speaker-0: Joining us is Bruce Edwards, founder and chief scientist at Q Foundry. Bruce is a recognized leader in quantum readiness, helping organizations accelerate the adoption of quantum technologies through the Q framework. His expertise spans post quantum cryptography. QKD, quantum security and the broader transition to a quantum safe future. Bruce, welcome to Quantum Ecosystem Conversations. It's a pleasure to have you with us today. tell us a bit about your background and yourself.
speaker-1: Yeah, so I I think it all kind of started when I was two with an IBM three eighty six. I my dad was a software developer and I think he decided, hey, if I put a computer in my kid's room, and he can't really speak a language yet, maybe he'll, you know, fumble around and see how he feels about it. So I kind of think that was the ultimate catalyst to just introduction to computers. It was kind of the personal computer era when they started to become more of a thing in the household. I guess that dates me, but that's okay. but that's kind of where everything started. And I I kind of got into software development, I think, in the very beginning. And every is kind of one thing led to another software development systems, cloud computing, security. And then I kind of ended up in this crypt realm of cryptography and in the security space and cybersecurity space. but yeah, so I I've worked at mo mostly all private sector in the beginning. but then the last couple of years I've really focused on work in the public sector as well. with various agencies. But a lot of my background comes in public or private, excuse me, and starting with, you know, entertainment companies, then big semiconductor companies, and then kind of leading me to eventually after that starting my own thing. So here we are.
speaker-0: Great, great. So could you also give a little bit about your educational background?
speaker-1: yeah. schooling? Yes. yeah. we're being honest. I I don't really have a lot of general education background. I'm actually a college dropout. I went to college for a year and realized it wasn't my thing. And I was able to write in like five or six development languages at the time. So I said I'm just gonna go write software and figure out what I'm gonna do with my life. And I kind of have explored and taught myself everything just by experience, running into problems, building things. So may not be the answer that people want to hear, but it's the truth. So
speaker-0: This is what I've been noticing as a pattern in our in our guests. They have quite unconventional background, and not necessarily focused on a traditional pathway to education. And so I think this is definitely refreshing. to hear,
speaker-1: Yeah, I my brother was always the one to go down that route. He went to medical school and all those things and I was always the untraditional sense. But I figured out a way out of what I guess some people thought that would lead to and yeah, here we are. So
speaker-0: could you give our listeners or viewers a flair of the companies that you work for, national, international. I know you have you're highly decorated that way. And so it just helps our audience to understand your trajectory.
speaker-1: Yeah, So I worked at Disney, so it's originally in content protection. So work with any piracy cype on the cyber side and basically building frameworks and systems to help the business be able to do things like how are we shooting all these movies and films and TV shows globally, and how are we getting all this data back home safely? Because if you have three unit shooting, you have all this camera raw being dumped on some local storage on set, like how are we going to get that stuff back to a post prod house? All those types things. So a lot of my team was building protocols and systems to help, you know, whether that's like cloud systems, encryption systems to help move things safely and securely, as opposed to having a sneaker netted across the world with armored trucks and all these things. So that was a lot of my my job at Disney writing white papers, like security white papers about how you know, Marvel or Pixar or whoever else needs to be approaching certain types of situations if for data. But a lot of it was data focused on that sense. And then I was at Sony Pictures for I think nearly three years. And I was in the cloud ops team. So building, you know, infrastructure and systems on the cloud side. How does Sony Pictures use cloud? How does it use it securely? How do we, you know, especially during COVID when They were trying to we're releasing Spider-Man. I think it was that year. I don't know if it was the Far From Home. I think it was Far From Home is the very first one. And there was a lot of post-production work that had to be done. And it's like, well, how do we do it if the lot was closed and we couldn't there was no like a guild protocol at the time to go back to the lot. And so our team were able to work and build these post production avid machines in the cloud so they these people could securely edit Spider Man in their pajamas at home. without having to be at the lot and actually, you know, not miss deadlines in terms of release schedule and stuff like that. and with films it's really important because there's been a lot of money and marketing and making sure these release dates are lined up to like drop the film at this time. So that a lot of and then a lot of that also was partnering with the security teams over there, all anti-piracy, just general information security and helping build a better, more robust ecosystem. Cause I feel like their companies like that tend to have, at least my experience, they tend to have a lot of Siloing, and I don't think it's intentional all the time, but sometimes these these people get siloed and it's like, well, these teams I think all kind of nearly need to work together. especially when it comes to security and cloud and infrastructural type teams. So I kind of worked a lot to bridge those gaps. I feel like there was a lot of siloing, and I was like, why don't we work together closer? Like these things are really important. So a lot of my my time there was on the security side and cloud side. And then most recently. I worked for a subsidiary of SK Heinex for almost four years. And they basically SK in 21 bought Intel's storage division. So they had made Intel used to make SSDs. and they said we're getting out of that business. So SK Heinex bought it. and I'm sure people listening probably know who SK Heinex is, especially in the last year and a half, with all the memory shortages and things like that going on. and so there I ran product security and cryptography and built. know, the entire cryptographic adoption roadmap for like we have these products, how do we adopt coming to PQC at this point now, right? Like we were using traditional algorithms. How do we adopt like algorithms in the post-quantum space? And at that time, you know, NIST recently just approved the PQC suite. So it hasn't been like too terribly long since we've had an approved suite of PQC algorithms that we can actually adapt adopt and The reason why that's important is because you're using non-standard things, especially in the hardware manufacturing space. that's the other tricky part about that industry is a semiconductor, usually you're taping out one, two plus years ahead of time or taping out way ahead. And so you have to have these standards in place because once you tape out, retaping out's very expensive. So you kind of have to be on the very cutting edge of this stuff because you have to work so far in the future because of how long things take to produce in the factory. So I learned a lot of lessons and had a lot of challenges there. Like, how does this business adopt post quantum cryptographic algorithms in our products, which in this case were solid state drives? And how do we use this technology? Is it in the firmware? Is it in in transit? Like, how do we like what types of ways are we able to utilize this technology? So that was definitely an undertaking, but that was my most recent adventure. And yeah. So that was the whole inten and then so at this point, but I guess by the time I left there, it's like they had a pretty good grip on how do we adopt these algorithms? Do we have the infrastructure in place? but that's that's the tricky part, right? Because if you're waiting on NIST to approve something, but you still have to tape something out. So you can't tape out a non-standard algorithm, you're in trouble. You have to retape. So it's like a whole so it was very tricky, one of those things where you have to be On the cutting edge of every little thing happening and following NIST and what's going on. But now they're approved. We can use them and at least the standards, the PKC standards, the PKC algorithmic standards are approved now. And NIST has the whole suite. So but yeah, it that was definitely the biggest challenge in this for me is learning if you're not ahead of this stuff early, especially in hardware, you're in trouble. You're already behind. And I feel like you're already behind if you're not thinking about this anyway. Because, like I told you, like adopting this type of these algorithmic changes, it it depends on what you're doing, right? Is it is it for defense? Is it in the field? Is it for banking? Is it for traffic systems? There's so many applications for types of encryption and they're all going to be vulnerable at some point. and I know that like it's kind of all theoretical because it's like we don't have a quantum computer right now to run shores to see if these ECC and ERSA are technically that vulnerable. But it's like if you look at the math, it's it's kind of a thing. And there's a reason the NSA Outlined their timelines for transition. There's a reason the last the EO came out last week, you know, all those things. So, but yeah, that's kind of my history and background and what kind of led me to Bill Q Foundry because I realized that there is a gap in the time that people think they actually have versus what they really have. And I realized adopting this is so tailored to a business and a use case and an industry and sector as opposed to. Just go to the store and buy this one thing and you're done. Buy the fertilizer for the grass. It's all gonna go green. It's like, no, what fertilizer and what patch of grass and what blade of grass? It's such a very niche thing per industry per sector, how you adopt this. So I learned a lot of that just working at SK, realizing the challenges and things that I faced there. So
speaker-0: So you your your transition actually aligns very well from a large enterprise to kind of your own startup, which is also one of the first speakers we had from IBM to a startup. what do you see where some of the the the transition issues that you encountered moving from a large business to your own startup? And also what are the pros and cons?
speaker-1: Yeah, I mean, I think in general, obviously working for an individual, you have this like I guess the pro is you have this like pretty systematic way. You go to work, you build this thing someone tells you to build, and you obviously, if you're at more of a leadership role like I was, you're helping shape what that roadmap looks like. I guess that's some pros, but like the cons are, you know, you don't have the final say of everything. You could have this idea that could help save them X amount of time or Another way to implement an algorithm that might be more efficient. And if someone just says no, it doesn't matter what you think. and the benefit of having your own thing is like, well, like you obviously the customer is ultimately the boss anyway, but at the same time, you can help guide the customer in a way that doesn't have there's not a bunch of I guess bureaucracy in the middle. It's like what you're the expert here, like how what how do you think we should approach solving this problem? don't know if that was really answering your question. I no, I was trying to keep
speaker-0: Great. I was getting at is some of the you know the the younger generation is considering careers in post-quantum, not necessarily becoming quantum physicists or sensing. You know, there are several verticals, But they are looking into unconventional careers, even with a science background and or biology background. And what I'm where I'm getting at is it is the perfect time or the perfect storm to actually consider some of those careers. also eventually four years later create their own startup if they are confident about their product you sound like a perfect background people can draw inspiration from, you know, it's it's something I am also so moving on How did you and I know you touched a bit about it, but I want you to expand a little bit more. How did you become interested in cryptography and cybersecurity? Is it because of the job profile you had or the the white spaces that you noticed or the resistance to being agile in the organization? how did you s you started with Disney and how did you end up here? I know you were dealing with data all along.
