Full Transcript: GDG Cloud Southlake #43: Tommy Todd: The Quantum Apocalypse: A Looming Threat &…

This is the full transcript for GDG Cloud Southlake's forty-third speaker session. Also, find an AI-generated summary, video session links, and the speaker's career advice.

Bevylabs created a summary of the session (accurate but missing the entire main points of the session):

In a virtual meeting, two speakers discuss the setup for a presentation on quantum computing, specifically focusing on the "quantum apocalypse" and its implications for cybersecurity. The event is hosted by GDG Cloud Southlake, a Google Developer Group in the Dallas-Fort Worth area. They plan to conduct the session with a presentation by Tommy Todd, a cybersecurity expert, who will address the potential threats posed by quantum computing to current encryption methods. The session includes a Q&A segment and a networking opportunity. The presentation covers the benefits and risks of quantum computing, particularly its impact on encryption, and offers guidance on preparing for these challenges. The event is recorded for later viewing.

Tommy Todd, CISSP, Virtual CISO with Compass IT Compliance joined the Google Developer Group (GDG) Cloud Southlake virtual meetup to present The Quantum Apocalypse: A Looming Threat & The Need for Post-Quantum Encryption. What does cryptography give you? Security through time. The code can be cracked, but only with sufficient compute power and time. Quantum computing brings a ton of compute power and — for most encryption that we've seen to date — brings the time to ZERO. Are you prepared for the Quantum Apocalypse?

Quantum Computers: Can You Protect Your Digital Assets from Them? Secrets have been kept across the ages by creating cryptographic ciphers. WWII saw the Enigma machine, the Lorenz…

What Lights Your Spark? When you wake up, can you wait to get to work or do you want to stay under the covers as long as possible? When you are…

Here's the transcript of GDG Cloud Southlake #43: Tommy Todd: The Quantum Apocalypse: A Looming Threat & The Need for Post-Quantum Encryption, courtesy of Bevy Labs Platform.

Speaker 0: you in a few minutes. Good afternoon, everybody. Good evening. If you're joining from somewhere else in around the world besides Dallas Fort Worth area, Glad you could make it here to GDG Cloud Southlake. Let me go through a quick introduction before we get into our speaker, Tommy Todd.

Here's kinda the set agenda as people are joining. Glad to have, some early birds. Few of you got to peek behind the scenes and see us, getting ready for the the event. Southlake, we're in the Dallas Fort Worth area here in Texas. So if you haven't heard of South Lake, not a big deal.

We're a Google Meetup group. We have sessions online, once a month. We also have, in person meetups once a month, over in Coppell, not Southlake, but over in Coppell at the, flying saucer in Cypress Waters there. So glad you could make it here and join us. I guess it's gonna be a great, topic today on quantum computing.

I always think quantum computing is just far out of reach, just far out of my understanding. So hopefully Tommy can help bring some, some clarity to me, and to us. But the way it'll go, we'll try and fit everything in with Tommy in sixty minutes or so or less. You know, usually try not to go over an hour. Q and a will happen while, Tommy's, speaking, but there can be some extra questions, at the end.

And then we break this into two sections. So first, our presenter, q and a. And then for those that, that, never get to meet up with us at the in person meetups because of timing or location or whatever, we do a little networking session at the end. We'll make everybody a presenter and, you know, we can find out a little bit more, from each other. Next month, we'll have a social club again.

This one will be on Juneteenth. So it's a holiday. You don't have to use work as an excuse for not not getting out to a social club. And then we'll have a, a speaker from a a startup in Israel about remote local development. You know, how to he'll explain it better than I can in in a few seconds.

So keep an eye out for that one, last Wednesday of each month at, at four thirty. Here's our crew, of organizers here at our Google Meetup group. So GDG Cloud Southlake. We have, probably the common denominator amongst everybody here is almost everybody at one point or another, worked at a company called Sabre. That's where I work now.

We're a giant Google Cloud customer. So four years ago, it made sense to start up a Google Meetup group, try and build that, that community of technologists, in the Dallas Fort Worth area. And kinda the idea is to, you know, be able to connect together, learn something, maybe grow a little bit, and maybe just kind of mix things up and see, you know, maybe something interesting can come out of, meeting each other, learning new things, and applying those to, to our work or if we have our own, businesses applying those things, applying those things there. GDG. Why is it GDG?

Google started, this community back when it was they just had Android developers. They didn't have any cloud. So they called Google Developer Groups. Later when they added cloud okay. Now we have Google Developer Groups cloud.

So we're GDG Cloud Southlake. If you're calling in from a part of the world that doesn't have a group yet, a meet Google Meetup group, they're open to, new people starting them. So if you wanna create a Google interest group in your area, check it out, g d g community dot dev. It's a very simple, process to apply, and then you'll find out if you can run one. There's also another, GDG in the DFW area called, GDG DAO.

They focus, a lot on Android development. I work at Sabre. We're in the a technology company in the travel industry. So we have airlines, hotels, travel agencies as our customers. We've closed nineteen data centers over the last five years.

