Preparing for Q-Day

0:00Most of the cryptography securing the internet today rests on mathematical problems that classical computers cannot solve in any reasonable time frame. That assumption is now being tested. Recent advances in quantum computing have dramatically compressed timelines, and many in the industry have set a target of full post-quantum security by 2029, meaning a complete migration to algorithms designed to remain secure against quantum attacks. Boss Vesterbon is a cryptography engineer at Cloudflare, where he leads the company's efforts to migrate to post-quantum cryptography. In this episode, Boss joins Kevin Ball to discuss how quantum computers threaten public-key cryptography, what post-quantum algorithms actually are and how they work, the timeline shifts that have made quantum readiness feel so urgent, and what software engineers need to do now to prepare their systems.

0:55Kevin Ball, or K-Ball, is the Vice President of Engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript Meetup, and organizes the AI in Action discussion group through Latent Space. Check out the show notes to follow KBall on Twitter or LinkedIn, or visit his website, kball.llc.

1:30Boss, welcome to the show. Hey, Kevin. Nice to be here. Yeah, I'm excited for this topic. This is one that has been suddenly raising my awareness, but I don't know enough about it. So I'm really eager to pick your brain. But let's start with a little bit about you. Can you kind of give us a little bit of your background and how you got to where you are today? It's quite a windy road. I always liked security and cryptography at high school. Decided to go study physics and mathematics because I thought that would be more challenging. Didn't end up being very good at the physics. so I stuck with the mathematics at least I mean the physicists they know how to bend the rules right and I don't know how to do that did mathematics then I did a PhD going back to physics a little bit in the mathematical foundations of quantum computing and the physics kept pulling me but actually I did that at the security group of my university so when I would be avoiding working on my actual thesis I would be spending time with the cryptographers around there so there's the there's people doing post-quantum cryptography there and designs of symmetric cryptography so i kind of learned by osmosis just during the coffee breaks and stuff after that when i did went for postdoc to london london is expensive so i thought maybe i can find an internship or something already some crypto engineering so i via via i ended up with an internship at cloudflare i enjoyed that so much doing crypto engineering there that after covid I got invited to join full-time in the Netherlands back and I've been there ever since.

3:05Leading for the last few years our efforts in migrating to post-quantum cryptography. That's awesome. I actually also started in physics. I studied physics as an undergraduate and got away from it and then like in recent years there's all these things that feel like oh that's suddenly relevant again. There's so much that is becoming interesting. Let's talk a little bit about quantum security, quantum cryptography, and all of this? Because I feel like this is something that most of us as software engineers weren't worried about, hasn't been that big on the radar, maybe if you were in kind of a niche area, and then suddenly it's a big concern.

3:42So maybe start back with like, what are the problems that quantum computers create for cryptography? Yeah, so quantum computers, it's quite an old concept. I think even earlier in the 90s, Richard Feynman, the famous physicist and some other folks proposed that you can use quantum computers to more efficiently simulate nature. So the whole thing about quantum computers is that things are in superposition. So if you want to compute things about them, you have to carry around actually an exponential number of probabilities, which they call amplitudes, which is inefficient. But then they realized if you use quantum mechanics itself, the full power of it to actually do computations instead of just using zeros and ones you can actually compute it more efficiently so that's all well and good the physicist's toy with hopefully amazing applications in material science and stuff but so it was all positive until in 94 peter shore mathematician he figured out that if you have a cognitive computer then you can also efficiently solve factoring and discrete logarithms.

4:46And that's a little bit inconvenient because basically all of our public key cryptography, not all cryptography, but basically all cryptography that's important relies on that today. So if a quantum computer is actually built, doesn't exist yet, but if it's actually built that's big and powerful enough, then most of the cryptography falls away. Yeah, that's really interesting. So I think some of our listeners will be crypto experts, but let's maybe really quickly talk about asymmetric cryptography and how this works and why this ability to factor large numbers suddenly makes this fall away. So you have these two big groups of cryptography, symmetric cryptography, which is AES, Shatou.

5:28That's mostly about jumbling bits, right? Mix things up a bit so that they become unpredictable. That's, in a way, it's a bit of a messy thing, but it's well understood that quantum computers don't touch that. That's still completely fine. Now, the public key cryptography, that's the cryptography where you have a public and a private key. And that requires something mathematical, something magical to make it work. And in the case of elliptic curves, that's discrete logarithms. And in case of RSA, it's using the fact that multiplying numbers is easy, but factoring them is hard. Well, we think it's hard.