speaker-1: Yeah, I think I mean in general, I think there's always like I I mentioned before to you, I come from two generations of military and intelligence service in my family. And I feel like there was always something in me that said I need to serve and give back to my country, but I don't really know how. But I think it starts with doing something in a career space and area that's meaningful that could also transcend into national security, but also help the private sector because By protecting the private sector, you're also defending national security in a way. Because if you're keeping companies that are very valuable to the the country, but also just the economic stability of the country safe, then you're protecting the country inevitably. But you're also, if you can touch the public sector space, you're also helping in that way as well. But I think like my interest just kind of I I've always been like a puzzle person growing up. I like puzzles, I like solving problems. And I feel like I would like as I was exploring kind of my career in the very beginning with writing software, I kept saying to myself, like, okay, yeah, things are challenges in the beginning, but then things quickly, and this isn't like an ego thing, but things have quickly became not challenges. And I'm like, I want to I have this weird, maybe it's masochistic, but I always want to be so challenged to where it's almost like I wanna feel like it's almost impossible to do. And it just like weirdly pushes me to just I don't know, puts me in this headspace of no, I'm going to solve this problem. And it may take me a long time, but That's kind of I think how I got into this space because I, you know, was kind of dabbling all my twenties and early thirties, like security, cyber and things like that. And and I always fasting makes it always like, how do we like solving problems and going down a rabbit hole of like there's this vulnerability? Well, why is it exist? How is it exploitable? And this is like solving kind of reverse engineering things. And I've kind of always been a tinkerer too, like ripping radios apart. How do they work? And how does everything work is the question I ask about everything. And it's kept me curious. And I think being curious is really important as a person. But I think also that just kind of led to running product security at this business at SK, but then or SK Solidine, but then saying, Hey, there's a new wave of algorithmic requirements coming and you have to adopt them. And you have to adopt them at a large scale. And I was like, this is gonna be a fun challenge. So I kind of, you know, have always been interested in in cryptography, but then also having this massive opportunity at that business to be able to kind of how do we adopt this at scale? And how do we adopt this also live? It's not like we can sit in a lab and RD for five years. Like we have to keep moving things, the business to keep making money. Right. But how do we adopt this in like a live op scenario to where We're not changing too much of the current infrastructure. We're adding the ability to be able to use these algorithms. So I think it just kind of, I don't know how I landed in this, like, I think it just kind of maybe I just manifested it in my life to be this thing. But I think the ultimate thing was I was like, now I have this problem to solve, problem or challenge. And I've all I always just I'm kind of obsessed with always being challenged. And maybe it's like I said, maybe it's masochistic as when you relax, I don't know if I know how. I just like to solve problems. I can't help it. So that was a really cool and humbling opportunity to be able to solve a problem. so it kind of led me here. I And then I want to say, yeah. so I was gonna say I want to say one more thing about that is I also realized during that journey, that's what kind of brought me to think about Q Foundry. It's like there's a huge gap in understanding how to adopt this stuff. Because like I said, there's so many different, it's not just go buy a fertilizer at the store and it fixes everything, the grass is all. There's so many different niches and use cases and sectors and industries. And also when you start talking about public sector, it's more delicate now. And there's just so many different. So I was like, there's gonna be people. I mean, the NSAC and SA 2.0 is saying we have to adopt these things, and it has different waves of technology by different timelines. Yeah. but I'm like, Does everybody like not only that, like the people have the talent? Now big companies like Microsoft, they probably can hire. They have big, big teams that probably are in the forefront of this stuff, but some maybe there's a smaller defense contractor, may not have the the skills or the talent to adopt this stuff. Maybe it's a company that just needs some advice to advise their own people. it's just the gap of understanding the adoption process of this is what really inspired me. Cause I said, How are people? And I was like, I feel like I have a really good grip on how to do this now. And how to transcend that to any sector industry. So that's what inspired me to build what I built. Because I I like helping people and solving problems at the same time. But also, this is a really important transition, not only for our country, but just the world in general. because I feel like if we don't do it and there will be companies that are left behind that don't take it seriously and there will be impact, but we can only educate as much as we possibly can. And then taking action is up to the people, the business, public sector, et cetera.
speaker-0: While we are at it, can you actually talk about this once in a generational moment and why preparing for the post quantum era is so important
speaker-1: Yeah, I think I think like I was saying earlier, I think we're on this very I mean once in my lifetime kind of thing that we are shifting away from algorithms that are still mathematical in nature, but we're shifting to more advanced mathematical algorithms because they have the ability, at least are n are thought to be resistant to a quantum computer that is mature, right? running shores algorithm, for example. And the thing is, is like, if this is proven to be true when we have a mature quantum computer that we can run SHORE's and actually test our theory or case on, anything that's running ECC or RSA is vulnerable like immediately. And the other problem is like obviously there's tons of data breaches all the time. Unfortunately, this still happens. It's probably going to happen to the end of time because just there's Nuts that's something I learned about security too, is you some people obsess and never sleep and think about their job and secure security, but it's like you can only do so much. And you keep you can't cover every single hole, you can't prevent everything. So there's always gonna be these kind of things. The problem is, is someone may there's been a lot of cases, that's why harvest now decrypt later is kind of a thing, is because there's a lot of encrypted blobs of data that people have stolen.
speaker-0: Thank you.
speaker-1: Adversaries, whatever, and it it might be it's encrypted. But if it's like, okay, there's gonna these unless they have some special algorithm we don't know about, they're probably encrypted with ECC or RSA to an extent to some way. And if if like cloud as a service is now when cloud computing was early, it wasn't, but now it's like, you can use almost any resource as a service. When quantum becomes more available, we're like hopefully there's regulations and controls around this, but like if it becomes almost like AWS or GCP where you can just Rent a quantum computer to run an an input, and you can run shores, like that's gonna be a weapon to an adversary. And like they could take all this harvested data they've had for 20, 30 years. It could have state secrets, it could be anything in the in the public sector sense, or it could have private company secrets, it could be you know, trade secrets, whatever. If they can decrypt all this data, then it it's it's talk a cyber war. Like it could be very bad. So it's like we can't again. We can't fix everything, but because of this revelation and because of what's happening in the cryptographic space, we need to at least try our best, which is we need to move to these more advancement macro algorithms that have been developed and are known or thought to be resistant to a quantum computer. Because the traditional ones, at least according to Schrock's algorithm, are basically obsolete the moment that we can run it efficiently. And it's That's kind of scary because like I said, this is a once-on-time opportunity where it's like, or not opportunity, but moment where all everything is really encrypted with something. And a lot of it's these old algorithms. And it's like if they're all now vulnerable, you're saying everything in the world is now vulnerable. Like, yeah. And so that's why I think it's really important to say we don't know the effects of we we have, you know, theories and we've done tests and things, but at least if we can move to these more resistant algorithms, we have a better chance. Then at some point, you know, the quantum computer will likely be advanced to then break those. So then we have to look at QKD, right? How do we use quantum key distribution only? We're not using any kind of mathematical algorithms. We're using, you know, pure quantum mechanics at this point. but it's just it's important because it's not common that we have this collapse in digital trust to where everything that's encrypted, period, is using an algorithm that's now vulnerable. That's never been a thing, at least in my lifetime. So it's really important that we look to what does it take to get us to migrating these things? And like I said, it's a it's a big ask because every company is so different. People have different crypto stacks in their businesses. And so that's why I said, man, there needs to be someone that can help guide and help people adopt this. And that's why I started Q Foundry because I like I don't I saw a gap. That's why I say to any young person too, like, if you feel inspired. And you see a gap in something that you feel like you could fix, go build it. And if you fail, so be it. But go try. You have to try. And so that's kind of what I did. I said, I have to build this because I I feel it here. I have to build it, but also there's a gap. And I feel like people a lot of it may be education. It's like, why is this important? It's like, okay, well, let's start with educating you. But again, we can only do so much. We can start educating people. Why it's so important.
speaker-0: Yeah, it's just one part, right? But what do they do after awareness? And the which is something we observe as well in the c ecosystem building in states or nationally, is education is just step one, t teaching them what they don't know. But then what do they do with that information? Are they going to be quick enough to adopt this into their organization or are they going to wait like one more year, which in that case, It's going to be disastrous and I just think as we are speaking, the standards are developing and people are adopting, people who are going to lead this race are going to be the ones calling shots, right? So on the other end of the spectrum, what do you think if people don't move with this? If the organizations don't adopt this, what is the worst case scenario?
speaker-1: I mean, I think again, what we understand or perceive to be the case based on the algorith the classical algorithms like RSA and EC today, based on what we believe and know so far, at least in theory, because we again we haven't, at least I don't have access to a quantum computer that can run shores and test this exactly. But if it if it all proves to be exactly how we theorized it, I mean anything with ECC or RSA is obsolete. And someone that has access. To any kind of encrypted data or back ends, like there's a lot of like I think it's also really good to know, like a lot of people, maybe not understand a lot of these people that do breaches and hacks and things like that, a lot of them they've had they have access for a long time. They just kind of sit in in in hibernation and wait for the right time. They had access. So if they can sit in the back end and and just steal behind for a long time, that that's kind of the thing. So that's I I'm saying I think like the worst case to me is. I mean, it's just like I I I preached this internally, you know, when I was solid MSK. It's like we have to protect these private keys with our lives. Like, not really, but like in a way, it's that serious. It's crown jewel. Like, if these keys are leaked, the company could just shut the doors. Because you literally now someone can impersonate sign all your firmware. It's like very dangerous, right? Because so I think I'm kind of rambling on, but I think worst case, I mean. Everything is vulnerable. Think about HR find everything, personal data, socials. That's just like the PII. I'm talking about trade secrets, like anything that is encrypted with these algorithms. If again our theories are correct, and you know how Shores works and how it can actually attack these algorithms and break them, it's all vulnerable. And like I I I've had conversations like, you know, we when we were QD QEDC last year. W with certain officials and people saying, Hey, it's very scary, especially on the public sector side, if that is not something that's taken seriously. Just because of the implications. Like war doesn't always have to be on the ground. Like this could be a massive cyber war and a problem, and it'd be scary. So again, this is all if our theories are proven correct and shores can do these things and I'm in sure corner, Peter, but regardless, we should take it seriously. I mean The NSA didn't release the NSA two point with the detail they did for fun. Like they're they have information and data to build a document like that to say this is important to do now. And here's your transition timelines. And so yeah.