We've moved completely to Google Cloud. We don't have the biggest variety of jobs open right now, but if you looking, or looking in the future, you check us out. Alright. So glad, to see everyone online. This session will be recorded.

So if you know somebody that couldn't make it, we'll record it. Put it up on YouTube. Should be there by Monday. Usually, it's there earlier, and you can, you can share it, with, whoever you think should take a look at it. I'm glad to, welcome in.

I'm glad Tommy, Todd could join us. He's a local Dallas guy. He's been, a GDG member for, oh, maybe a year, year and a half, maybe two years. It's been, seems like it's been a while. Talented cybersecurity professional.

And he's gonna dig into, the quantum apocalypse. Once once good guys and bad guys get quantum computers, what does that do to our existing security? What do we need to do to protect ourselves? And, you know, maybe there's some other fun tidbits in there besides just security. I gotta stop sharing my screen so you

Speaker 1: can share

Speaker 0: yours. You wanna give yourself a a quick introduction and take it away?

Speaker 1: Yeah. Yeah. Sure will. In fact, I've got a a nice introduction here. I'll just go ahead and and jump right in, actually, and then introduce myself.

So as Jim mentioned, we'll be talking about the quantum apocalypse today. And it it's not all doom and gloom, but it is definitely something that is concerning to a lot of cybersecurity professionals and organizations. And it is, a pretty gloom picture of what's to come if we don't get ahead of some of the ways we need to secure our systems against quantum computing. When I put this presentation together and, again, I'll talk a little bit about myself and just to kind of preface this, I tried to keep it relatively high level. As you can probably imagine, when you start talking quantum computing and encryption, it can get pretty technical pretty quickly.

And I know from the the participants that are on this list, not everybody comes from a cyber background. So if there's any confusion or you have any questions throughout this presentation, obviously, we have a q and a at the end, but feel free to jump in and ask, and I'll try to answer it with the best, possible, answer I can. That won't get you down in the weeds. So as Jim mentioned, my name is Tommy Todd. I am a thirty year cybersecurity veteran.

So I've been in cyber now, it's hard to believe, thirty years, but you can tell from the gray, it hasn't been all, roses and unicorns. But primarily, my career has focused on data privacy and data protection. Those are things that I'm extremely passionate about both from an organizational perspective as well as a consumer, as an individual. So when I'm not speaking to technical professionals such as yourselves, I'm also out there advocating for privacy rights and working with different communities to help bring awareness to the encroaching technology advancements that are showing up in the home and just to be aware of what you're welcoming in when it comes to smart devices, etcetera. So I do more than just this, but this is definitely a a a topic that's near and dear to my heart just due to my background.

I did lead encryption initiatives at companies like PGP prior to the Symantec acquisition. Then I came into Symantec as well, representing that encryption space within their portfolio. And then after Symantec, I went to a company called Ionic Security, which was basically PGP two dot o. So for those that you aren't familiar with, PGP, they were considered the gold standard of encryption throughout the the late nineties and early two thousands, and they were kind of the godfather of how we know encryption today when it comes to things like public key exchange and all that good stuff. So, that experience has helped me understand where we've come from, and where we're headed as an industry when it comes to encryption.

So I come from, what I like to think is a position of authority on some of these areas, and I'm happy to share that experience and that knowledge with the team here so you can all get a little wiser about kinda where we're at, how we got here, etcetera. Throughout my career, working for these different organizations, I also was response for doing implementations. So I traveled the globe for about ten years implementing encryption style solutions within Fortune five hundred companies. So getting you know, when we started talking about regulations and compliance needs, everybody got on the bandwagon of getting some semblance of encryption in their environment. So there was a lot of activity and a lot of business to be had back in those days.

So, again, gained a lot of experience with what organizations struggle with when it comes to adopting encryption. And some of that will come through in the presentation later on. You'll start to see the challenges that a company has with trying to advance their encryption capabilities because it's not an easy task. And and and, unfortunately, there's not a lot of seasoned experienced people out there that understand this well enough to know what to look for. As you can probably imagine with the battle scars, if you've been in this industry long enough, you you probably have seen it all just like I have.

So, you know, helping organizations get secure and become more mature in their security. In my current role at Compass ITC, I do serve in a VCISO fashion. So I do serve as a CISO for multiple organizations, and they're all struggling with the same challenges. So it's really good experience to bring to bear, to this discussion today, and hopefully that'll come through. If you'd like to connect with me on LinkedIn, I have my LinkedIn profile link there.

I'd be happy to to stay connected and and share some additional content and, you know, follow each other, see how we progress. So let's go and jump in. And before I start trash talking quantum computing, I really wanna talk about what are some of the benefits that I'm gonna abbreviate it as QC from this point forward just because it's a bit of a mouthful. But what are some of the benefits of QC to mankind? Or what what's being advertised as, you know, with quantum computing and QC, there's all these cool things we can start to do that we can't do with class computing today.

