I'm very curious how much people will look back on this frenzy of PQC migration panic by 2050 when, my bet, there still won't be any remotely viable QCs. The decade plus of even slower TLS negotiation that this will bring in the name of "security", after so much time spent previously on improving encrypted connection latency, will seem quite comical, at least.
Agreed. This looks from the outside like someone read a report, got unnecessarily spooked, and now the rest of the herd is following along.
But it's also very possible that hypothetical report was genuinely concerning. We just haven't seen it or anything like it.
However I'm pretty firmly in the "quantum computing won't be doing anything useful any time soon, if ever" camp, so that definitely colors my opinions. I don't have any particular recent expertise to support that, but I did used to share an office with some serious QC people and go to their talks so... make of my words what you will.
It really depends on the market you are targeting and your threat model. If your threat model allows future decryption of the data by a passive listener, then you don't need to rush for PQC. If you are worried about your communications being archived for future decryption, then you need to deploy PQC now even if QCs aren't developed for decades (or ever).
The assumption that you care about this is baked into ANSSI certifications, otherwise you would usually not bother certifying your product. They warned in 2022 that they would do this (See Phase 2: https://messervices.cyber.gouv.fr/guides/en-anssi-views-post...) and will allow PQC-only algorithm no earlier than 2030.
You prepare for the 9.0 earthquake that can happen once in 500 years because it is a 9.0 earthquake and if you haven't prepared your society is dead, not because you think it will most likely happen in your lifetime.
I'm very curious how much people will look back on this frenzy of PQC migration panic by 2050 when, my bet, there still won't be any remotely viable QCs. The decade plus of even slower TLS negotiation that this will bring in the name of "security", after so much time spent previously on improving encrypted connection latency, will seem quite comical, at least.
Agreed. This looks from the outside like someone read a report, got unnecessarily spooked, and now the rest of the herd is following along.
But it's also very possible that hypothetical report was genuinely concerning. We just haven't seen it or anything like it.
However I'm pretty firmly in the "quantum computing won't be doing anything useful any time soon, if ever" camp, so that definitely colors my opinions. I don't have any particular recent expertise to support that, but I did used to share an office with some serious QC people and go to their talks so... make of my words what you will.
It really depends on the market you are targeting and your threat model. If your threat model allows future decryption of the data by a passive listener, then you don't need to rush for PQC. If you are worried about your communications being archived for future decryption, then you need to deploy PQC now even if QCs aren't developed for decades (or ever).
The assumption that you care about this is baked into ANSSI certifications, otherwise you would usually not bother certifying your product. They warned in 2022 that they would do this (See Phase 2: https://messervices.cyber.gouv.fr/guides/en-anssi-views-post...) and will allow PQC-only algorithm no earlier than 2030.
You prepare for the 9.0 earthquake that can happen once in 500 years because it is a 9.0 earthquake and if you haven't prepared your society is dead, not because you think it will most likely happen in your lifetime.
Related: https://news.ycombinator.com/item?id=48992806 (Are 128-bit symmetric keys really secure against quantum computers?)
Will they decertify previously certified PQC-free products?
Qualification is time-constrained. You are qualified for two to three years. So by 2030, all qualified products will be PQC-free.
> So by 2030, all qualified products will be PQC-free.
You mean the opposite. PQC-free will be blocked, so by 2030 all products will be PQC qualified.