographic algorithms work to how countries are working to face down looming quantum threats, the November 2023 conference covered many topics. We\u2019ve got 9 key insights and takeaways to share…<\/a>
      <\/ol><\/li>
    1. An Overview of the Top Concerns Haunting Organizations Regarding PQC Implementation<\/a>
        <\/ol><\/li>
      1. Top 9 Takeaways For Public and Private Sector Stakeholders<\/a>
        1. 1. We Need to Stop Calling It \u201cPost-Quantum\u201d Cryptography<\/a>
            <\/ol><\/li>
          1. 2. Quantum Computing Is Something to Start Planning & Preparing For Now Using Hybrid Cryptography<\/a>
              <\/ol><\/li>
            1. 3. A Cryptographic Inventory and Risk Analysis Are the First Steps to PQC Readiness & Agility<\/a>
              1. Where Does PKI Come Into Play in All of This?<\/a>
                  <\/ol><\/li><\/ol><\/li>
                1. 4. NIST\u2019s First PQC Standards Are Coming in Early 2024<\/a>
                    <\/ol><\/li>
                  1. 5. Being Crypto-Agile Is Crucial and Is Everyone\u2019s Responsibility<\/a>
                      <\/ol><\/li>
                    1. 6. By and Large, CISOs Won\u2019t Adopt PQC Until They Have To <\/a>
                        <\/ol><\/li>
                      1. 7. Take a Stealth Approach to Get Funding and Support of Your PQC Initiatives<\/a>
                          <\/ol><\/li>
                        1. 8. Businesses Want Financial Incentives to Become Early Adopters<\/a>
                            <\/ol><\/li>
                          1. 9. PQC Progress Requires Significant Collaboration Between Global Regions and Industries<\/a>
                              <\/ol><\/li><\/ol><\/li>
                            1. Final Thoughts on the Insights Shared at the PKIC PQC Forum<\/a>
                                <\/ol><\/li><\/ol><\/div>\n\n\n<\/span><\/span>\n\n\n

                                An Overview of the Top Concerns Haunting Organizations Regarding PQC Implementation<\/h2>\n\n\n\n

                                Before we dive into all of the top takeaways from this year\u2019s conference, let\u2019s quickly go over some of the key challenges that industry experts say organizations face when preparing for post-quantum cryptography.<\/p>\n\n\n\n

                                Of course, this is only a handful of the challenges that public and private sector organizations may experience in the journey to a post-quantum world. Now, it\u2019s time to explore some of the takeaways global industry leaders shared during the 2023 PQC conference.<\/p>\n\n\n\n

                                Top 9 Takeaways For Public and Private Sector Stakeholders<\/h2>\n\n\n\n

                                1. We Need to Stop Calling It \u201cPost-Quantum\u201d Cryptography<\/h3>\n\n\n\n

                                Using a term like \u201cpost-quantum cryptography\u201d doesn\u2019t drive home the urgency of transitioning from quantum-insecure to quantum-resistant cryptography. The actual verbiage is still contested within the industry, though, as some experts refer to it as PQC<\/em> while others call it \u201cquantum-resistant\u201d or \u201cquantum-safe\u201d cryptography.<\/p>\n\n\n\n

                                Chris Hickman, Chief Security Officer at KeyFactor<\/a> who presented and participated in one of the conference\u2019s panel discussions, described the term \u201cpost-quantum\u201d cryptography as the biggest disservice industry professionals did to themselves.<\/p>\n\n\n\n

                                \u201cThis is an evolution of security, and we really need to start thinking of it in those terms,\u201d said Hickman, who said that organizations need to start thinking through the security needs regarding these vastly different technologies now and not when quantum computers are widely available. He pointed out that the industry has been relying on the same technologies for several decades and that enough is enough. \u201cWhat else has lasted for 40 years in IT, period? Not a lot. Security-wise, not a lot.\u201d<\/p>\n\n\n\n

                                \n

                                \u201cSo, I think, yeah, things are going to take on their own life cycle and their own trajectory because organizations are going to start to realize that this is simply an evolution. This is the next step.<\/em><\/p>\n\n\n\n

