TRANSKRIPT 🔗
WEBVTT
00:00:02.730 --> 00:00:05.730
Two months ago we told you post quantum crypto
00:00:05.730 --> 00:00:08.589
was coming that Cisco's August release and a
00:00:08.589 --> 00:00:10.849
wave of vendors would make the migration real
00:00:10.849 --> 00:00:14.269
So did it happen? Here's the number that answers
00:00:14.269 --> 00:00:17.730
it as of this spring More than two -thirds of
00:00:17.730 --> 00:00:20.410
human web traffic to cloudflare is already post
00:00:20.410 --> 00:00:24.269
quantum encrypted not planned not piloted Encrypted
00:00:24.269 --> 00:00:28.089
today by default the migration didn't just get
00:00:28.089 --> 00:00:31.449
real it became the default on the majority of
00:00:31.449 --> 00:00:34.899
the web This is tech updates. Here's how that
00:00:34.899 --> 00:00:37.500
happened so fast and it's almost invisible. Your
00:00:37.500 --> 00:00:40.820
browser did it for you. Chrome, Edge, and Firefox
00:00:40.820 --> 00:00:44.420
quietly switched their TLS handshakes to a hybrid
00:00:44.420 --> 00:00:48.039
key exchange. Classical crypto plus ML chem,
00:00:48.520 --> 00:00:51.200
the new post quantum standard starting in late
00:00:51.200 --> 00:00:54.460
2024. Every time you load a modern website over
00:00:54.460 --> 00:00:56.539
one of the big edge networks, you're already
00:00:56.539 --> 00:01:00.320
using it. A year ago, it was a minority of connections.
00:01:00.590 --> 00:01:04.090
Today, it's the majority. The most consequential
00:01:04.090 --> 00:01:06.409
crypto upgrade in decades shipped as a browser
00:01:06.409 --> 00:01:09.109
update most people never noticed. So did our
00:01:09.109 --> 00:01:13.629
June prediction hold? Mostly, yes. We said, Cisco
00:01:13.629 --> 00:01:17.810
would put post -quantum crypto into IOS XE. They
00:01:17.810 --> 00:01:20.629
did. Their switch software already ships full
00:01:20.629 --> 00:01:23.370
stack post quantum, secure boot, image signing,
00:01:23.909 --> 00:01:27.150
and IPsec VPN key exchange, all quantum safe.
00:01:27.790 --> 00:01:30.969
The August release extends it across the SD -WAN
00:01:30.969 --> 00:01:34.030
overlay and adds hardware acceleration, though
00:01:34.030 --> 00:01:37.129
those pieces are rolling out rather than confirmed
00:01:37.129 --> 00:01:40.109
live. And the quantum ready assessments we mentioned,
00:01:40.530 --> 00:01:43.010
the tool that scans your network for harvest
00:01:43.010 --> 00:01:46.629
now decrypt later exposure, went live in July
00:01:46.629 --> 00:01:50.459
as planned. The vendor promises landed. But it's
00:01:50.459 --> 00:01:53.680
not just Cisco. And that's the real story. Apple's
00:01:53.680 --> 00:01:56.299
iMessage has used post -quantum encryption since
00:01:56.299 --> 00:02:00.599
2024. AWS added it to Secrets Manager in April.
00:02:01.099 --> 00:02:03.420
Microsoft shipped the algorithms into Windows.
00:02:04.099 --> 00:02:08.020
OpenSSL and OpenSSH have it built in. The standards
00:02:08.020 --> 00:02:11.099
body NIST finalized the algorithms two years
00:02:11.099 --> 00:02:14.080
ago, and now the entire ecosystem has shipped.
00:02:14.669 --> 00:02:17.530
post -quantum crypto stopped being an availability
00:02:17.530 --> 00:02:20.629
problem. It's a deployment problem now. The code
00:02:20.629 --> 00:02:23.050
exists everywhere, and the only question is whether
00:02:23.050 --> 00:02:25.689
you've turned it on. One stat before we move
00:02:25.689 --> 00:02:28.650
on, and it's the one that moved the whole timeline.