6:03It is hard, we think, for normal computers, but for quantum computers, it's pretty easy. And the problem is, if you can solve that problem, if you can do a factor or a number easily, then you can also break the public key and from the public key, the private property. And maybe we should go, what does this actually mean? What's the actual impact, right? Instead of the mathematical bits. And the thing is, so we use cryptography for basically two things, mostly. I mean, for a lot of things, but the two big things are protecting data and protecting access and authenticity. So if you make a connection, you do a TLS handshake, there's what is called a key agreement first.

6:42And after the key agreement, both sides have a shared key, which they then use for bulk encryption using typically AES. So this key agreement today also relies on either elliptic curves of RSA. And if that's broken, then people who recorded the encrypted conversation can retroactively decrypt it and see the data. So that's the famous harvest now, decrypt later. People can record encrypted sessions today. And if they are not protecting using post-quantum cryptography, cryptography designed to be secure against the attack of quantum computers, then they can be decrypted in the future. So that's one.

7:19Yeah. And just to like even put it in broad terms, like that's every connection we have today, especially now everything's using HTTPS. If you're on the web, you're going and logging in to Google, to your bank, to what have you. All of those at the root are doing a TLS handshake, shared key, and encrypting it using AES, which if it's being recorded, which I mean, I live in the United States. I kind of unfortunately assume everything is being recorded at this point. All of that could be replayed and cracked with a quantum computer. Well, luckily, we have made some good... I mean, we've known about this problem for quite a long time, and we've made some good progress.

7:56By default, if you use a modern browser, Chrome or Safari or Firefox, then that already tries to make a connection using post-quantum cryptography that secures it against harvest now decrypt later. So that is good to dig into. So actually, first, what does it mean to be post-quantum cryptography? What is that? Yeah. So post-quantum cryptography is cryptography that is designed or we believe is secure against the attack of quantum computers. So the funny thing is, is this cryptography is typically already quite old. So lattices, which is the front runner. I mean, there are many different types of post-quantum cryptography.

8:29You have hash-based cryptography, lattice-based cryptography, sojourney-based cryptography, multivariate-based cryptography. The one that are really taking, are on the frontier that are being deployed now, is lattice-based cryptography. and we believe that they are secure against the attack of quantum computers. I believe that sounds weird, but I mean, also with classical cryptography tomorrow, we can wake up and someone discovered a classical algorithm to factor numbers quickly. That is possible. Luckily, it hasn't happened, but for the best of our knowledge, we have quite a good confidence in it that lattice-based cryptography is secure against the attack of quantum computers.

9:02And if you use that lattice-based cryptography, then you're secure against this threat. So let's maybe really quickly talk about what that actually is, because I enjoy geeking out on this. So we've talked about the two examples where you've got elliptic curves and computing things there. We're using logarithms. We talked about large number multiplication being easy, but factoring being hard. And those are kind of the two quantum crackable approaches that we have. So what does it mean, lattice-based cryptography? What's the underlying math happening there? Yeah, so what is a lattice? So a simple example of a lattice, a simplified example of it, a toy example of it, is think of a plane.

9:39So a plane with an X, Y grid, and you have two points on the plane. So we start with just two points. And then what we do is we create a grid from those points where each of those points, they think about a parallelogram, and then it just repeats. So if you have such a grid at this point, it's very easy to say what is the smallest point in the grid. that's closest to the origin. That's pretty easy if you give the grid as two points that are neatly orthogonal. So that's what they call a good basis. But you can also give the same grid by giving a point that's very far away, two points that are very far away and close together.

10:18Those two points can also generate the same grid. But that's what's called a bad basis. It's a basis where it's not that clear to see where the actual smallest point in the grid is. a picture is worth here more than a thousand words, but maybe you can add a link to a picture about this. Yeah. I mean, I think conceptually it makes a lot of sense, right? Where if you're imagining this plane, if we're looking at a point that's very close to the origin, you can be very zoomed in. It's able to be very high level of fidelity, high detail. You have two points. Okay. But you're still looking in very good fidelity.