And when it comes to the what separates QC from what we call classical computing, it really comes down to what they call superposition or the ability to do processing much faster. And in simplest of terms, when you think about a typical computer, it evaluates one and zero. It's the binary language. Right? And so when we think about classical computing, it can either evaluate one or zero, but it can't do it at the same time.

Quantum computing can, and that's really where the value comes in is that it can assess one and zero simultaneously, which means that the processing is much faster. That means the calculations that it can perform are much faster. So if you take nothing else away from all the fancy jargon around qubits and, you know, quantum words and things of this nature, just think in those terms. Right? Ones and zeros become simultaneous rather than one at a time.

So some of the benefits that QC apparently brings to the table is and and some of these are valid. Right? Revolutionizing the industries. When you think about the different challenges that certain industries face, for example, drug discovery, being able to analyze and understand the impacts of things like health care and helping science come to outcomes much faster than classic computing can. Instead of taking weeks or or years, it can take minutes or hours to get to that level.

When we talk about simulations, a lot of times we think in terms of, like, simulating the universe and simulating a black hole. I think Interstellar was the first movie that came out that truly assessed, like, millions of data points to represent a black hole. And then that's one of the awards that they won for that movie was the fact that they represented that in such a way that even scientists today are still using that model to understand how black holes operate. With quantum computing, we can do that much faster. We can get a better understanding of our universe.

More importantly though, and if you think about it from a what are some of the areas that, that have impact that you might not be thinking about? Nuclear testing. So one of the things about nuclear testing is with the the test ban, you know, the test treaties and all the stuff that we've got in place now, we can't detonate nuclear weapons above ground. They all have to be underground. So with quantum computing, we can simulate the effects of a nuclear explosion without ever having to set one off.

So I know the military is very keen on quantum computing hitting the horizon so that they can stop nuclear testing and start doing it in simulations. That way they're not poisoning the earth as part of this process, but still getting the understandings that they need to be able to assess and analyze the the, you know, whether it be blast or the impact of a nuclear detonation. And then finally, when we think about where QC can kinda go astray, it's in the idea of, unimaginable innovations, specifically around AI. And we'll talk a little bit more about that through the presentation. But other areas of impact, things like health care, being able to assess and diagnose, conditions much faster and be able to create solutions Instead of taking years like we did with COVID to come up with an effective vaccine that we knew worked really well, we can do this in a matter of days just because we can simulate all the different outcomes using quantum computing that we normally couldn't do without human testing.

Logistics is another area. If you think about how things move across the globe right now, there's a lot of inefficiencies with those procedures. Having quantum computing kind of figure out all this ahead of schedule will allow delivery of goods to be much simpler and much more efficient. So this has much more impact beyond just your cybersecurity concern, and these are some of the advertised benefits. So, again, all roses when you think about it from that perspective.

But as we know, mankind generally doesn't follow that track and ultimately will use good things for, either being weaponized or for bad purposes. So how does quantum computing affect encryption as it stands today? Well, as we already talked about with the quantum mechanics, the ability to do calculations much faster allows it to process much larger numbers than ever before. And when you think about encryption, what it's typically made up of, it's mathematics. It's a bunch of numbers.

The ability to calculate these numbers are generally insurmountable when it comes to cracking. But with quantum computing, that changes the game a little bit by making that process much faster. Interestingly enough, I included a couple of algorithms that were developed back in the nineties that were theoretical at the time, but if they become something that gets applied within quantum computing could really be damaging. So these are some of the risks that we're already thinking through. We've been thinking about them for over twenty years at this point.

So Peter Shore, who's a professor of applied mathematics at MIT, back in ninety four developed a quantum algorithm that basically factored exponentially faster than the best currently known classical computer at the time, which back in ninety four, not, you know, computers compared to today were much slower, but the theory was there. And the idea was if we can factor these numbers much faster and break them down quicker, then all encryption at the time is at risk. So in this concept, from an algorithm perspective, it will dynamically break RSA, ECC, and what we call elliptical curve cryptography and the Dippy Helman encryption. So these ciphers are typical I'm sorry. These algorithms are well established, well tested and well known.

And a lot of companies put these in place. A lot of companies have these there. So if you think about your DKIMS, so your, your domain keys, you think about TLS, you think about all the things that US use RSA today, this one algorithm in the hands of quantum computing could crack it pretty quickly. Then we have Grover's algorithm, and this was originally designed, by Love Grover as a database search algorithm to speed up the ability to to query databases. And as a side effect of this, he was able to determine through his algorithm that he could have the effective key length of symmetric encryption.

So imagine AES two fifty six, you're now at AES one twenty eight. Because of this algorithm, it cuts that encryption capability down in half, which again reduces the amount of time that it takes to crack the encryption using quantum computing. And I'll stop here and kind of give you guys a little bit of a primer about some of the inherent risks with encryption because it sounds like, wow, before quantum computing, encryption was secure. Right? Well, not really.