speaker-0: Okay, so the data-wise, in my opinion, the military, national security-related data and the health data that you pointed out to PIIs are kind of the most critical if if I was given a choice, the first to protect. is there anything else that you would rank above it or on par with it that I'm missing here?
speaker-1: I mean, that's a good question. I think I mean even thinking about like he this is something that's a little bit niche, but it's more of a national security thing. Let's say there's a lot of data I mean, around like let's just say a big city, like traffic systems, like light patterns, how things move, how traffic flows, like that could be a threat to our country Like if someone understands how traffic systems work. Like that could be data on like how are these things moving? Like how are when does this thing like all these or for like, you know, water systems, how does the dam work? Like all these little like niche things or water supply. How does it actually twin? When does this happen? When's so I think just data on key critical manufacturing systems as well, like or even like traffic systems or like that kind of data can be exploited as opposed to like if you steal health data, you have health data here it is in front of you. But if you have data on traffic systems for a massive city, how they work and lights and things like that and timings, that might just be to the normal person, it may just be like, that's just a bunch of dumb data, but the right person could exploit that and potentially commit an act of terrorism with that kind of data. And that's very dangerous. So I think like any kind of like I guess data that has any almost I I don't know, almost There's some things that may not be the end of the world. Like, no offense to a private sector company, but if a big wig salary leaks, okay. Probably don't want people to know, but like, okay, but like if a trade secret leaks, like how is Coca-Cola made? Like that's probably a problem. If it's not as critical as national security, but it's still a problem for a company because it potentially caused massive losses and public companies, which shareholders would be very happy. That's just bad for the financial markets in general. So there's a lot of things. I mean, I could go on and on about that, but yeah, I think like there's a lot of different aspects of that. Absolutely.
speaker-0: Thanks for bringing all those things out because this is exactly where I look at it. Is not the most obvious critical data. it is as simple as air traffic control. could be shutting down the entire nation. you know in a heartbeat, including like chemical manufacturing. I I come from that background. I I look at what are the implications. most of the chemical plants are now obviously digitized, but there are AI agents now manufacturing next pharmaceutical And if you just alter some of these compositions or basically alter the recipes of a pharmaceutical itself, like a vaccine that could be producing something not intended for a mass administration like we did for COVID. So there are so many implications if not properly thought out. I'm actually worried, which is why I bring experts like you to reinforce post-quantum and the quantum readiness both equally you mentioned Bruce the NIST lays out these standards now are they looking five years into the future like I know how do organizations ad adapt and adopt do they work with NIST to come up with some of these standards did you have any prior experience coming up with standards for federal government? only things that you can talk about, by the way.
speaker-1: Yeah, what I can say is I think especially, you know, if let's just say an algorithm standard is being developed, like when PQC was being standardized, there was drafts and drafts and you know, a lot of bigger companies, even smaller companies, you there's if you have an issue with how something's implemented or I have an issue with this standardization because I can't do ABC if this is a restriction we need to work on. So there is actually a lot of miscollaboration with private sector as well. Which think is really good. So I think a lot of these, especially the PKC standard, it took some time to get out of draft phase to a final standardization. But I think there was a lot of collaboration with private about because I remember specifically I can't talk about all the details, but at SK Solidime, there were specific niche issues that we had to work through with the standards based on how we we built things. So it's like we there it there is a lot of like feedback. You know, you can work with NIST on. Hey, this is like might not work for us. And so there is a lot of community driven back to those standards as well. So I think that's a good thing. But I also think, you know, because they're interagency, they can work with lot of other people, like internally at the federal government and say, because like I said, the NSAC and S82.0 didn't come out of thin air. Like, there's a reason. Well, well, that data is obviously very secret and proprietary where it came from, but like there's a reason why they gave the dates and developed what they did. And that's good because they're looking to the future. So I do think These algorithms weren't they are a stopgap to quantum cryptography, I think, but I think that they're a pretty healthy one in terms of timeline. And I think, hey, it's better than just keeping RSA and E C around saying, screw it, guys, just stay on this and we'll just hope and pray that sure doesn't work the way we think it does or whatever, right? so I I do think that, you know, there is a lot of great collaboration there with NIST and private, especially. I'm sure there's a lot of good public to public collaboration internally there as well. But You know, if there is issues like, hey, we can't implement this this way because it may not work ABC. There's a lot of cause there's lot of very specific algorithmic features. Like for example, MLDSA eighty seven or MLDSA in general, that suite has also different types of algorithmic features. And some algorithms don't work the same as others. And so yeah, I would I would say at least what I've seen, there's been a lot of great collaboration. but I do think those algorithms are being developed and standards being developed based on the future. I do think they're looking at, you know, as far out as math advanced mathematics can actually protect us from in terms of encryption. I think they're doing their best to look in that direction, especially looking internally interagency to say, Hey, where are you guys seeing and how do we kind of align with you as well?
speaker-0: Sure. So let's switch gears to now that we laid the ground for people who actually never heard of PQC. what is PQC? and how do you explain that to somebody with no technical background?
speaker-1: Well, yeah. So basically, just like RSA and ECC, PQC, and that's the thing because I think it's kind of confusing because people say post quantum cryptography. Doesn't that mean after quantum cryptography? But it the name refers to the era, not the technology. So it's referring to, hey, after a post qu after a post quantum age, where we have mature quantum computers, what can help protect us leading up to this as well? Right. So That's at least a little bit because it was confusing me at first. It's like, why is it post quantum? And it's it's more of like the era. so how how do we protect ourselves from the coming era, like the post quantum era? Because I so yeah. So yeah, so PQC is just it is still mathematical algorithms, but they're more advanced math. so all the way to the point that like There is like a sense where I can imagine in a hardware situation, you might need to work with new manufacturers that can even support this type of because it's advanced math on a chip. How do you you have people that can support that kind of thing? So there is definitely a change that's needed. It's not just, but it's this is my really technical way trying to describe something simple and it's not working out so well. but it's bait it's still mathematical algorithms, it's just more advanced. It's using advanced math and it's more complex. So it makes it at least thought to be harder for a quantum computer to solve easy. But again, it's all theory because have we tested it? Not really. so yeah, and I guess explaining PQC to someone with non-technical background. So my example was you know, imagining there's all these digital locks that protect your bank accounts, messages in your phone. And They're about to, there's about to be this era shift where there's a new technology that is just a universal master key to basically unlock all those locks are now basically obsolete. You can just get a hammer and bust it off. So what post quantum cryptography like I guess looks and aims to solve is how do we replace globally all these digital padlocks with a a new design that the master key or How do we replace these padlocks with a new design that this master key, this universal master key that's being built, can't easily just open? So it basically is, I guess the simple way to say it is all these things there that are known to be secure, don't really have locks that are worth anything anymore. It's like putting a door in a lock, but then like the frame is just there, you walk around the door. It doesn't really matter. You can still get around. So Just imagine everything that has some sort of layer of encryption or security having a master key that can just basically make it obsolete. And so we're trying to find a way to replace all those locks with better locks that are more advanced that the master key maybe won't be able to open as easily or at all.
speaker-0: And and there is also a misconception I would like for you to clear it up for our audiences is Is the understanding that these algorithms need to be done also on a quantum computer. But you can actually start adopting these algorithms, using a classical computer, right? So can you explain a little bit more on how what you hear about this and how you can clear that misconception and how adoption can take place starting now?
speaker-1: Yeah, I think the first step is if you're looking to you, you know, you may not even know. That's the thing, the education piece, like you may not even know you need to adopt these things. But if you have an idea of, my gosh, we have a crypto stack that needs to be adopted into more of a PQC or wastely wipe over PQC so we can not be vulnerable. yeah, these so a lot of it starts with, you know, let's just say I'll use the hardware manufacturing case because it's a little bit It's nothing private. This is all like pretty well known. In this case, you have keys, for example, right? Let's say device ID keys that live on an actual drive. So you have billions or millions of drives that go out the door in that factory. But there's gonna be keys that live on all those drives. the private key, right? So but or the public key. So it's like that the other key, or I'll explain this. so those the private keys have to live somewhere safe. But and these are post-quantum cryptographic keys. They're still, again, these are still classical. There's still classical computers involved. It's not anything to do with quantum computers at all, actually. so in this case, those keys have to live on what you'd call a hardware security module, right? Like a device. So there's lots of vendors, Talus, Fortanix, a lot of good vendors out there that have these devices for and they they they build, they've been building these for years. So but there's You know, that's one way is if for at least the key storage side is you have vendors like that that support these newer algorithms. but that's nothing to do with quantum at all in this case, quantum computers at least, that are needed in this case. but again, everything really depends on the type of adoption you're looking at. there are keys have to live somewhere and they have to live somewhere safely. So when it comes to like having one in a hardware security module. you just have to have a vendor that can support these algorithms that can generate keys with these algorithms, which requires, you know, newer hardware that can do this advanced mathematics and things like that. But all of it is still classical.
speaker-0: in future adversaries are using to decrypt this data using a quantum computer, but at the same time, we are prepping for that future using a classical computer. Do you see a a combination of a quantum computer with these classical algorithms? to combat this more efficiently? Like is there a spot for quantum computer working against quantum computer in future is my question.
speaker-1: I mean, I I think so, because I I think the quantum computers that we have today, as as you know as well, a lot of it is this duality where when the quantum computer gets an input, it decides, do I need to give this instruction to a quantum computer or a classical computer? Because I think a lot of the misconception about quantum computers as well is that classical computers are now obsolete. It's like no classical computers still do th some things way better than quantum computers do at this time. So the qu a quantum computer is actually a hybrid. It it has an instruction where it says what is better for class computer to do and what's better for quantum computer to do. And it kind of splits these instructions and they go do the thing and at the end of the end of the end of the line they merge and say, Here's your output. So I do think there's a world where a quantum computer can assist in combating against adversaries in this way because quantum computers still use classical. I mean, just like the quantum two we learned about last year, QDC. It's like It takes an input that says, okay, are you better for quantum computing or are you better for classical? I can solve, okay, so I'll break this apart and you can you quantum is you know, you can this is more of a quantum-based equation you solve. This is more classical. And let's meet at the end when we're done solving our problems and give somebody an output. So I think that cla that's the misconception, I think, as well as, well, quantum computers come, class computers are worthless. Like, no, I don't think so. I think that they'll still be a vital integral part of even quantum computing because of. what they can at least as of now do better in some cases in quantum computers. So I think they're always gonna work together. Even though it's a quantum computer, there's still a classical piece of it, especially when it comes to solving issues or solving problems. At least how they're built today.