10:52Whereas if it's very far out, conceptually, you're having to zoom way out and it's hard to see any level of detail yes also when they're close together it's really hard to see how will things cancel out if you start adding and subtracting them but actually on the plane you can i mean it's a fun thing to run an algorithm for it if you're living in a spectrum it's actually pretty easy to figure this out in the plane right because that's just two dimensions but it turns out that if you do this in a space that has a thousand dimensions it's not just x and y but a thousand different directions then this becomes computationally very, very hard.

11:25And that's the basis of lattice-based cryptography. So I'm going to use the example of the multiplication and factoring, because that one I understand personally more than I understand the elliptic curve one. In that example, the way that the public and private works is you say, okay, if we know the private, we can do the multiplication route. We just show the end version. We both got to the same thing, but somebody just seeing that end version, they can't factor it. In the lattice, what is the equivalent here? Like, what am I sharing with my counterparty or how do I get to some sort of shared basis for encryption?

11:57So actually, do you know about Diffie-Hellman, the clock things? Only somewhat. Why don't you explain it and then we can go with it. Diffie-Hellman is a classical one. It's based on discrete log where each of us starts with a secret number, A and B. And we do this using modular arithmetic. So it's like time on the clock. I have a secret B, you have a secret K, right? For Cameron and boss. And we both agree on the basis number, let's say two. So I compute two to the B and modulo, I don't know, the big prime number we choose, and you compute two to the K. You send two to the K to me, and I send two to the B to you.

12:33Going from two to the B, figuring out, I mean, if it's normal numbers, it's easy to take a logarithm. If you see two to the B to then see what is B, but if you do this modulo or prime, this is actually hard. This is called the discrete logarithm problem. Well, hard for us now with our puny classical computers, but with a quantum computer, it's easy. Okay, so that's the public key, 2 to the B. My public key, 2 to the K is your public key. Now, you've got my public key, 2 to the B, and what you can do is you can exponentiate in your K. So you can do 2 to the B, 2 to the K, and I can do 2 to the K, and I can exponent in B.

13:14So 2 to the K, 2 to the B. And what we end up with is both of us end up with 2 to the B times K. So we both got the same shared number, which we can use as a secret to then do AES. So this is called Diffie-Hellman. And with lettuces, you kind of do the same, but then with adding a lot of noise. So it's like a noisy version of this. That makes a ton of sense, actually. That's really helpful. So you're each starting with essentially this like small, easy to understand piece. And then you layer it and you end up with this. Okay, this is way out in the world. This is hard to decrypt. My colleague, Chris Patton, he wrote together with Peter Schrauber, one of the designs for the scheme.

13:58He wrote a nice blog post with this analogy, explaining it some more. I really don't do it justice in five minutes, but we can add a link to it. Yeah, we can go and check that out. So if you're looking for it, Google will turn it up, I'm sure. Okay, cool. So that, I think, helps us understand a little bit more about an example of post-quantum cryptography. And so you're saying, essentially, if we're using modern browsers for web traffic, we're pretty much all protected from... That's bad news. Almost. Okay. We're protected against Harvest now decrypt later. That's where I was going to go. Yeah, we're protected against Harvest now decrypt later.

14:32But there was this recent announcement from Google that I think has shifted the threat model a little bit. Yeah, so Q-Day. Q-Day is the day that we expect there will be a cryptographically relevant quantum computer. One that's powerful enough to actually crack real keys used in production. And if you think that Q-Day is far away, then it's really about the harvest now, dig up later, right? It's about, I'm still using, if we're honest, I'm still using passwords I've been using 10 years ago. I don't want to change those passwords. I want them to be secure today. So if QDA is far away, it's the harvest now decrypt later.

15:06But we don't just need to fix the harvest now decrypt later, a bit of it. We also need to fix the authentication, the certificates bit of it. Because just as we explained, we had this shared secret, this 2 to the B to the K, which we can then use for AES. But we did this exchange. But how do I know that I'm actually talking to you, right? Yeah, yeah. How do you know that you're sending your secret to actual Kevin and not someone else? Yeah, it might be someone in the middle who does this dance with me and with you separately and then re-encrypts everything, right? The classical man in the middle attack.

15:37So the way that that is solved is that we use certificates to authenticate. So after we do this thing, you would send me a certificate signed by a certificate authority, which says, I'm Kevin. I have, I don't know, what's your personal website? In TLS, the CA says you can trust this public key for doing connections with this particular domain. So the key agreement ensures that you have a secure connection, but you don't know with whom. And the certificates make sure that you're talking to the right person. Now, there's no deployment of post-quantum certificates today. It's all classical certificates, which is fine.