At the end of the day, the one thing that encryption suffers from the most is time. You give anything enough time and it will crack the encryption. Now it might be millions of years, but in a million years, we can crack encryption using traditional computing. So what quantum computing does for us is it reduces that time from thousands of years down to literally hours. And so when we start talking about some ways to solve this, it's resetting that clock.

So what was normally a thousand years is down to minutes. Now we can push it back out to a thousand years. So that's the tug of war that encryption has within the industry about how do we get ahead of some of these things to reset that clock. Even once we've done that, it's still at the mercy of time. So it's still a problem.

It just lengthens that. So what is the apocalypse? We talk about this doom and gloom model as it relates to quantum, quantum computing and quantum cryptography. We look at it in terms of, obsolescence. So as soon as quantum computing becomes something that is mainstream, that is operationalized at the common man level, it's not theoretical, it's not something in the hands of the big giants.

When that day comes, all of your encryption as it exists today will be vulnerable and will be exposed. So from that, we talk about the broken algorithms such as RSA, ECC, Diffie Hellman, and even AES, which is treated as military grade has been chipped away at recently by soup you know, like quantum computing and some experimentation. And this is universal. So this will be something that will hit the globe. It's not gonna be unique to specific organizations.

This is gonna impact all of us. So imagine waking up one morning and all of your information is now exposed. Everything about you, your financial transactions, your emails, your signal chats, your web traffic that's typically TLS encrypted, anything that had encryption protection yesterday is now exposed tomorrow. And in those situations, there are no more secrets. And if that's in that particular condition, the world's gonna be thrown into chaos.

Because we think about financial systems, being able to have, manipulation of the markets, going in and actually creating a bunch of bogus entries, and next thing you know, we dilute the market down to where it collapses in on itself. You You know, military secrets. Think about all the communications that the military does with satellites and with weapons in the field. All of that could be disrupted and all of that could be exposed. So it really does create this Armageddon situation when that day comes, and it is coming soon if we don't get ahead of this.

At a personal data level, we talk about this being a risk, but the reality is you you've probably gotten to this complacent state where your data is already out there. Right? It it really doesn't have to be quantum encryption or quantum computing to break this stuff when your stuff gets leaked by an organization. When it comes down to things like things you know you've encrypted, the sensitive stuff that you know has been protected, all of that is now exposed. We won't really have a choice when that day comes.

It's just gonna be one of those things where the threat actor gets a hold of it, they'll know everything about everyone. To kinda take a little bit of a divergent because I think it's important to understand that encryption is not the only thing at risk here when it comes to quantum computing or QC. If you combine QC with artificial intelligence, you've now kind of got this perfect storm of a situation where we're now really in trouble. So not only are our secrets gonna be exposed, but also artificial intelligence can operate at speed to the point now where it's you can't tell the difference between what's real and what's not. Especially, you know, we have this fear of artificial intelligence becoming self aware, and once it learns to a certain point, it's gonna be smarter than the rest of us.

And more importantly, it's gonna be less predictable. We're not gonna know how it's making decisions. We're already at that stage now, but when you add quantum computing to the mix, now it gets even worse because it can think and process much faster than ever before. So it becomes a terrifying type of a scenario when we think about blending these two, and this is where we're headed as a society. So the reasons why your major manufacturers, and we'll talk about this a little bit later in the presentation, why they're putting so much onus on doing QC is so that they can benefit their AI engines and make them faster and process quicker with less resources.

So this is, again, a pending state. This is something that, unfortunately, is gonna be the the in the next five years, we're gonna see this as a common occurrence. So when we think about what we're already seeing as it relates to AI and how quantum computing can actually be more problematic, we're already starting to see things like deep fakes. We you know, this has been a common thing for a while now. And with AI, it's making it even worse.

I know Google just released their new AI video production where videos look realistic. You have no idea that AI actually put these things together. So we're blurring the lines between what's real and what's been made up and faked. Now think of this in terms of a threat actor. We've already seen examples where using ten minutes of a CISO's presentation that was posted on YouTube gives you enough information to be able to fake that person's voice well enough to socially engineer an organization.

We've seen this happen a couple of times. Now imagine having a limited, YouTube video of somebody. Now I can take AI and replicate that person's image and its video and make it even look more realistic. So when we think about the the threats to what we have going on, these are all things that we're currently seeing, and they're only gonna get worse when QC gets online because this stuff's gonna be much faster. You're gonna see more of it.

And, again, we're talking blurred lines between what's real and what's misinformation. The final point here, and this is something that scares me even more when I when I mentioned earlier about my, my involvement in community awareness and helping people understand when you're inviting these technologies into your home, what are you actually giving up in relation to privacy? And mass surveillance has always been a a concern of mine. As cameras become more prolific in the industry, you can't even walk down your your street now in your own neighborhood without being picked up by several ring cams along the way. Traffic cameras, we're seeing a lot more facial recognition at things like sporting events, mass transit facilities.

