This episode discusses the threat quantum computers pose to public key cryptography, the urgent timeline for migrating to post-quantum algorithms, and practical steps software engineers can take now. Key highlights include the compression of Q-Day estimates to 2029 or earlier, the difference between key agreement and authentication, and the performance trade-offs of larger post-quantum signatures.
Summarized by Podsumo
Q-Day timeline has compressed dramatically: recent research from Google and startup Ortomic shows a 20x reduction in required physical qubits to break elliptic curves (from 200M to 10,000), making 2029 or earlier plausible.
Post-quantum cryptography is already deployed for key agreement (protecting against 'harvest now, decrypt later') in modern browsers, but authentication (certificates) remains vulnerable and harder to upgrade.
Post-quantum signatures are much larger than current ones (2.5 KB vs 64 bytes for elliptic curves), causing performance issues for small connections like IoT devices and requiring protocol redesign.
The 'hard cases' – such as embedded devices, cars, and old software – require top-down risk analysis rather than bottom-up key inventory.
Low-effort steps engineers can take now: update libraries, enable certificate automation, and run a business impact simulation assuming Q-Day has already arrived.
"Half of the connections transfer three-quarters of that would just be certificates instead of data."
"We cannot exclude the possibility that we see one in 2030 already. 2029, even with maybe one percent chance."
"It's not about reaching every corner; it's about starting early."