                                No, we\u2019ve never been through this; yes, it\u2019s going to be painful. Are we going to stumble along the way? Organizations will stumble along the way, that\u2019s without question. But the thing that we can do here is help explain the best ways to do that, the ways to mitigate the risk, how to look at it from risk management standpoint. I think that\u2019s a very smart way to look at it.\u201d <\/em><\/p>\n\u2014 Chris Hickman, Chief Security Officer at KeyFactor<\/strong><\/cite><\/blockquote>\n\n\n\n

                                Hickman\u2019s sentiments are shared by other industry experts, including Tim Hollebeek, DigiCert<\/a>\u2019s Industry Technical Strategist. He recommends<\/a> referring to it as \u201cquantum-safe cryptography\u201d instead.<\/p>\n\n\n\n

                                \n

                                \u201cThe problem with the term post-quantum cryptography is that it is easy to misunderstand as something you don\u2019t need to do until cryptographically relevant quantum computers (CRQCs) arrive, which that\u2019s the exact opposite of true.\u201d <\/em><\/p>\n\u2014 Tim Hollebeek, Industry Technical Strategist at <\/strong>DigiCert<\/strong><\/a><\/cite><\/blockquote>\n\n\n\n

                                2. Quantum Computing Is Something to Start Planning & Preparing For Now Using Hybrid Cryptography<\/h3>\n\n\n\n

                                A theme that was repeated throughout the two-day conference is that you can (and should) start planning and preparing for PQC rather than waiting. If you wait, you\u2019ll already be too late. While saying companies should start planning and preparing is all well and good, but it leaves us with two important questions:<\/p>\n\n\n\n

                                  \n
                                1. How do we start preparing?<\/li>\n\n\n\n
                                2. And how soon do we need to do so?<\/li>\n<\/ol>\n\n\n\n

                                  One of the things highlighted by many speakers was having a hybrid quantum security strategy. The benefit of using PQC hybrid algorithms in your approach is that they still support the \u201cclassical\u201d algorithms that are necessary to fight modern threats while also using PQC algorithms to protect data against \u201charvest now, decrypt later\u201d attacks.<\/p>\n\n\n\n

                                  This means bad guys would have to break two cryptosystems in order to compromise data. This protects you while in the transition period when we\u2019re not sure about whether the new PQC algorithms will work as intended. (After all, we\u2019ve seen a number of NIST candidate algorithms being broken over the past several years using modern computers.)<\/p>\n\n\n\n

                                  We\u2019ll talk more about the answer to the first question in just a moment. But as far as the answer to question #2 is concerned: start planning now. Quantum computers are becoming more advanced, and companies are working on \u201cnoise reduction\u201d to help facilitate more powerful machines that require fewer qubits to operate. So, what does this mean for organizations with regard to when they need to start getting their ducks in a row?<\/p>\n\n\n\n

                                  \n

                                  “The main thing is, don\u2019t wait. Well, we do<\/strong> want you to wait for the final standards. So, you can test out the algorithms now. You can get ready. Wait for the final standards to begin actually putting these into products. But for planning purposes, don\u2019t wait to think about your migration \u2013 start getting ready for that.\u201d <\/em><\/p>\n\u2013 Dustin Moody, Mathematician & Project Lead, Post-Quantum Cryptography at the <\/strong>National Institute of Standard and Technology (NIST)<\/strong><\/a><\/cite><\/blockquote>\n\n\n\n

                                  3. A Cryptographic Inventory and Risk Analysis Are the First Steps to PQC Readiness & Agility<\/h3>\n\n\n\n

                                  By and large, organizations are clueless about where and how they\u2019re using cryptography within their networks and IT infrastructure. In some cases, the uses are internal; other times, they\u2019re provided through third-party services and software.<\/p>\n\n\n\n

                                  But the key thing to remember is that if you don\u2019t know what cryptographic assets you have or where they are, then you can\u2019t identify your risks, and if you can\u2019t do that, then you don\u2019t know what you need to mitigate them.<\/p>\n\n\n\n