00:02:28.789 --> 00:02:30.949
To break the encryption protecting your data
00:02:30.949 --> 00:02:33.789
today, a quantum computer needs a certain number
00:02:33.789 --> 00:02:37.349
of qubits. In 2019, the estimate was 20 million.
00:02:37.810 --> 00:02:41.110
In May of 2025, Google researchers cut it to
00:02:41.110 --> 00:02:45.120
under 1 million. In February of 2026, another
00:02:45.120 --> 00:02:48.240
team cut it to under 100 ,000. From 20 million
00:02:48.240 --> 00:02:51.280
to 100 ,000 in about a year. Nobody has that
00:02:51.280 --> 00:02:54.639
machine yet. But the target got 200 times easier
00:02:54.639 --> 00:02:57.360
to hit. And that's why everyone suddenly started
00:02:57.360 --> 00:03:00.240
shipping. And here's what turns a good idea into
00:03:00.240 --> 00:03:03.539
you have no choice. On June 22nd, the White House
00:03:03.539 --> 00:03:06.879
signed an executive order, 14 -4 -12, setting
00:03:06.879 --> 00:03:10.300
hard federal deadlines. High -value systems must
00:03:10.300 --> 00:03:12.800
move to post -quantum key exchange by the end
00:03:12.800 --> 00:03:17.719
of 2030, authentication by 2031. NIST's guidance
00:03:17.719 --> 00:03:22.719
deprecates RSA and ECC after 2030 and disallows
00:03:22.719 --> 00:03:26.240
them entirely by 2035. This isn't a white paper
00:03:26.240 --> 00:03:29.479
anymore. It's law with dates on it. If you're
00:03:29.479 --> 00:03:31.939
studying for Security Plus or the new SecurityX
00:03:31.939 --> 00:03:35.560
exam, here's exactly where this lands. The crypto
00:03:35.560 --> 00:03:38.039
you're learning isn't being replaced. the key
00:03:38.039 --> 00:03:42.039
exchange inside it is. Your IPsec VPNs, your
00:03:42.039 --> 00:03:45.800
TLS handshakes, your PKI, your SSH, all of them
00:03:45.800 --> 00:03:48.729
are being upgraded to hybrid MLChem. Know the
00:03:48.729 --> 00:03:53.469
players RSA and ECC are the vulnerable ones MLChem
00:03:53.469 --> 00:03:59.389
MLDSA and SLHDSA are the NIST replacements and
00:03:59.389 --> 00:04:01.810
the one concept that ties it together is crypto
00:04:01.810 --> 00:04:04.669
agility building systems So you can swap the
00:04:04.669 --> 00:04:08.210
algorithm with a config change not a forklift
00:04:08.210 --> 00:04:12.020
upgrade. So here's the close two years ago The
00:04:12.020 --> 00:04:14.860
cryptographers handed us the cure. This year
00:04:14.860 --> 00:04:17.240
the vendors shipped it, and the majority of the
00:04:17.240 --> 00:04:20.160
web already runs on it. Q Day might be 2030,
00:04:20.500 --> 00:04:23.439
it might be later. But Harvest Now Decrypt Later
00:04:23.439 --> 00:04:25.920
means the data you send this afternoon is already
00:04:25.920 --> 00:04:28.339
being recorded. The migration is no longer the
00:04:28.339 --> 00:04:31.180
hard part. Turning it on before the disease arrives,
00:04:31.720 --> 00:04:34.889
that's the only job left. That's the show. If
00:04:34.889 --> 00:04:37.490
this made you check whether your VPN is quantum
00:04:37.490 --> 00:04:40.970
safe yet, good. Go ask your vendor. We're back
00:04:40.970 --> 00:04:43.509
next week with more tech updates. Stay sharp.