speaker-0: Great. So moving on to the next question on I know we talked about this, but if you can explain a little bit more, On what is harvest now and decrypt later?
speaker-1: So yeah, so I was yeah, I was touching on that earlier. So basically it's a good example of this. There's been a I can't think of a breach off the top of my head right now, but there's a lot of times where an attacker can they may breach a business or government, unfortunately, and there may be data they gather that maybe is just encrypted blobs and they don't really even know what it is. It's just a ton of data that's encrypted. And The harvest and decrypti later means they harvest it. So they they may have a breach and they may say, we can get all this data if I'm an attacker. I can get some of it is decrypted, some of it's not. and so they could take who knows, terabytes, terabytes of data that is just encrypted, and they have no idea what it is because it's just a blob of nothing, because they don't know what it is because they can't decrypt it right now. So they'll steal all that data, they'll go throw it in some cold storage and some data center, some weird place, another country in the mountains or wherever. And they're just saying, hey, at some point. The encryption that this is using to protect this data will be obsolete. But the data inside the encrypted blob might not be obsolete. If it's a state secret, that might be kind of a forever piece of information, right? That's why it's so dangerous, is because, you know, again, if it's a CEO's salary, okay, that's No offense, that to me is not a national security threat. That's not good. It's bad press. But but the thing is, is a lot of this data could be, if it's stolen, again, I can't think of a breach of top of my head. But you steal a bunch of encrypted data, you say, hey, like at some point, these these encrypted the the algorithms that are encrypting this data will be obsolete in terms of there won't be hard to break. So if I harvest all this data now, I'll just sit on it and wait until. The moment comes where I can decrypt this data, whether it's like I have access to a quantum computer or one as a service, and I can dec start decrypting this data. And who knows what's gonna be in there? Again, if it's that's the danger in it. If it's state secrets or something like that, it's very dangerous because that stuff is persistent data. It's not like, you know, it could be something that happened or something going on. It's a huge risk, national security in general. Like if I'm looking at the public sector side, but I mean, even if it the private sector example, if someone broke into an entertainment business and stole a bunch of like trade secrets or how they do things or how they maybe it's a VFX pipeline, they have an efficient way of, you know, rendering VFX for a film and it's like a proprietary thing they built. That's still a problem because while it might not cause a war, it could cause a lot of economic disruption. and so that's kind of essentially what it is. It's taking something that is encrypted now. with some algorithm that's a cli like ECC or RSA and saying, Hey, I know I can't do much with this data because it's basically worthless right now. But at some point, if I can decrypt it, who knows what will be inside of it. And that's the problem is the data is the data might be something that's a persistent thing. It might not just be, you know, a salary. It could be a state secret. So it's a problem.
speaker-0: So right now all the data as you are saying is vulnerable, right? It's probably harveste already. this goes back to one of the I'm an adjunct here in a local Utah University where in we had set several students actually ask this question about and they are cybersecurity students. How to how to think about intellectual property protection in post quantum era do you have any guidelines on that, Bruce?
speaker-1: I mean, I think i i I'd say all data is kind of the way I look at it. I mean, there's certain data you want to maybe treat differently in terms of your recovery plans or where it's stored and how it's encrypted. But I'd say IP in general. I mean, you just need to look at the bleeding edge of how can we encrypt things now. And it post quantum era is here in terms of the cryptographic side. There's standard algorithms you can use today. So I'd say if there's anything that's coming out of today that you can encrypt, try to use an algorithm. that's more resistant, like the post-quantum suite from NIST. I I think and again, this is where the this is why the adoption challenges come in, because sometimes, for example, like with this is a newer technology, like there's been issues where well I have this new algorithm, but I can't decrypt it fast enough in mass because of the speed. So there's all these little things you have consider, but in terms of just purely protecting a piece of information. I think you should look to utilizing post-quantum algorithms for encrypting anything. And I again, sometimes you're kind of at the mercy of, we use a vendor like SAP or we use a vendor for storing this. How do we know? It's like, well, you have to work with that vendor and say, hey, like how are you encrypting this data right now? Like so that's it, but if you have full autonomy of the data in your own storage devices and you still might have a vendor though, cause somebody produces the hard drive that the data's on. Somebody produces maybe the storage appliance. So that's the other gap is like there's all these vendors that have to there and a lot of these vendors I've talked to, especially across the board and different industries, they're they're they kind of have to move to this because not only they don't want to be liable later, but they don't want to be vulnerable. But I'd say if you're encrypting anything right now, look at, you know, trying to use a post quantum suite from NIST. And again, that how you use that is gonna depend on what kind of data it is, how is it stored, where is it stored, using a vendor, or using cloud service, a lot of different variants. This is why the adoption side is not just a one size fits all. And that's why, like I said, I felt like somebody had to do it.
speaker-0: Yeah, it has to be custom made for the organization or the entity, big or small, right? Including the data centers, I'm assuming. handle quite a bit of data. Now, is there we we do have quantum computers right now at some kind of logical qubits and physical qubits, so moderately operating quantum computers. is there any data that could be decrypted using those do you discuss about this in your circles or i it's not a chance right now?
speaker-1: I actually don't know. I actually don't know if there's a quantum computer that can efficiently run shores and try to break RSA. I don't even at a small scale. I don't even I'm actually not sure if we've done it. Maybe we have. But I think if we've have, I'd hear more noise about it. But yes. I think it's still theoretics, but someone that knows a lot more about this that that specifically can correct me if I'm wrong. but I don't think as of right now. This day we have one that can efficiently run shore stably to actually decrypt. But I maybe someone's running these tests, but not that I know of. But again, somebody out there that knows a lot more than me about this could potentially share any additional information that but not that I know of. I don't think we're far away. Yeah.
speaker-0: Great. That could be far away. There is our next speaker, and we would love to bring you back just to be like on a panel to ask some of these questions. to have a juxtaposition of the post quantum and quantum folks. but also there there are some publications over the last one year. from China. But again, the validity and credibility is yet to be ratified by somebody who is a subject matter in the field, right? so any any other career paths advice for the students K through twelve but also I would like you to comment on adoption strategies a high level or a recommendation on a high level for enterprises and entities that can be offered.
speaker-1: Yeah, I think the first the first point of the question was any additional advice. I think like if you really feel passionate about something and you see a gap, even if I get that, like, you know, a lot usually especially when you're young, you can't easily leave a full-time job and just go pursue something on your own. Like usually takes a little bit of time in your career to build up some savings and some time and things like that. But if you have an idea and you're passionate about you see a gap, build it after work. Like Start thinking about it. don't be afraid to fail because like I failed so many times in my career, but failing is how you learn things. And you can't be afraid to make mistakes. I mean, obviously you don't make very bad big mistakes, but you can make you know, don't be afraid to make mistakes and stumble a little bit when you're trying to think about things. But if you have an idea and you feel and that's the thing, don't get in your head about it about I don't know if this is gonna work. Who cares? Try it, do it, give it a shot. If you see a gap, try to You know, fill it with something. Again, even if it's like on the side, you build something on the side, test it out, spend time. I said it's one thing is don't be afraid. Cause sometimes certain societal perceptions will make you think like maybe in your head, if you've shared anybody with your idea, they may make you think that your idea is not viable. Just ignore it. Just go do it. And again, easier said than done, but maybe start small. but just don't be afraid to do something and try something. Like if you feel something and you see a gap and you can actually solve a problem, maybe go try to solve it. I'd say for the second piece in terms of where do you start with adoption, I would say the number one thing before anything is you need to understand the landscape of your crypto stack. Do an inventory. There's a lot of good tools out there that can do it for you, but you need to understand What's your crypto stack look like? What what does it contain? Is it all TLS? Is it TLS? And there's some other things. Like, what is your crypto stack look like in your business? And do an inventory of your crypto stack. And then you can say, here's an inventory. And I can say, okay, I have 50,000 certs, for example. in this case, what are they all? Are they all ECC or are they all RSA? Like then. You have to have an inventory first. Like so starting with an inventory of what your cryp crypto landscape even looks like in the business is the first step. Because then until you have an inventory of what the landscape actually is that you need to adopt and shift over and migrate over to, because that you're not really gonna have it's gonna be kind of a messy thing, right? So I think the first step is building a crypto inventory in your business and understanding landscape of what you have. And then at that point, you know, okay, so Then you can start building out like phases of I need to work on adopting my TLS stack first. Okay, what does it like? Are we using vendors? Do they support this? There's just so many questions, but having a crypto inventory is the most important thing. Understanding the landscape of what you have now. So that's the that's the, I guess the if I could leave one piece of advice is start working on building a crypto inventory of all the things that are, you know, in your business.
speaker-0: Great. Any last few thoughts, Bruce, before we close the conversation?
speaker-1: just I don't know, just if you feel like I said earlier, like if you feel like there's a gap and you wanna solve a problem, just go solve it, even if you have to start small and don't be afraid to do it. Don't let societal norms tell you, that's a dumb idea. Who cares what they think? Like if you think it's a a problem you could solve and you could fill a gap, try it. Great. And just don't listen to people, just focus on what you believe in your heart is the right thing to build. So yeah.
speaker-0: Great. Thank you so much. Thanks for joining us today, Bruce, and for helping demystify such an important topic. As we have learned, post-quantum cryptography isn't just about preparing for the future, it's about taking action today to protect the digital infrastructure we all rely on. To our audience, thank you for joining another episode of Quantum Ecosystem Conversation. I hope today's discussion provided valuable insights into post-quantum cryptography, why it matters, and what organizations can do to begin their quantum safe journey. Thank you for watching and we'll see you next on the Quantum Ecosystem Conversations.
