Maria Konner
2 min readDec 28, 2023

--

The standard goto source for crypto algorithm/strength standards is NIST. Most modern crypto is good until at least 2030 or so, and there is no NIST requirement for quantum or quantum agility (ability to add algorithms/technologies without changing out protocols).

Of course, there could be an accelerated breakthrough that changes this schedule. Also one needs to take into account the lead time to adapt new technologies, but NIST typically gives plenty of time for that - e.g. 2+ years.

So the remaining issue is whether NIST is good enough for your risks. For most companies if you follow NIST guidelines you can't readily be sued, and customers will generally adapt your implemention and not blame you for unusual events like a novel bug in a well used algorithm/strength. So caring about quantum from a business point of view above and beyond NIST depends on whether you have anything specific about your use case that requires it. For example, it's well known that today's encryption becomes obsolete eventually, so you should never assume ANY data is secure forever. There are many measures in place such as rotation of passwords/secrets used for access or signatures, assuming any IP secrets have a shelf life and there will be ample warning to change out the encryption per NIST + other guidelines, etc.

As a cybersecurity professional I don't pay attention to anything like this seriously unless NIST puts it on their radar and brings it to our attention. But I don't work for a security company (not anymore - it's a terrible industry to work in). If you're selling security products, you want to be ahead of the curve on that.

--

--

Maria Konner
Maria Konner

No responses yet