🟡 Medium | Source: The Hacker News
Quantum computers, whilst not yet capable of breaking today’s encryption, are advancing rapidly enough that data and credentials captured now could be decrypted in the future — a threat known as ‘harvest now, decrypt later’. Post-quantum cryptography (PQC) standards are emerging to address this, and credentials represent the highest-priority migration target due to their long-term sensitivity. Organisations that delay PQC adoption risk exposing critical authentication material retroactively.
Security Architect’s Take: Begin a cryptographic inventory now, prioritising credential stores, identity tokens, and certificate authorities — these are the highest-value targets for harvest-now-decrypt-later attacks. Evaluate NIST’s finalised PQC algorithms (ML-KEM, ML-DSA) for integration into your IAM and PKI pipelines, and engage your cloud providers on their PQC roadmaps for managed key services such as AWS KMS, Azure Key Vault, and GCP Cloud KMS.
Original advisory: Why Post-Quantum Cryptography Starts With Credentials