Taking advantage of quantum computing and AI will allow them to assess your profile and track you much more quickly. So So it takes time today to build a profile of you as you move from one point to the other. There's all these different sources that have to be analyzed and correlated. With quantum computing, that's much faster. So from the time you leave your house until you get back, you're gonna be tracked all the way through.

And that to me scares me because at that point, there's nothing we can do. Your privacy basically evaporates. The only private place we're gonna have left is the mind, and that's slowly becoming a problem as they continue to to work with biometrics and things of that nature. So, again, when we think about all the the threats and the doom and gloom associated with quantum computing and AI, it's not a great picture. It's it's really something that we have to be concerned with.

So let's pull it back to the crypto concern when we think about encryption. If you listen to NIST, NIST is still estimating that the full quantum threat is five to ten years away. And I, as a as a professional in encryption, disagree. The signs are there. Right?

We have several major manufacturers that have announced, you know, quantum chips in the last year. We've seen, exercises by the Chinese trying to take down certain aspects of ADS. We've seen certain things happening in the industry right now that to me indicate we're really about two to three years out, before this becomes reality just due to the nature of the advancements in the technology. And the reason why NIST is saying five to ten years and trying to calm people down is because this is not the first rodeo for these guys. When you think about what we've done in the past, for those of you that are familiar with Triple DES or 3DES, the the algorithm that was used for encryption, that was deprecated about ten years prior before most organizations moved off of it.

And this gave everybody about a five to ten year window to say move forward even though they knew that that that algorithm had been deprecated long ago, but organizations are slow to respond. So they kinda buffer this time frame because they understand it's about how long can it take the organizations to move off. And if we give them a five year runway, maybe they'll start doing something about it within year two. If I were to tell you that this is actually gonna happen in two to three years from now, it doesn't give you a lot of time to pivot and to to do all the assessments that you need to see where your threats are and then to be able to roll in something that will protect you from those threats. In the meantime, we are seeing an active list of of current attacks, this harvest now, decrypt later concept.

When you think about how ransomware operates today, the fact that it steals your data, disrupts your data by encrypting it, and then hold your data hostage, those are the ones we know about. The true ransomware guys are the ones that are stealing all your data without you even knowing about it. Even your sensitive crown jewels that might have been protected using legacy encryption because they know it's only a matter of time before they have the ability to decrypt that information. So they're just able to take your data today and hold on to it and warehouse that data until such time as they can decrypt it using quantum computing. This is actively happening right now, and this is something that is gonna continue to happen.

So when we think about what's the damage today, this is what we're dealing with. Not everything in an environment is encrypted. We all recognize that. Not everything needs to be encrypted. For those things that are, though, they become a focal point for these aggressors because they realize if you're taking the time to encrypt it, it must be important enough for you to wanna do that to it.

So I'm gonna take that, and I'm gonna try to decrypt that later to break it open and see what your secrets are. So just be aware that even though we have this five to ten ten year window that missed claims, this kind of activity is happening right now. And so your data is probably already gone or on the way out in anticipation of quantum computing. Okay. Let's see.

Yep. So when we talk about which algorithms are affected right now, and some of these might be familiar to you, some of them might not. If you're not if you don't come from an encryption world, this might be kind of Greek to you, but I'll just kinda break it down in the simplest of terms so that everybody understands where we stand. You'll hear me use terms like algorithm and cipher, and the two are not really interchangeable. In this in the context of what we're talking about today, think of the algorithm as like a recipe for encryption.

It provides the instructions for how encryption should be invoked, but it actually doesn't do any of the encryption services itself. That's what the Cypher does. So the Cypher can be treated like a specific dish using that recipe, and it combines the algorithm with key ingredients such as Cypher strength. So that's why you'll hear us use AES two fifty six. That's your key strength.

You'll hear us use certain, flags like nonrepudiation. You hear things like signatures and signing. So there's certain, ingredients that can be applied to the algorithm that then invoke that encryption. And so when we look at these algorithms, these are all the most common ones that are out there today. I already mentioned the fact that RSA is a very common algorithm in use with things like your domain keys, TLS sessions.

So when you're going to your web traffic, RSA is kind of a wrapper around that. We have ECC for certain types of file encryption, same thing with Diffie Hellman. And then as I mentioned earlier, AES is the considered military strength encryption that our military and our governments use to protect their assets. So we look at, are these things vulnerable? As you can see by the chart, yeah, every every single one of them is vulnerable to some extent.

Even AES is partially vulnerable, but it determines your, it's based on your key sizes. So if you're running AES five twelve or something larger, your risk of vulnerable computing against quantum computing is less, but it still is impacted by that. Just know that every time you increase the key size, you're also increasing the amount of resources required to do encrypt, decrypt functionality, which is why you'll typically see people top out at about the AES two fifty six level. Very rarely do we see people move up to five twelve just due to the nature of the resource intensity, and we often see that two fifty six is good enough, and that's typically what we see get implemented. Now I list one time pads here and if you're not familiar with a one time pad, it's actually, something you should probably look into because it's one of the most it's one of the original ways to handle encrypt decrypt ciphers and it's considered, a single use of a pre shared key that's uncrackable.

