Quantum-Resistant Security: PQC Readiness and Research Challenges (Invited)

What is your PQC-readiness” - in this paper, we have explored this problem, some of the key challenges to address it and how ciphersuite dependency graphs alongwith observability plays a vital role in addressing some of those challenges. Quantum computing capabilities are evolving fast and on course to develop a cryptographically relevant quantum computer (CRQC). With that several widely used classical cryptography protocols such as RSA are poised to be broken in the next few years. NIST has announced three cryptography protocols as part of the first batch of post-quantum cryptography standards. However, implementation and adoption of quantum-resistant cryptography is a hard problem given the complexities of today’s internet and computing stack. Our work has led to development of algorithms and a system Quartz (Quantum Risk and Threat Analyzer) for observability for quantum vulnerabilities for cryptography suites, where they are used, and analyzing their risks. In that context, we used observability, and the concept of ciphersuite dependency graphs in order to determine use of quantum-unsafe cryptography, and its influence on cryptography supply chain, and generation of cryptography bill of materials (CBOM).