speaker-1: Yeah, so I I think it all kind of started when I was two with an IBM three eighty six. I my dad was a software developer and I think he decided, hey, if I put a computer in my kid's room, and he can't really speak a language yet, maybe he'll, you know, fumble around and see how he feels about it. So I kind of think that was the ultimate catalyst to just introduction to computers. It was kind of the personal computer era when they started to become more of a thing in the household. I guess that dates me, but that's okay. but that's kind of where everything started. And I I kind of got into software development, I think, in the very beginning. And every is kind of one thing led to another software development systems, cloud computing, security. And then I kind of ended up in this crypt realm of cryptography and in the security space and cybersecurity space. but yeah, so I I've worked at mo mostly all private sector in the beginning. but then the last couple of years I've really focused on work in the public sector as well. with various agencies. But a lot of my background comes in public or private, excuse me, and starting with, you know, entertainment companies, then big semiconductor companies, and then kind of leading me to eventually after that starting my own thing. So here we are.
speaker-0: Great, great. So could you also give a little bit about your educational background?
speaker-1: yeah. schooling? Yes. yeah. we're being honest. I I don't really have a lot of general education background. I'm actually a college dropout. I went to college for a year and realized it wasn't my thing. And I was able to write in like five or six development languages at the time. So I said I'm just gonna go write software and figure out what I'm gonna do with my life. And I kind of have explored and taught myself everything just by experience, running into problems, building things. So may not be the answer that people want to hear, but it's the truth. So
speaker-0: This is what I've been noticing as a pattern in our in our guests. They have quite unconventional background, and not necessarily focused on a traditional pathway to education. And so I think this is definitely refreshing. to hear,
speaker-1: Yeah, I my brother was always the one to go down that route. He went to medical school and all those things and I was always the untraditional sense. But I figured out a way out of what I guess some people thought that would lead to and yeah, here we are. So
speaker-0: could you give our listeners or viewers a flair of the companies that you work for, national, international. I know you have you're highly decorated that way. And so it just helps our audience to understand your trajectory.
speaker-1: Yeah, So I worked at Disney, so it's originally in content protection. So work with any piracy cype on the cyber side and basically building frameworks and systems to help the business be able to do things like how are we shooting all these movies and films and TV shows globally, and how are we getting all this data back home safely? Because if you have three unit shooting, you have all this camera raw being dumped on some local storage on set, like how are we going to get that stuff back to a post prod house? All those types things. So a lot of my team was building protocols and systems to help, you know, whether that's like cloud systems, encryption systems to help move things safely and securely, as opposed to having a sneaker netted across the world with armored trucks and all these things. So that was a lot of my my job at Disney writing white papers, like security white papers about how you know, Marvel or Pixar or whoever else needs to be approaching certain types of situations if for data. But a lot of it was data focused on that sense. And then I was at Sony Pictures for I think nearly three years. And I was in the cloud ops team. So building, you know, infrastructure and systems on the cloud side. How does Sony Pictures use cloud? How does it use it securely? How do we, you know, especially during COVID when They were trying to we're releasing Spider-Man. I think it was that year. I don't know if it was the Far From Home. I think it was Far From Home is the very first one. And there was a lot of post-production work that had to be done. And it's like, well, how do we do it if the lot was closed and we couldn't there was no like a guild protocol at the time to go back to the lot. And so our team were able to work and build these post production avid machines in the cloud so they these people could securely edit Spider Man in their pajamas at home. without having to be at the lot and actually, you know, not miss deadlines in terms of release schedule and stuff like that. and with films it's really important because there's been a lot of money and marketing and making sure these release dates are lined up to like drop the film at this time. So that a lot of and then a lot of that also was partnering with the security teams over there, all anti-piracy, just general information security and helping build a better, more robust ecosystem. Cause I feel like their companies like that tend to have, at least my experience, they tend to have a lot of Siloing, and I don't think it's intentional all the time, but sometimes these these people get siloed and it's like, well, these teams I think all kind of nearly need to work together. especially when it comes to security and cloud and infrastructural type teams. So I kind of worked a lot to bridge those gaps. I feel like there was a lot of siloing, and I was like, why don't we work together closer? Like these things are really important. So a lot of my my time there was on the security side and cloud side. And then most recently. I worked for a subsidiary of SK Heinex for almost four years. And they basically SK in 21 bought Intel's storage division. So they had made Intel used to make SSDs. and they said we're getting out of that business. So SK Heinex bought it. and I'm sure people listening probably know who SK Heinex is, especially in the last year and a half, with all the memory shortages and things like that going on. and so there I ran product security and cryptography and built. know, the entire cryptographic adoption roadmap for like we have these products, how do we adopt coming to PQC at this point now, right? Like we were using traditional algorithms. How do we adopt like algorithms in the post-quantum space? And at that time, you know, NIST recently just approved the PQC suite. So it hasn't been like too terribly long since we've had an approved suite of PQC algorithms that we can actually adapt adopt and The reason why that's important is because you're using non-standard things, especially in the hardware manufacturing space. that's the other tricky part about that industry is a semiconductor, usually you're taping out one, two plus years ahead of time or taping out way ahead. And so you have to have these standards in place because once you tape out, retaping out's very expensive. So you kind of have to be on the very cutting edge of this stuff because you have to work so far in the future because of how long things take to produce in the factory. So I learned a lot of lessons and had a lot of challenges there. Like, how does this business adopt post quantum cryptographic algorithms in our products, which in this case were solid state drives? And how do we use this technology? Is it in the firmware? Is it in in transit? Like, how do we like what types of ways are we able to utilize this technology? So that was definitely an undertaking, but that was my most recent adventure. And yeah. So that was the whole inten and then so at this point, but I guess by the time I left there, it's like they had a pretty good grip on how do we adopt these algorithms? Do we have the infrastructure in place? but that's that's the tricky part, right? Because if you're waiting on NIST to approve something, but you still have to tape something out. So you can't tape out a non-standard algorithm, you're in trouble. You have to retape. So it's like a whole so it was very tricky, one of those things where you have to be On the cutting edge of every little thing happening and following NIST and what's going on. But now they're approved. We can use them and at least the standards, the PKC standards, the PKC algorithmic standards are approved now. And NIST has the whole suite. So but yeah, it that was definitely the biggest challenge in this for me is learning if you're not ahead of this stuff early, especially in hardware, you're in trouble. You're already behind. And I feel like you're already behind if you're not thinking about this anyway. Because, like I told you, like adopting this type of these algorithmic changes, it it depends on what you're doing, right? Is it is it for defense? Is it in the field? Is it for banking? Is it for traffic systems? There's so many applications for types of encryption and they're all going to be vulnerable at some point. and I know that like it's kind of all theoretical because it's like we don't have a quantum computer right now to run shores to see if these ECC and ERSA are technically that vulnerable. But it's like if you look at the math, it's it's kind of a thing. And there's a reason the NSA Outlined their timelines for transition. There's a reason the last the EO came out last week, you know, all those things. So, but yeah, that's kind of my history and background and what kind of led me to Bill Q Foundry because I realized that there is a gap in the time that people think they actually have versus what they really have. And I realized adopting this is so tailored to a business and a use case and an industry and sector as opposed to. Just go to the store and buy this one thing and you're done. Buy the fertilizer for the grass. It's all gonna go green. It's like, no, what fertilizer and what patch of grass and what blade of grass? It's such a very niche thing per industry per sector, how you adopt this. So I learned a lot of that just working at SK, realizing the challenges and things that I faced there. So
speaker-0: So you your your transition actually aligns very well from a large enterprise to kind of your own startup, which is also one of the first speakers we had from IBM to a startup. what do you see where some of the the the transition issues that you encountered moving from a large business to your own startup? And also what are the pros and cons?
speaker-1: Yeah, I mean, I think in general, obviously working for an individual, you have this like I guess the pro is you have this like pretty systematic way. You go to work, you build this thing someone tells you to build, and you obviously, if you're at more of a leadership role like I was, you're helping shape what that roadmap looks like. I guess that's some pros, but like the cons are, you know, you don't have the final say of everything. You could have this idea that could help save them X amount of time or Another way to implement an algorithm that might be more efficient. And if someone just says no, it doesn't matter what you think. and the benefit of having your own thing is like, well, like you obviously the customer is ultimately the boss anyway, but at the same time, you can help guide the customer in a way that doesn't have there's not a bunch of I guess bureaucracy in the middle. It's like what you're the expert here, like how what how do you think we should approach solving this problem? don't know if that was really answering your question. I no, I was trying to keep
speaker-0: Great. I was getting at is some of the you know the the younger generation is considering careers in post-quantum, not necessarily becoming quantum physicists or sensing. You know, there are several verticals, But they are looking into unconventional careers, even with a science background and or biology background. And what I'm where I'm getting at is it is the perfect time or the perfect storm to actually consider some of those careers. also eventually four years later create their own startup if they are confident about their product you sound like a perfect background people can draw inspiration from, you know, it's it's something I am also so moving on How did you and I know you touched a bit about it, but I want you to expand a little bit more. How did you become interested in cryptography and cybersecurity? Is it because of the job profile you had or the the white spaces that you noticed or the resistance to being agile in the organization? how did you s you started with Disney and how did you end up here? I know you were dealing with data all along.
