Bản chép lời đầy đủ của Post-Quantum Shipped — Two-Thirds of the Web Is Already Quantum-Safe

WEBVTT 00:00:02.730 --> 00:00:05.730 Two months ago we told you post quantum crypto 00:00:05.730 --> 00:00:08.589 was coming that Cisco's August release and a 00:00:08.589 --> 00:00:10.849 wave of vendors would make the migration real 00:00:10.849 --> 00:00:14.269 So did it happen? Here's the number that answers 00:00:14.269 --> 00:00:17.730 it as of this spring More than two -thirds of 00:00:17.730 --> 00:00:20.410 human web traffic to cloudflare is already post 00:00:20.410 --> 00:00:24.269 quantum encrypted not planned not piloted Encrypted 00:00:24.269 --> 00:00:28.089 today by default the migration didn't just get 00:00:28.089 --> 00:00:31.449 real it became the default on the majority of 00:00:31.449 --> 00:00:34.899 the web This is tech updates. Here's how that 00:00:34.899 --> 00:00:37.500 happened so fast and it's almost invisible. Your 00:00:37.500 --> 00:00:40.820 browser did it for you. Chrome, Edge, and Firefox 00:00:40.820 --> 00:00:44.420 quietly switched their TLS handshakes to a hybrid 00:00:44.420 --> 00:00:48.039 key exchange. Classical crypto plus ML chem, 00:00:48.520 --> 00:00:51.200 the new post quantum standard starting in late 00:00:51.200 --> 00:00:54.460 2024. Every time you load a modern website over 00:00:54.460 --> 00:00:56.539 one of the big edge networks, you're already 00:00:56.539 --> 00:01:00.320 using it. A year ago, it was a minority of connections. 00:01:00.590 --> 00:01:04.090 Today, it's the majority. The most consequential 00:01:04.090 --> 00:01:06.409 crypto upgrade in decades shipped as a browser 00:01:06.409 --> 00:01:09.109 update most people never noticed. So did our 00:01:09.109 --> 00:01:13.629 June prediction hold? Mostly, yes. We said, Cisco 00:01:13.629 --> 00:01:17.810 would put post -quantum crypto into IOS XE. They 00:01:17.810 --> 00:01:20.629 did. Their switch software already ships full 00:01:20.629 --> 00:01:23.370 stack post quantum, secure boot, image signing, 00:01:23.909 --> 00:01:27.150 and IPsec VPN key exchange, all quantum safe. 00:01:27.790 --> 00:01:30.969 The August release extends it across the SD -WAN 00:01:30.969 --> 00:01:34.030 overlay and adds hardware acceleration, though 00:01:34.030 --> 00:01:37.129 those pieces are rolling out rather than confirmed 00:01:37.129 --> 00:01:40.109 live. And the quantum ready assessments we mentioned, 00:01:40.530 --> 00:01:43.010 the tool that scans your network for harvest 00:01:43.010 --> 00:01:46.629 now decrypt later exposure, went live in July 00:01:46.629 --> 00:01:50.459 as planned. The vendor promises landed. But it's 00:01:50.459 --> 00:01:53.680 not just Cisco. And that's the real story. Apple's 00:01:53.680 --> 00:01:56.299 iMessage has used post -quantum encryption since 00:01:56.299 --> 00:02:00.599 2024. AWS added it to Secrets Manager in April. 00:02:01.099 --> 00:02:03.420 Microsoft shipped the algorithms into Windows. 00:02:04.099 --> 00:02:08.020 OpenSSL and OpenSSH have it built in. The standards 00:02:08.020 --> 00:02:11.099 body NIST finalized the algorithms two years 00:02:11.099 --> 00:02:14.080 ago, and now the entire ecosystem has shipped. 