So if you're familiar with things like number stations, the way governments communicate with spies over shortwave radio, it's just a series of numbers. Anyone can pick those up and anyone can record those, but unless you have that pre shared key on the other end, you cannot decrypt that message. And no computer on the earth, even quantum computing, will be able to crack that. Now I bring it up because it's a very traditional way of doing encryption, very simplified way. But as you can see, it's impractical to implement.

There's no way to operationalize something like that. So all of these advanced algorithms are at the mercy of math, whereas one time pads are not. So I just like to toss it in there that we still have an uncrackable mechanism even after quantum computing comes online. It's just unfortunately not operational. So let's talk about post quantum cryptography or PQC for short.

You also hear this referred to as PQE or post quantum encryption depending on who you talk to and then and what language they're using as far as, you know, seriously tech jargon or just somebody that understands encryption. And at the end, really what it is is quantum resistant math. As I mentioned before, encryption is all based on mathematics. The ability to factor prime numbers and calculate all these different factoring. So when we look at quantum resistant math, it's based on a number of different things.

The lattices that are used, the hashes, and other resistance structures. Now the cool thing about PQC is that it does provide dual protection. So not only is it designed to protect you against post quantum, computing, but it also can protect your classical encryption against existing attacks. And when we talk about existing attacks, it's things like hash collisions, brute forcing, breaking down certain components of the the Cypher implementation. You might not be able to break the Cypher itself, but you can break the way it's implemented if it's been implemented incorrectly.

So being able to protect against today's threats as well as tomorrow's threats is the idea behind PQC. And NIST is charging away here. So they have standardized, and we'll talk a little bit about what they're doing as far as the way that they've invoked some of these PQC algorithms, what they are, and why they matter. And then, kinda help you get a level set on what's available to you today and what's on the horizon. So let's talk a little bit about this.

Yeah. Somebody have questions? I'm sorry.

Speaker 0: Yeah. Quick question on on the algorithms. I know there's some quantum resistant, algorithms. Any that you've seen that claim to be, like, this will, this will be not just quantum resistant, but, won't be defeated by a quantum computer?

Speaker 1: No. No. And I'll tell you why. It's it's in the same, analogy as a bulletproof vest. Right?

A bulletproof vest is not bulletproof. It's bullet resistant. Meaning that if you shoot it enough, it the bullets will get through. That's why, encryption is very time based. So we say resistant because it will resist quantum attacks, but ultimately, all encryption can be cracked.

It's just a matter of time. So you'll never hear them say quantum proof. It'll only be resistant to that. Okay. And that's that's why we use those phrases.

That's a that's a good question. That's a good distinction.

Speaker 0: Alright. Thanks, Tommy.

Speaker 1: Sure. Yeah. You know, before I jump into the to to go any further into PQC, maybe it helps to understand how we got here as far as the evolution of encryption as we know it today. And it comes down to a a few simplistic terms. In the old days, for those of you that are familiar with the PGP way of doing things, it was what we call public key infrastructure or public key exchange.

That means if Jim and I wanted to send each other encrypted emails, I would send him a copy of my public key. He would send me a copy of his public key. We would encrypt to those keys, and then he would use his private key to decrypt, and I would do the same on my end. So in a nutshell, that was what we call the that public key exchange, right, being able to share those keys back and forth. The challenge with that model is it's not very scalable.

So if you're rolling out this public key capability to an organization, that means everyone in your company has to have a public key and a private key that they need to manage. So they have to set the password. They have to rotate it. They have to do all this administrative overhead just to have keys available in the event somebody wants to send them something encrypted. So the the there was a quick evolution away from that public key exchange to what we consider a symmetric key implementation.

So imagine if you will, you've got a whole bunch of keys that get created in your environment, but that are not managed by an individual. And the way that these would typically be applied in an organization is every piece of data that gets created in your environment has a very unique key created to encrypt that data, and it's a one time use key. So for this piece of data, I have this key that was created. It encrypts it, and it moves on. That means as an attacker, if I want to crack that file, I only crack that particular key.

I'm not cracking all of the keys in the environment. So it it gives you a little bit more resilience in the way your encryption's been rolled out by having a one for one relationship. In both the situation with the legacy public key exchange and the symmetric key environment, you still have the problem of the single algorithm being used. So generally speaking, when you build a public and private key pair, you choose an algorithm and a cipher that you wanna use. And then anything encrypted to your key uses that cipher or that algorithm.

So that means if I bust the algorithm, I bust everything you've ever done with that particular key. Same thing with symmetric. Even though you have the symmetric key, unless you're rotating through ciphers, you end up with the same algorithm being applied to every single one of the keys that are being used. And therefore, I bust the algorithm, I bust all your files. So in the last twenty years, we've gone from public key exchange to symmetric key involvement.