speaker-1: Yeah, I think I mean in general, I think there's always like I I mentioned before to you, I come from two generations of military and intelligence service in my family. And I feel like there was always something in me that said I need to serve and give back to my country, but I don't really know how. But I think it starts with doing something in a career space and area that's meaningful that could also transcend into national security, but also help the private sector because By protecting the private sector, you're also defending national security in a way. Because if you're keeping companies that are very valuable to the the country, but also just the economic stability of the country safe, then you're protecting the country inevitably. But you're also, if you can touch the public sector space, you're also helping in that way as well. But I think like my interest just kind of I I've always been like a puzzle person growing up. I like puzzles, I like solving problems. And I feel like I would like as I was exploring kind of my career in the very beginning with writing software, I kept saying to myself, like, okay, yeah, things are challenges in the beginning, but then things quickly, and this isn't like an ego thing, but things have quickly became not challenges. And I'm like, I want to I have this weird, maybe it's masochistic, but I always want to be so challenged to where it's almost like I wanna feel like it's almost impossible to do. And it just like weirdly pushes me to just I don't know, puts me in this headspace of no, I'm going to solve this problem. And it may take me a long time, but That's kind of I think how I got into this space because I, you know, was kind of dabbling all my twenties and early thirties, like security, cyber and things like that. And and I always fasting makes it always like, how do we like solving problems and going down a rabbit hole of like there's this vulnerability? Well, why is it exist? How is it exploitable? And this is like solving kind of reverse engineering things. And I've kind of always been a tinkerer too, like ripping radios apart. How do they work? And how does everything work is the question I ask about everything. And it's kept me curious. And I think being curious is really important as a person. But I think also that just kind of led to running product security at this business at SK, but then or SK Solidine, but then saying, Hey, there's a new wave of algorithmic requirements coming and you have to adopt them. And you have to adopt them at a large scale. And I was like, this is gonna be a fun challenge. So I kind of, you know, have always been interested in in cryptography, but then also having this massive opportunity at that business to be able to kind of how do we adopt this at scale? And how do we adopt this also live? It's not like we can sit in a lab and RD for five years. Like we have to keep moving things, the business to keep making money. Right. But how do we adopt this in like a live op scenario to where We're not changing too much of the current infrastructure. We're adding the ability to be able to use these algorithms. So I think it just kind of, I don't know how I landed in this, like, I think it just kind of maybe I just manifested it in my life to be this thing. But I think the ultimate thing was I was like, now I have this problem to solve, problem or challenge. And I've all I always just I'm kind of obsessed with always being challenged. And maybe it's like I said, maybe it's masochistic as when you relax, I don't know if I know how. I just like to solve problems. I can't help it. So that was a really cool and humbling opportunity to be able to solve a problem. so it kind of led me here. I And then I want to say, yeah. so I was gonna say I want to say one more thing about that is I also realized during that journey, that's what kind of brought me to think about Q Foundry. It's like there's a huge gap in understanding how to adopt this stuff. Because like I said, there's so many different, it's not just go buy a fertilizer at the store and it fixes everything, the grass is all. There's so many different niches and use cases and sectors and industries. And also when you start talking about public sector, it's more delicate now. And there's just so many different. So I was like, there's gonna be people. I mean, the NSAC and SA 2.0 is saying we have to adopt these things, and it has different waves of technology by different timelines. Yeah. but I'm like, Does everybody like not only that, like the people have the talent? Now big companies like Microsoft, they probably can hire. They have big, big teams that probably are in the forefront of this stuff, but some maybe there's a smaller defense contractor, may not have the the skills or the talent to adopt this stuff. Maybe it's a company that just needs some advice to advise their own people. it's just the gap of understanding the adoption process of this is what really inspired me. Cause I said, How are people? And I was like, I feel like I have a really good grip on how to do this now. And how to transcend that to any sector industry. So that's what inspired me to build what I built. Because I I like helping people and solving problems at the same time. But also, this is a really important transition, not only for our country, but just the world in general. because I feel like if we don't do it and there will be companies that are left behind that don't take it seriously and there will be impact, but we can only educate as much as we possibly can. And then taking action is up to the people, the business, public sector, et cetera.
speaker-0: While we are at it, can you actually talk about this once in a generational moment and why preparing for the post quantum era is so important
speaker-1: Yeah, I think I think like I was saying earlier, I think we're on this very I mean once in my lifetime kind of thing that we are shifting away from algorithms that are still mathematical in nature, but we're shifting to more advanced mathematical algorithms because they have the ability, at least are n are thought to be resistant to a quantum computer that is mature, right? running shores algorithm, for example. And the thing is, is like, if this is proven to be true when we have a mature quantum computer that we can run SHORE's and actually test our theory or case on, anything that's running ECC or RSA is vulnerable like immediately. And the other problem is like obviously there's tons of data breaches all the time. Unfortunately, this still happens. It's probably going to happen to the end of time because just there's Nuts that's something I learned about security too, is you some people obsess and never sleep and think about their job and secure security, but it's like you can only do so much. And you keep you can't cover every single hole, you can't prevent everything. So there's always gonna be these kind of things. The problem is, is someone may there's been a lot of cases, that's why harvest now decrypt later is kind of a thing, is because there's a lot of encrypted blobs of data that people have stolen.
speaker-0: Thank you.
speaker-1: Adversaries, whatever, and it it might be it's encrypted. But if it's like, okay, there's gonna these unless they have some special algorithm we don't know about, they're probably encrypted with ECC or RSA to an extent to some way. And if if like cloud as a service is now when cloud computing was early, it wasn't, but now it's like, you can use almost any resource as a service. When quantum becomes more available, we're like hopefully there's regulations and controls around this, but like if it becomes almost like AWS or GCP where you can just Rent a quantum computer to run an an input, and you can run shores, like that's gonna be a weapon to an adversary. And like they could take all this harvested data they've had for 20, 30 years. It could have state secrets, it could be anything in the in the public sector sense, or it could have private company secrets, it could be you know, trade secrets, whatever. If they can decrypt all this data, then it it's it's talk a cyber war. Like it could be very bad. So it's like we can't again. We can't fix everything, but because of this revelation and because of what's happening in the cryptographic space, we need to at least try our best, which is we need to move to these more advancement macro algorithms that have been developed and are known or thought to be resistant to a quantum computer. Because the traditional ones, at least according to Schrock's algorithm, are basically obsolete the moment that we can run it efficiently. And it's That's kind of scary because like I said, this is a once-on-time opportunity where it's like, or not opportunity, but moment where all everything is really encrypted with something. And a lot of it's these old algorithms. And it's like if they're all now vulnerable, you're saying everything in the world is now vulnerable. Like, yeah. And so that's why I think it's really important to say we don't know the effects of we we have, you know, theories and we've done tests and things, but at least if we can move to these more resistant algorithms, we have a better chance. Then at some point, you know, the quantum computer will likely be advanced to then break those. So then we have to look at QKD, right? How do we use quantum key distribution only? We're not using any kind of mathematical algorithms. We're using, you know, pure quantum mechanics at this point. but it's just it's important because it's not common that we have this collapse in digital trust to where everything that's encrypted, period, is using an algorithm that's now vulnerable. That's never been a thing, at least in my lifetime. So it's really important that we look to what does it take to get us to migrating these things? And like I said, it's a it's a big ask because every company is so different. People have different crypto stacks in their businesses. And so that's why I said, man, there needs to be someone that can help guide and help people adopt this. And that's why I started Q Foundry because I like I don't I saw a gap. That's why I say to any young person too, like, if you feel inspired. And you see a gap in something that you feel like you could fix, go build it. And if you fail, so be it. But go try. You have to try. And so that's kind of what I did. I said, I have to build this because I I feel it here. I have to build it, but also there's a gap. And I feel like people a lot of it may be education. It's like, why is this important? It's like, okay, well, let's start with educating you. But again, we can only do so much. We can start educating people. Why it's so important.
speaker-0: Yeah, it's just one part, right? But what do they do after awareness? And the which is something we observe as well in the c ecosystem building in states or nationally, is education is just step one, t teaching them what they don't know. But then what do they do with that information? Are they going to be quick enough to adopt this into their organization or are they going to wait like one more year, which in that case, It's going to be disastrous and I just think as we are speaking, the standards are developing and people are adopting, people who are going to lead this race are going to be the ones calling shots, right? So on the other end of the spectrum, what do you think if people don't move with this? If the organizations don't adopt this, what is the worst case scenario?
speaker-1: I mean, I think again, what we understand or perceive to be the case based on the algorith the classical algorithms like RSA and EC today, based on what we believe and know so far, at least in theory, because we again we haven't, at least I don't have access to a quantum computer that can run shores and test this exactly. But if it if it all proves to be exactly how we theorized it, I mean anything with ECC or RSA is obsolete. And someone that has access. To any kind of encrypted data or back ends, like there's a lot of like I think it's also really good to know, like a lot of people, maybe not understand a lot of these people that do breaches and hacks and things like that, a lot of them they've had they have access for a long time. They just kind of sit in in in hibernation and wait for the right time. They had access. So if they can sit in the back end and and just steal behind for a long time, that that's kind of the thing. So that's I I'm saying I think like the worst case to me is. I mean, it's just like I I I preached this internally, you know, when I was solid MSK. It's like we have to protect these private keys with our lives. Like, not really, but like in a way, it's that serious. It's crown jewel. Like, if these keys are leaked, the company could just shut the doors. Because you literally now someone can impersonate sign all your firmware. It's like very dangerous, right? Because so I think I'm kind of rambling on, but I think worst case, I mean. Everything is vulnerable. Think about HR find everything, personal data, socials. That's just like the PII. I'm talking about trade secrets, like anything that is encrypted with these algorithms. If again our theories are correct, and you know how Shores works and how it can actually attack these algorithms and break them, it's all vulnerable. And like I I I've had conversations like, you know, we when we were QD QEDC last year. W with certain officials and people saying, Hey, it's very scary, especially on the public sector side, if that is not something that's taken seriously. Just because of the implications. Like war doesn't always have to be on the ground. Like this could be a massive cyber war and a problem, and it'd be scary. So again, this is all if our theories are proven correct and shores can do these things and I'm in sure corner, Peter, but regardless, we should take it seriously. I mean The NSA didn't release the NSA two point with the detail they did for fun. Like they're they have information and data to build a document like that to say this is important to do now. And here's your transition timelines. And so yeah.
speaker-0: Okay, so the data-wise, in my opinion, the military, national security-related data and the health data that you pointed out to PIIs are kind of the most critical if if I was given a choice, the first to protect. is there anything else that you would rank above it or on par with it that I'm missing here?
