DigiCert Event Presses Enterprises to Start Post-Quantum Migration Now

“Prioritize the migration to quantum safety,” DigiCert CEO Amit Sinha said in an interview with theCUBE. “PKI modernization is long overdue. If you don’t start today, you’re already out of time.” Public key infrastructure provides the framework for creating, managing and revoking digital certificates that establish trust across digital networks, and advances in quantum computing are increasing pressure to replace vulnerable public-key cryptography across systems.

Sinha described PKI modernization as a staged effort that needs visibility into where cryptography is used before migration can be planned. DigiCert’s Quantum Central is designed to help assess that risk, he said, while shorter certificate lifetimes add pressure to automate certificate management. “The road to crypto agility with the 47-day mandate is kind of the same road to post-quantum cryptography,” Sinha said. “Both of those deadlines are now 2029. So, having a good system in place, bringing public and private PKI together [and] having last-mile automation capabilities that give you crypto agility are foundational steps — both for the 47-day mandate that we have today and the migration to post-quantum cryptography.”

The migration will also have to accommodate different standards across jurisdictions. Many countries are adopting standards developed by the U.S. National Institute of Standards and Technology, while others are pursuing different approaches; China has launched a program to solicit and evaluate quantum-resistant cryptographic algorithms for possible standardization. Jostein Stokkan, product manager of service offerings at Atea Norge AS, told theCUBE that different standards will affect post-quantum cryptography, but that helping organizations become more crypto agile would make adaptation smoother. “If we can help organizations to become more crypto agile, to be able to adapt to different types of encryption as they become important or just change, I think everything will be smoother and easier for all parties,” he said.

LGT Financial Services AG began asking vendors for supported algorithms and compatibility constraints at least two years ago, according to Christian Pfister, team leader for IT security operations and lead for LGT’s Quantum Safe Competence Center. He told theCUBE that trying to inventory, replace and validate every cryptographic use case at once would make the program unmanageable and impossible to measure. “The [post-quantum cryptography] migration is not one project and one algorithm change; it’s a series of migration waves,” Pfister said.

A DigiCert survey cited at the event found that 87% of surveyed organizations were planning, testing or implementing post-quantum cryptography initiatives, while only 7% had deployed quantum-safe or hybrid cryptography across most of their digital certificates. The gap between planning and deployment leaves organizations asking how to proceed. “There is no one-size-fits-all; there is no template,” said Naomi Wynn, chief executive officer of National Energy Public Key Infrastructure, or NEPKI. “But I’m hoping that by this time next year … we are seeing improved guidance as well in terms of what expectations are, what is good enough [and] what will actually meet the requirements.”

Organizations are also testing how post-quantum cryptography performs in existing environments. Daiwa Institute of Research Ltd. conducted a proof of concept for Daiwa Securities Group that used a post-quantum-enabled load balancer to assess Transport Layer Security performance. Sadaaki Yamazaki, senior security specialist for the Digital Solution R&D Department at Daiwa Institute of Research, said the average TLS handshake time increased by approximately 1.2 milliseconds in the measurements.