00:02:14.669 --> 00:02:17.530 post -quantum crypto stopped being an availability 00:02:17.530 --> 00:02:20.629 problem. It's a deployment problem now. The code 00:02:20.629 --> 00:02:23.050 exists everywhere, and the only question is whether 00:02:23.050 --> 00:02:25.689 you've turned it on. One stat before we move 00:02:25.689 --> 00:02:28.650 on, and it's the one that moved the whole timeline. 00:02:28.789 --> 00:02:30.949 To break the encryption protecting your data 00:02:30.949 --> 00:02:33.789 today, a quantum computer needs a certain number 00:02:33.789 --> 00:02:37.349 of qubits. In 2019, the estimate was 20 million. 00:02:37.810 --> 00:02:41.110 In May of 2025, Google researchers cut it to 00:02:41.110 --> 00:02:45.120 under 1 million. In February of 2026, another 00:02:45.120 --> 00:02:48.240 team cut it to under 100 ,000. From 20 million 00:02:48.240 --> 00:02:51.280 to 100 ,000 in about a year. Nobody has that 00:02:51.280 --> 00:02:54.639 machine yet. But the target got 200 times easier 00:02:54.639 --> 00:02:57.360 to hit. And that's why everyone suddenly started 00:02:57.360 --> 00:03:00.240 shipping. And here's what turns a good idea into 00:03:00.240 --> 00:03:03.539 you have no choice. On June 22nd, the White House 00:03:03.539 --> 00:03:06.879 signed an executive order, 14 -4 -12, setting 00:03:06.879 --> 00:03:10.300 hard federal deadlines. High -value systems must 00:03:10.300 --> 00:03:12.800 move to post -quantum key exchange by the end 00:03:12.800 --> 00:03:17.719 of 2030, authentication by 2031. NIST's guidance 00:03:17.719 --> 00:03:22.719 deprecates RSA and ECC after 2030 and disallows 00:03:22.719 --> 00:03:26.240 them entirely by 2035. This isn't a white paper 00:03:26.240 --> 00:03:29.479 anymore. It's law with dates on it. If you're 00:03:29.479 --> 00:03:31.939 studying for Security Plus or the new SecurityX 00:03:31.939 --> 00:03:35.560 exam, here's exactly where this lands. The crypto 00:03:35.560 --> 00:03:38.039 you're learning isn't being replaced. the key 00:03:38.039 --> 00:03:42.039 exchange inside it is. Your IPsec VPNs, your 00:03:42.039 --> 00:03:45.800 TLS handshakes, your PKI, your SSH, all of them 00:03:45.800 --> 00:03:48.729 are being upgraded to hybrid MLChem. Know the 00:03:48.729 --> 00:03:53.469 players RSA and ECC are the vulnerable ones MLChem 00:03:53.469 --> 00:03:59.389 MLDSA and SLHDSA are the NIST replacements and 00:03:59.389 --> 00:04:01.810 the one concept that ties it together is crypto 00:04:01.810 --> 00:04:04.669 agility building systems So you can swap the 00:04:04.669 --> 00:04:08.210 algorithm with a config change not a forklift 00:04:08.210 --> 00:04:12.020 upgrade. So here's the close two years ago The 00:04:12.020 --> 00:04:14.860 cryptographers handed us the cure. This year 00:04:14.860 --> 00:04:17.240 the vendors shipped it, and the majority of the 00:04:17.240 --> 00:04:20.160 web already runs on it. Q Day might be 2030, 00:04:20.500 --> 00:04:23.439 it might be later. But Harvest Now Decrypt Later 00:04:23.439 --> 00:04:25.920 means the data you send this afternoon is already 00:04:25.920 --> 00:04:28.339 being recorded. The migration is no longer the 00:04:28.339 --> 00:04:31.180 hard part. Turning it on before the disease arrives, 00:04:31.720 --> 00:04:34.889 that's the only job left. That's the show. If 00:04:34.889 --> 00:04:37.490 this made you check whether your VPN is quantum 00:04:37.490 --> 00:04:40.970 safe yet, good. Go ask your vendor. We're back 00:04:40.970 --> 00:04:43.509 next week with more tech updates. Stay sharp.