speaker-1: I mean, that's a good question. I think I mean even thinking about like he this is something that's a little bit niche, but it's more of a national security thing. Let's say there's a lot of data I mean, around like let's just say a big city, like traffic systems, like light patterns, how things move, how traffic flows, like that could be a threat to our country Like if someone understands how traffic systems work. Like that could be data on like how are these things moving? Like how are when does this thing like all these or for like, you know, water systems, how does the dam work? Like all these little like niche things or water supply. How does it actually twin? When does this happen? When's so I think just data on key critical manufacturing systems as well, like or even like traffic systems or like that kind of data can be exploited as opposed to like if you steal health data, you have health data here it is in front of you. But if you have data on traffic systems for a massive city, how they work and lights and things like that and timings, that might just be to the normal person, it may just be like, that's just a bunch of dumb data, but the right person could exploit that and potentially commit an act of terrorism with that kind of data. And that's very dangerous. So I think like any kind of like I guess data that has any almost I I don't know, almost There's some things that may not be the end of the world. Like, no offense to a private sector company, but if a big wig salary leaks, okay. Probably don't want people to know, but like, okay, but like if a trade secret leaks, like how is Coca-Cola made? Like that's probably a problem. If it's not as critical as national security, but it's still a problem for a company because it potentially caused massive losses and public companies, which shareholders would be very happy. That's just bad for the financial markets in general. So there's a lot of things. I mean, I could go on and on about that, but yeah, I think like there's a lot of different aspects of that. Absolutely.
speaker-0: Thanks for bringing all those things out because this is exactly where I look at it. Is not the most obvious critical data. it is as simple as air traffic control. could be shutting down the entire nation. you know in a heartbeat, including like chemical manufacturing. I I come from that background. I I look at what are the implications. most of the chemical plants are now obviously digitized, but there are AI agents now manufacturing next pharmaceutical And if you just alter some of these compositions or basically alter the recipes of a pharmaceutical itself, like a vaccine that could be producing something not intended for a mass administration like we did for COVID. So there are so many implications if not properly thought out. I'm actually worried, which is why I bring experts like you to reinforce post-quantum and the quantum readiness both equally you mentioned Bruce the NIST lays out these standards now are they looking five years into the future like I know how do organizations ad adapt and adopt do they work with NIST to come up with some of these standards did you have any prior experience coming up with standards for federal government? only things that you can talk about, by the way.
speaker-1: Yeah, what I can say is I think especially, you know, if let's just say an algorithm standard is being developed, like when PQC was being standardized, there was drafts and drafts and you know, a lot of bigger companies, even smaller companies, you there's if you have an issue with how something's implemented or I have an issue with this standardization because I can't do ABC if this is a restriction we need to work on. So there is actually a lot of miscollaboration with private sector as well. Which think is really good. So I think a lot of these, especially the PKC standard, it took some time to get out of draft phase to a final standardization. But I think there was a lot of collaboration with private about because I remember specifically I can't talk about all the details, but at SK Solidime, there were specific niche issues that we had to work through with the standards based on how we we built things. So it's like we there it there is a lot of like feedback. You know, you can work with NIST on. Hey, this is like might not work for us. And so there is a lot of community driven back to those standards as well. So I think that's a good thing. But I also think, you know, because they're interagency, they can work with lot of other people, like internally at the federal government and say, because like I said, the NSAC and S82.0 didn't come out of thin air. Like, there's a reason. Well, well, that data is obviously very secret and proprietary where it came from, but like there's a reason why they gave the dates and developed what they did. And that's good because they're looking to the future. So I do think These algorithms weren't they are a stopgap to quantum cryptography, I think, but I think that they're a pretty healthy one in terms of timeline. And I think, hey, it's better than just keeping RSA and E C around saying, screw it, guys, just stay on this and we'll just hope and pray that sure doesn't work the way we think it does or whatever, right? so I I do think that, you know, there is a lot of great collaboration there with NIST and private, especially. I'm sure there's a lot of good public to public collaboration internally there as well. But You know, if there is issues like, hey, we can't implement this this way because it may not work ABC. There's a lot of cause there's lot of very specific algorithmic features. Like for example, MLDSA eighty seven or MLDSA in general, that suite has also different types of algorithmic features. And some algorithms don't work the same as others. And so yeah, I would I would say at least what I've seen, there's been a lot of great collaboration. but I do think those algorithms are being developed and standards being developed based on the future. I do think they're looking at, you know, as far out as math advanced mathematics can actually protect us from in terms of encryption. I think they're doing their best to look in that direction, especially looking internally interagency to say, Hey, where are you guys seeing and how do we kind of align with you as well?
speaker-0: Sure. So let's switch gears to now that we laid the ground for people who actually never heard of PQC. what is PQC? and how do you explain that to somebody with no technical background?
speaker-1: Well, yeah. So basically, just like RSA and ECC, PQC, and that's the thing because I think it's kind of confusing because people say post quantum cryptography. Doesn't that mean after quantum cryptography? But it the name refers to the era, not the technology. So it's referring to, hey, after a post qu after a post quantum age, where we have mature quantum computers, what can help protect us leading up to this as well? Right. So That's at least a little bit because it was confusing me at first. It's like, why is it post quantum? And it's it's more of like the era. so how how do we protect ourselves from the coming era, like the post quantum era? Because I so yeah. So yeah, so PQC is just it is still mathematical algorithms, but they're more advanced math. so all the way to the point that like There is like a sense where I can imagine in a hardware situation, you might need to work with new manufacturers that can even support this type of because it's advanced math on a chip. How do you you have people that can support that kind of thing? So there is definitely a change that's needed. It's not just, but it's this is my really technical way trying to describe something simple and it's not working out so well. but it's bait it's still mathematical algorithms, it's just more advanced. It's using advanced math and it's more complex. So it makes it at least thought to be harder for a quantum computer to solve easy. But again, it's all theory because have we tested it? Not really. so yeah, and I guess explaining PQC to someone with non-technical background. So my example was you know, imagining there's all these digital locks that protect your bank accounts, messages in your phone. And They're about to, there's about to be this era shift where there's a new technology that is just a universal master key to basically unlock all those locks are now basically obsolete. You can just get a hammer and bust it off. So what post quantum cryptography like I guess looks and aims to solve is how do we replace globally all these digital padlocks with a a new design that the master key or How do we replace these padlocks with a new design that this master key, this universal master key that's being built, can't easily just open? So it basically is, I guess the simple way to say it is all these things there that are known to be secure, don't really have locks that are worth anything anymore. It's like putting a door in a lock, but then like the frame is just there, you walk around the door. It doesn't really matter. You can still get around. So Just imagine everything that has some sort of layer of encryption or security having a master key that can just basically make it obsolete. And so we're trying to find a way to replace all those locks with better locks that are more advanced that the master key maybe won't be able to open as easily or at all.
speaker-0: And and there is also a misconception I would like for you to clear it up for our audiences is Is the understanding that these algorithms need to be done also on a quantum computer. But you can actually start adopting these algorithms, using a classical computer, right? So can you explain a little bit more on how what you hear about this and how you can clear that misconception and how adoption can take place starting now?
speaker-1: Yeah, I think the first step is if you're looking to you, you know, you may not even know. That's the thing, the education piece, like you may not even know you need to adopt these things. But if you have an idea of, my gosh, we have a crypto stack that needs to be adopted into more of a PQC or wastely wipe over PQC so we can not be vulnerable. yeah, these so a lot of it starts with, you know, let's just say I'll use the hardware manufacturing case because it's a little bit It's nothing private. This is all like pretty well known. In this case, you have keys, for example, right? Let's say device ID keys that live on an actual drive. So you have billions or millions of drives that go out the door in that factory. But there's gonna be keys that live on all those drives. the private key, right? So but or the public key. So it's like that the other key, or I'll explain this. so those the private keys have to live somewhere safe. But and these are post-quantum cryptographic keys. They're still, again, these are still classical. There's still classical computers involved. It's not anything to do with quantum computers at all, actually. so in this case, those keys have to live on what you'd call a hardware security module, right? Like a device. So there's lots of vendors, Talus, Fortanix, a lot of good vendors out there that have these devices for and they they they build, they've been building these for years. So but there's You know, that's one way is if for at least the key storage side is you have vendors like that that support these newer algorithms. but that's nothing to do with quantum at all in this case, quantum computers at least, that are needed in this case. but again, everything really depends on the type of adoption you're looking at. there are keys have to live somewhere and they have to live somewhere safely. So when it comes to like having one in a hardware security module. you just have to have a vendor that can support these algorithms that can generate keys with these algorithms, which requires, you know, newer hardware that can do this advanced mathematics and things like that. But all of it is still classical.
speaker-0: in future adversaries are using to decrypt this data using a quantum computer, but at the same time, we are prepping for that future using a classical computer. Do you see a a combination of a quantum computer with these classical algorithms? to combat this more efficiently? Like is there a spot for quantum computer working against quantum computer in future is my question.
speaker-1: I mean, I I think so, because I I think the quantum computers that we have today, as as you know as well, a lot of it is this duality where when the quantum computer gets an input, it decides, do I need to give this instruction to a quantum computer or a classical computer? Because I think a lot of the misconception about quantum computers as well is that classical computers are now obsolete. It's like no classical computers still do th some things way better than quantum computers do at this time. So the qu a quantum computer is actually a hybrid. It it has an instruction where it says what is better for class computer to do and what's better for quantum computer to do. And it kind of splits these instructions and they go do the thing and at the end of the end of the end of the line they merge and say, Here's your output. So I do think there's a world where a quantum computer can assist in combating against adversaries in this way because quantum computers still use classical. I mean, just like the quantum two we learned about last year, QDC. It's like It takes an input that says, okay, are you better for quantum computing or are you better for classical? I can solve, okay, so I'll break this apart and you can you quantum is you know, you can this is more of a quantum-based equation you solve. This is more classical. And let's meet at the end when we're done solving our problems and give somebody an output. So I think that cla that's the misconception, I think, as well as, well, quantum computers come, class computers are worthless. Like, no, I don't think so. I think that they'll still be a vital integral part of even quantum computing because of. what they can at least as of now do better in some cases in quantum computers. So I think they're always gonna work together. Even though it's a quantum computer, there's still a classical piece of it, especially when it comes to solving issues or solving problems. At least how they're built today.
