A Contrarian’s View of Priorities in the PQC Transition (G13c)
The Store-Now-Decrypt-Later aspect of the post-quantum cryptography (PQC) migration problem has become a focal point due to concerns that attackers are already collecting encrypted secrets for future decryption. While this scenario poses significant risks for entities with sensitive information (e.g., governments and military organizations), the majority of individuals and businesses are more impacted by the risk of undermined digital trust provided by digital signatures. Digital signatures form the foundation of digital commerce and the global economy.
This talk emphasizes the urgency of addressing threats to digital trust and proposes the need to prioritize resources for developing and testing concrete solutions. It also highlights the varying lifespans of digital signatures, with some requiring only short-term validity (e.g., establishing identity during an interaction) and others needing to last for decades (e.g., firmware signatures for satellites or critical infrastructure). The talk concludes with recommendations for planning algorithm migration and deprecation timelines while considering the varying requirements of digital signatures.