16:16Until Q-Day. Yeah, until Q-Day, right? Because come Q-Day, it's not just about an active attack, right? because ComQ Day has these root certificates of big certificate authorities. A quantum computer just has to crack one of them. I mean, each browser trusts a whole bunch of them, not just Stance. It's hundreds of authorities that are trusted. A quantum computer just has to crack one of them and it then can create a certificate trusted by basically any browser or basically everyone uses the same kind of trust infrastructure as the browsers. That's a huge problem. And so when you have that in place now, suddenly the consequences of this is essentially whoever owns this quantum computer can set up a man in the middle to anywhere well not just man in the middle because that sure they can do a man in the middle but they don't need to be in the middle they can just if i crack a ca key i can create my own certificate i don't necessarily have to be in the middle it depends on what it is right i can if i'm on a on your network i don't even have to talk to the actual server i can just respond as if I were the real server, right?

17:19It's just not in the middle. It's just you talk to no one else but me. But it's even scarier with things like, for instance, if you have a phone, the way it trusts a software update is using a public tool. If you have a Tesla or some other car that does over the wire updates or other things. Yeah. So last year I bought a new secondhand car, which is new enough that it has a remote unlock and all this kind of jazz, but old enough that it probably won't get any post-quantum updates. I don't want to buy a new car. Let's hope at least we can turn off the remote control functionality. One of the best practices in software is to have auto-update mechanisms, right?

17:59That you can quickly push in a software update for zero day. Every software update mechanism becomes a remote code execution for quantum attackers. So what do we do? You mentioned for fighting against decryption for this harvest now decrypt later. We have alternate approaches that we know work that we've been deploying out through at least critical pieces of software like browsers and things like that. Do we know the answer? What does post-quantum authentication look like? Yeah, so maybe also in the previous one to say, actually, on our view, we can see how many of our clients already can do the post-quantum key agreement.

18:41And that's now more than 65 % already are protected. I mean, that's pretty good. Yeah, of course, we want higher. We want 95%. 100 % ideally, we never get to 100%. 95 % would be nice, but it's pretty good, yeah. But we turned that on in 2022, and it took until now to get to 65%. We know how to do post-content authentication. We have the algorithms. It's trickling down in software as we speak, and people are starting to move faster. Amazing what threats will do, right? Yeah, yeah, yeah, yeah. Things move fast. I mean, people start only working when the deadline is near anyway, right? If we're completely honest.

19:22So we have the algorithms. We're finishing up the final little standards, how to do it in the protocols, and it's just about deploying. And I think there's good news and bad news here. I think like a lot of software development, there's a 90-10 rule here, Where in the vast majority of cases, it will not be a very difficult upgrade. In a sense, it's just a different type of certificate. It's just you have to keep your software up to date. You just install a different kind of certificate and you're secure. But it's a 10 % of cases that are really difficult. It's the cases where you critically depend on cryptography baked into hardware, where you can't replace the hardware.

20:01It's when you depend on the box that someone bought before you joined the company. Does the vendor still exist? What does it actually do? It's these hard cases for several reasons that you need to service, which makes it hard and also by its urge to start looking to even know what the deal is. But luckily, probably if you just use modern stuff, TLS, it will probably be reasonably straightforward. Every AI team eventually hits the same wall. The models are solid, the infra is solid, but the data coming in is hours old because the pipeline is batch when it should be streaming and nobody's had time to fix it.

20:43That's not a modeling problem. That's a pipeline problem. Estuary gives you CDC, batch, and streaming in one platform. 200 plus connectors, live in hours, not weeks. Your AI is only as good as your pipeline. estuary.dev If you're running Postgres in production, you've probably felt the moment analytical queries start fighting your transactional workload. Most teams end up adding a second database and all the pipeline complexity that comes with it. Tiger Data, creators of TimescaleDB, takes a different approach. We extend Postgres with hybrid row and columnar storage so one table handles both writes and analytical scans.

21:20Native compression cuts storage costs up to 95%. Continuous aggregates keep dashboards live without bash jobs. and it scales to petabytes without you re-architecting. Companies like Cloudflare, Octave Energy, Schneider, Axpo, and Floco run production workloads on Tiger Data today. No stale data, no second system to operate, just Postgres. Managed for you, ready for the workload you're building toward. Try it free at tigerdata.com. You know Fidelity is a financial services leader, but did you know that inside Fidelity is a community of technologists working together to shape the future of finance and tech?