speaker-0: Great. So moving on to the next question on I know we talked about this, but if you can explain a little bit more, On what is harvest now and decrypt later?
speaker-1: So yeah, so I was yeah, I was touching on that earlier. So basically it's a good example of this. There's been a I can't think of a breach off the top of my head right now, but there's a lot of times where an attacker can they may breach a business or government, unfortunately, and there may be data they gather that maybe is just encrypted blobs and they don't really even know what it is. It's just a ton of data that's encrypted. And The harvest and decrypti later means they harvest it. So they they may have a breach and they may say, we can get all this data if I'm an attacker. I can get some of it is decrypted, some of it's not. and so they could take who knows, terabytes, terabytes of data that is just encrypted, and they have no idea what it is because it's just a blob of nothing, because they don't know what it is because they can't decrypt it right now. So they'll steal all that data, they'll go throw it in some cold storage and some data center, some weird place, another country in the mountains or wherever. And they're just saying, hey, at some point. The encryption that this is using to protect this data will be obsolete. But the data inside the encrypted blob might not be obsolete. If it's a state secret, that might be kind of a forever piece of information, right? That's why it's so dangerous, is because, you know, again, if it's a CEO's salary, okay, that's No offense, that to me is not a national security threat. That's not good. It's bad press. But but the thing is, is a lot of this data could be, if it's stolen, again, I can't think of a breach of top of my head. But you steal a bunch of encrypted data, you say, hey, like at some point, these these encrypted the the algorithms that are encrypting this data will be obsolete in terms of there won't be hard to break. So if I harvest all this data now, I'll just sit on it and wait until. The moment comes where I can decrypt this data, whether it's like I have access to a quantum computer or one as a service, and I can dec start decrypting this data. And who knows what's gonna be in there? Again, if it's that's the danger in it. If it's state secrets or something like that, it's very dangerous because that stuff is persistent data. It's not like, you know, it could be something that happened or something going on. It's a huge risk, national security in general. Like if I'm looking at the public sector side, but I mean, even if it the private sector example, if someone broke into an entertainment business and stole a bunch of like trade secrets or how they do things or how they maybe it's a VFX pipeline, they have an efficient way of, you know, rendering VFX for a film and it's like a proprietary thing they built. That's still a problem because while it might not cause a war, it could cause a lot of economic disruption. and so that's kind of essentially what it is. It's taking something that is encrypted now. with some algorithm that's a cli like ECC or RSA and saying, Hey, I know I can't do much with this data because it's basically worthless right now. But at some point, if I can decrypt it, who knows what will be inside of it. And that's the problem is the data is the data might be something that's a persistent thing. It might not just be, you know, a salary. It could be a state secret. So it's a problem.
speaker-0: So right now all the data as you are saying is vulnerable, right? It's probably harveste already. this goes back to one of the I'm an adjunct here in a local Utah University where in we had set several students actually ask this question about and they are cybersecurity students. How to how to think about intellectual property protection in post quantum era do you have any guidelines on that, Bruce?
speaker-1: I mean, I think i i I'd say all data is kind of the way I look at it. I mean, there's certain data you want to maybe treat differently in terms of your recovery plans or where it's stored and how it's encrypted. But I'd say IP in general. I mean, you just need to look at the bleeding edge of how can we encrypt things now. And it post quantum era is here in terms of the cryptographic side. There's standard algorithms you can use today. So I'd say if there's anything that's coming out of today that you can encrypt, try to use an algorithm. that's more resistant, like the post-quantum suite from NIST. I I think and again, this is where the this is why the adoption challenges come in, because sometimes, for example, like with this is a newer technology, like there's been issues where well I have this new algorithm, but I can't decrypt it fast enough in mass because of the speed. So there's all these little things you have consider, but in terms of just purely protecting a piece of information. I think you should look to utilizing post-quantum algorithms for encrypting anything. And I again, sometimes you're kind of at the mercy of, we use a vendor like SAP or we use a vendor for storing this. How do we know? It's like, well, you have to work with that vendor and say, hey, like how are you encrypting this data right now? Like so that's it, but if you have full autonomy of the data in your own storage devices and you still might have a vendor though, cause somebody produces the hard drive that the data's on. Somebody produces maybe the storage appliance. So that's the other gap is like there's all these vendors that have to there and a lot of these vendors I've talked to, especially across the board and different industries, they're they're they kind of have to move to this because not only they don't want to be liable later, but they don't want to be vulnerable. But I'd say if you're encrypting anything right now, look at, you know, trying to use a post quantum suite from NIST. And again, that how you use that is gonna depend on what kind of data it is, how is it stored, where is it stored, using a vendor, or using cloud service, a lot of different variants. This is why the adoption side is not just a one size fits all. And that's why, like I said, I felt like somebody had to do it.
speaker-0: Yeah, it has to be custom made for the organization or the entity, big or small, right? Including the data centers, I'm assuming. handle quite a bit of data. Now, is there we we do have quantum computers right now at some kind of logical qubits and physical qubits, so moderately operating quantum computers. is there any data that could be decrypted using those do you discuss about this in your circles or i it's not a chance right now?
speaker-1: I actually don't know. I actually don't know if there's a quantum computer that can efficiently run shores and try to break RSA. I don't even at a small scale. I don't even I'm actually not sure if we've done it. Maybe we have. But I think if we've have, I'd hear more noise about it. But yes. I think it's still theoretics, but someone that knows a lot more about this that that specifically can correct me if I'm wrong. but I don't think as of right now. This day we have one that can efficiently run shore stably to actually decrypt. But I maybe someone's running these tests, but not that I know of. But again, somebody out there that knows a lot more than me about this could potentially share any additional information that but not that I know of. I don't think we're far away. Yeah.
speaker-0: Great. That could be far away. There is our next speaker, and we would love to bring you back just to be like on a panel to ask some of these questions. to have a juxtaposition of the post quantum and quantum folks. but also there there are some publications over the last one year. from China. But again, the validity and credibility is yet to be ratified by somebody who is a subject matter in the field, right? so any any other career paths advice for the students K through twelve but also I would like you to comment on adoption strategies a high level or a recommendation on a high level for enterprises and entities that can be offered.
speaker-1: Yeah, I think the first the first point of the question was any additional advice. I think like if you really feel passionate about something and you see a gap, even if I get that, like, you know, a lot usually especially when you're young, you can't easily leave a full-time job and just go pursue something on your own. Like usually takes a little bit of time in your career to build up some savings and some time and things like that. But if you have an idea and you're passionate about you see a gap, build it after work. Like Start thinking about it. don't be afraid to fail because like I failed so many times in my career, but failing is how you learn things. And you can't be afraid to make mistakes. I mean, obviously you don't make very bad big mistakes, but you can make you know, don't be afraid to make mistakes and stumble a little bit when you're trying to think about things. But if you have an idea and you feel and that's the thing, don't get in your head about it about I don't know if this is gonna work. Who cares? Try it, do it, give it a shot. If you see a gap, try to You know, fill it with something. Again, even if it's like on the side, you build something on the side, test it out, spend time. I said it's one thing is don't be afraid. Cause sometimes certain societal perceptions will make you think like maybe in your head, if you've shared anybody with your idea, they may make you think that your idea is not viable. Just ignore it. Just go do it. And again, easier said than done, but maybe start small. but just don't be afraid to do something and try something. Like if you feel something and you see a gap and you can actually solve a problem, maybe go try to solve it. I'd say for the second piece in terms of where do you start with adoption, I would say the number one thing before anything is you need to understand the landscape of your crypto stack. Do an inventory. There's a lot of good tools out there that can do it for you, but you need to understand What's your crypto stack look like? What what does it contain? Is it all TLS? Is it TLS? And there's some other things. Like, what is your crypto stack look like in your business? And do an inventory of your crypto stack. And then you can say, here's an inventory. And I can say, okay, I have 50,000 certs, for example. in this case, what are they all? Are they all ECC or are they all RSA? Like then. You have to have an inventory first. Like so starting with an inventory of what your cryp crypto landscape even looks like in the business is the first step. Because then until you have an inventory of what the landscape actually is that you need to adopt and shift over and migrate over to, because that you're not really gonna have it's gonna be kind of a messy thing, right? So I think the first step is building a crypto inventory in your business and understanding landscape of what you have. And then at that point, you know, okay, so Then you can start building out like phases of I need to work on adopting my TLS stack first. Okay, what does it like? Are we using vendors? Do they support this? There's just so many questions, but having a crypto inventory is the most important thing. Understanding the landscape of what you have now. So that's the that's the, I guess the if I could leave one piece of advice is start working on building a crypto inventory of all the things that are, you know, in your business.
speaker-0: Great. Any last few thoughts, Bruce, before we close the conversation?
speaker-1: just I don't know, just if you feel like I said earlier, like if you feel like there's a gap and you wanna solve a problem, just go solve it, even if you have to start small and don't be afraid to do it. Don't let societal norms tell you, that's a dumb idea. Who cares what they think? Like if you think it's a a problem you could solve and you could fill a gap, try it. Great. And just don't listen to people, just focus on what you believe in your heart is the right thing to build. So yeah.
speaker-0: Great. Thank you so much. Thanks for joining us today, Bruce, and for helping demystify such an important topic. As we have learned, post-quantum cryptography isn't just about preparing for the future, it's about taking action today to protect the digital infrastructure we all rely on. To our audience, thank you for joining another episode of Quantum Ecosystem Conversation. I hope today's discussion provided valuable insights into post-quantum cryptography, why it matters, and what organizations can do to begin their quantum safe journey. Thank you for watching and we'll see you next on the Quantum Ecosystem Conversations.
