PQC is already vulnerable.
You may be doing it wrong.
The Quantum Dragon’s treasure really ought to be safe. After all, it’s in the back of a cave, and it’s protected by… hello… a frickin’ dragon. But what if The Quantum Dragon did it wrong and stored his treasure outside his cave? Can we agree that the treasure would seem to be a bit more vulnerable?
I had a chat with Denis Mandich, CTO of Qrypt, about post-quantum cryptography, and he pointed out this vulnerability. First of all, we can’t know for sure whether the PQC protocols are truly invulnerable. Everyone hopefully understands that part, but let’s assume for a brief moment that they are.
Even in a utopia in which PQC protocols are guaranteed to stand the test of time, what if you make errors implementing them? I’m not former CIA like he is, so I couldn’t tell you what right looks like one way or the other, but I have a bit of an IT background, and I’ve definitely observed a hiccup or two over the decades. Now that I think about it, it’s far more naive to assume that implementing anything would execute perfectly.
Conclusion
It really doesn’t matter where a dragon keeps its treasure. A word to the wise: don’t try to be a hero.
Also, we need to remember that every IT Department has a guy named Murphy. Murphy’s Law Murphy. You’ve met him. I’ve met too many of him. So, when we talk about migrating to PQC, we need to remember that Murphy is on the team.