And now we're starting to see more of a rotational model that applies to, quantum post quantum cryptography. And I'll talk a little bit about that here in a minute, but you'll see that there's been a a kind of a a leap forward in how we think about encryption to move forward and use and take advantage of PQC as part of this process. But as it relates to NIST, so we'll talk a little bit more about this, but NIST has selected four algorithms. These are available to everyone out on the market right now, so you can take advantage of these. They've also, implemented the FIPS standard for each one of these.

So FIPS two zero three, two zero four, and two zero five. These kind of articulate the way the cryptographic modules are applied. So if you ever wanna be audited to make sure that so you wanna build these into a tool that you're developing, you can have a a FIPS certification that goes along with that, kinda like the one forty dash three, the one forty two dash three and all these things where you have a standard that can apply to, PQC type algorithms. So, again, they're moving forward with that standardization. It's still not a hundred percent finalized yet, so there's still some dialogue happening about, you know, what are the standards that we wanna make sure we adhere to.

And as a result, some of the startups that we've seen in the industry kind of put all their eggs in one basket because if something changes, they now have to pivot and pivot pretty quickly to catch up. So in my mind, until we get full adoption, full standardization from this, it's still a bit of a moving target. And then as far as the mandates are concerned, so governments and enterprises are urged to prepare now, and we'll talk a little bit more about what, the NSA did back in twenty twenty one. But what I'm expecting to see in the near future is government entities starting to update regulatory requirements to include PQC specifically in their mandates. So think about HIPAA.

You know? Unfortunately, HIPAA doesn't actually require encryption. If you look at the law, there's nothing in it that says you gotta have encryption. You have to have data protection, but not necessarily encryption. I would expect those regulations to be updated to include specifically PQC style encryption.

Same thing with, you know, GLBA and any of these standards, even PCI, invoking PQC as part of that process so that you're using the best standards moving forward and not just using whatever encryption you choose to use, knowing that it's currently at risk of being busted by quantum computing. So let's dive into some of these algorithms.

Speaker 0: You might be you might be answering this coming up. But, Mike and, Rajita had a couple. Two questions went along the same vein. Like, what what should we do to prepare, you know, for the loss of an encryption? What can we do to safeguard?

We have traditional encryption now. It sounds like it's grab one of these algorithms out of the, approved list and start an encrypting with that now.

Speaker 1: Yep. So I I do talk about that. We'll talk about that here in a couple of slides. What you can do to be prepared for this.

Speaker 0: Okay. Cool.

Speaker 1: Because in in my mind, it's not enough just to tell you have a problem. I wanna make sure I'm helping you solve this problem. Right? And giving you some ideas and suggestions to think about, to get ahead of this curve. So, yeah, I'll I'll cover that here in just a couple minutes, and, hopefully, that'll answer those questions.

Awesome. Yeah. So let's dive into a little bit on the what what NIST has approved from an algorithm perspective because it's it's interesting to see their approach. And, you know, I'm used to having algorithms tied back to ciphers, and I can pick and choose which cipher I wanna use to encrypt data. That's not what NIST did in this particular situation, and they did it for a very specific reason, which we'll talk about in a minute.

But just to know, there are four different algorithms available to you. Kyber, which has now been renamed MLKEM and for a very good reason. It's module lattice based, key encapsulation, which is a mouthful. So I still call it Kyber even though it's been renamed MLKEM. But this is basically the key encapsulation mechanism.

So this is the imagine wrapping your existing keys using Kyber. So you're still using AES two fifty six. You're just wrapping it with Kyber to give you that post quantum capability. We typically see this being, invoked in communication. So like TLS, HTTPS, we see it through SSH.

Anywhere where you have a network tunnel that is already tunneled and encrypted, we can then wrap around that key that was used with Kyber to give you that post quantum capability. The other three that we have here, dilithium, falcon, and sphinx, these are signature algorithms, and these all have their place as well. So when we think about why would we want to have advancements of so many signature based algorithms when we only have one key encapsulation method, it's because of the secure digital transactions. So when we think about all the ways encryption works today, it's not just about encrypting your files and encrypting your tunnels. A lot of this is used in the banking world to verify identities and to do other digital interactions.

We also use these signatures for document signing. Think about all the legal documents that you might process, your MDAs, your agreements, your wills, your trusts. Everything that has a legal basis has to be signed. And that signature that applies to what these like, the lithium, falcon, and sphinx allows you to make sure that that document has not been tampered with and you also get the benefit of what we call non repudiation, which in essence non repudiation is the inability for me to refute that I did something. So for example, if I sent Jim an email and I signed it using one of these signatory algorithms, I can't say, I didn't send that email to you, Jim.

That wasn't me. That was some other actor because I have signed it, and it it's my stamp saying this is me. This legitimizes what I'm sending to you. And although these three don't necessarily encrypt data directly, they do play a crucial role in securing communications communications and software updates as well as sensitive transactions. So think about Microsoft.