21:54Fidelity is always investing in tomorrow, from emerging tech to cutting-edge tools that will transform what comes next. Their technologists are encouraged to keep learning so they can expand their skill sets, explore new ground, and stay ahead of this rapidly evolving industry. And right now, Fidelity is hiring technologists to join their team. Fidelity technologists get the best of both worlds, startup energy that's grounded in the stability of a financial institution. That means support, resources, and amazing benefits. Bring your skills to a culture where you're empowered to dream big and build the tech that drives an organization and makes a real impact on people's lives.

22:33Find out more at tech.fidelitycareers.com. That's tech.fidelitycareers.com. Fidelity is an equal opportunity employer. So let's start with the straightforward ones, and then we can dig our way down into the deeper ones. So to deploy this out, it sounds like first you probably need the certificate authorities themselves to be updating, having another approach. And then it's for users. It's like a software upgrade. It's like, okay, next version of Chrome, next version of SSH and all these other different things. They're going to use post-quantum authentication. Yeah. So Chrome already announced their roadmap on when they will accept post-quantum certificate authorities and they will start accepting them in Q1 of 2027.

23:18So probably we will see the first ones then. So one thing that is new is that you will need two certificates. Because the thing is, not everyone can upgrade at once. Maybe if you have an internal network, you can just replace everyone, have a flag day, flip the switch. But if you have some kind of serious system or maybe even just a few different teams in a big organization, you can't get it done all at once. So you need to be able to deal with clients and servers that both are not upgraded yet. So on the server side, that means that a server needs to be able to install both a traditional RSA or an ECC certificate, but also a post-content certificate.

23:57Oh, that's right. So it's not just the root certificate over at the authority that needs, like this actually needs to get deployed out to anyone with a web server, essentially. Yeah, yeah, of course. It makes sense, but I hadn't made the connection somehow. So yeah, okay. So anyone running your own web server, you've got NGINX doing something or whatever, you're going to need to update. next time you do a certificate update you need to have two of them yeah so hopefully a lot of people do certificate automation right so you don't do this certificate installing yourself you get acme and some kind of acme client to do it for you so hopefully that's easy that's maybe the 90 case at this point i that feels generous actually i don't know if we're up to 90 of people hosting servers are already using like acme i don't know i mean it's something you can do today right so even though there are no post-quantum certificates today you get at least the certificate automation today.

24:44Another thing you can do is check whether your application server can actually install two certificates. A lot of pieces of software assume there's just the one certificate, right? Just one slot. Whereas you really need at least two slots here. Although if it turns out it's really hard to get application servers to move, we might need to define an ugly certificate format where we squeeze in two certificates into one. But let's hope we won't need that. How bad would that be? Because I, you know, once Once again, having been burned before, I suspect there will be a long tail of application servers that are not going to be updating.

25:19Oh, for sure. For sure. That's the reality, right? We can't have the slow movers hold back the fast movers, right? And also, one of the things is you need to, for instance, if you go to an office and you go to the parking lot and there's the turnstile, does that thing top BQ? If we want to upgrade that, do we need to replace the whole thing? I mean, is it worth it? Do we really care if someone with a quantum computer can have free parking? It's fascinating. It reminds me of the whole Y2K scare, except we have orders and orders and orders of magnitude, more deployed software and hardware at this point.

25:56And also the cryptography. We've had 50 years to put cryptography basically everywhere. And usually we hide it. And once cryptography is there, you don't want to touch it, right? Yeah, it's working. It's fine. unless it's really broken people don't really touch software right cryptography so yeah of course yeah so okay interesting so let's dive a little bit more so imagine you're in a world where you own some of this software right the 80 90 i'm just deploying new software i don't i'm not building the software it's somebody else's job to make this except two certificates whatever i just need to roll out updates but now let's step back and say okay we're a bunch of software developers Probably some of us have software where this is actually relevant.

26:37So what do we need to do then? Is this like just dropping in some new libraries or are there bigger changes? Are there performance considerations? Like what does this look like? So the big things are common best practices, right? So I already mentioned keep software libraries up to date, be able to install two certificates, do certificate automation if you can do it. So those are generally good advice that you can do today. On internal PKI, you can already use it. If your software library supports it, then you can already use and deploy post-quantum certificates. So you can already do that today for internal networks.