When they push out updates to the world, there's a key that they use to sign all of their updates so that your endpoint knows this is coming from Microsoft and it hasn't been tampered with. Because they don't use quantum resistant keys for that mechanism, imagine when quantum computing comes online and we're able to bust that key. Now you have no idea should you trust Microsoft because it could be a man in the middle using the same key and hijacking that session and kind of invalidating the integrity of that update package. So this is why it's important we have these signing algorithms. And they each do a a couple of little things.

Right? The lithium is a standard signer. The Falcon is a bit of a a short string signer for optimized systems. So if you need signing at speed, And then Sphinx, if you wanna have a takeaway from that, is more about long term signatures. So imagine signing a document that needs to stick around for fifty years.

You wanna make sure that that signature stays, intact and doesn't degrade over that fifty year cycle. So there's a reason why they did these first three, which is is kind of interesting when you think about it. Now the other thing about Kyber and when I when I started to investigate this on my own and I was thinking, okay. I'm used to the file based encryption. Why did NIST approve a non file encryption based algorithm?

Why did they do that? Yeah. Right? Why why do we have the situation where I can't use Kyber to encrypt data? That's just not how it works.

Well, the reason they did it is because they understood organizations are gonna be slow to adopt any new system. They're probably gonna keep AES in their environment. They're probably gonna keep RSA in their environment. So rather than requiring you to displace that by decrypting your data and then reencrypting it with a post quantum algorithm, they decided, why don't we just build an encapsulation mechanism? So that's basically what Kyber does.

It still relies on you having AES or RSA or ECC, one of those standard algorithms in your environment. It just kinda safety nets it by wrapping it with its own encapsulation. So this made it easier for organizations to adopt because you're not really forced to decrypt your data first, which is typically a massive administrative overhead to do that. And all you have to do is apply Kyber, rotate it in, and then it just populates over your keys and keep on trucking. So it's actually a relatively simple way to get this into your organization and to future proof you without having to do a bunch of reverse engineering.

But it's important to note that none of these keys or none of these algorithms do any kind of data encryption on their own. Right? These all have different mechanisms. So until NIST approves a brand new algorithm, something that's better than AES, this is what we got. And, in my opinion, if you ask me, hey.

How secure is this? I'm fifty fifty on my confidence level, and I'll and I'll tell you why. I don't like the idea of having a single, key encapsulation method. What happens if Kyber gets compromised tomorrow from some unknown threat that we're not aware of today? And that's the only one we have.

We have no alternative. We have no other option. So we're kind of putting our eggs in one basket by having this single instance that we can rely on. And that's not to say Kyber has not been attacked because it has. Over the last year, there have been at least three separate side channel attacks demonstrated against Kyber.

Now they were patched, but as I mentioned earlier, these side channel attacks are not really attacking the algorithm. They're attacking the way the algorithm is implemented. So if the algorithm is written incorrectly or it has certain instructions that could be, exposed or vulnerable, that's what we're attacking. And these side channel attacks bypass the encryption capability and kind of expose the information, which is not what you want. So until we have a variety of different types of options for us, I'm a little skeptical that this is the path forward.

That's just one man's opinion. You might feel differently. So what's the world doing? What you know, now we know government action. Right?

We talk a little bit about some of the mandates. Well, interestingly enough, the NSA in an interoffice memo mandated quantum resistant algorithms for top secret systems back in twenty twenty one. So four years ago, they knew this was an impending threat, and they mandated that all NSA top secret systems had to have some mechanism for post quantum, resistance. In other words, they had to find a solution, and some of it might have been homegrown and stuff you and I will never know about, but they kinda set the tone for where the rest of the world needed to be. And this is really what kicked mist in the pants to build something that the world could take advantage of.

Because if the NSA finds it that important, that means everyone else really should as well just to be able to protect their secrets and all that good stuff. Tech giants that are currently involved in, testing these hybrid encryption approaches, and it's you're gonna see me chuckle a little bit when I name these guys, Google, Microsoft, and AWS, simply because you'll see in my next slide why I'm a little skeptical about them as well. But we'll we'll save that for the next slide. And then market response. So we do have start up vendors that are building PQE environments today.

So, like, Qubit Security and QSecure. These are two organizations that have already built in PQE capable solutions that have been pretty mature. They've been around for a couple of years now. So there are solutions out there if you're interested in evaluating different opportunities that might help you in your organization get ahead of this post quantum world. So when I talk about those three big guys, it's it's kind of interesting that here they are building hybrid encryption solutions to protect against quantum computing, and yet they are the leaders in quantum computing.

In the last year, Microsoft, Google, and Amazon have all announced their own version of a quantum processor. So they're kinda it's a conflict of interest in my opinion. It's like, oh, yeah. We don't lead the way in in quantum computing. Oh, and by the way, we're gonna try to protect you against quantum computing by helping you build encryption that'll that'll do I'm one of those guys that I'm skeptical about any industry that is not security first.

Microsoft is an operating system company that thinks that they know security. Google is a platform company that thinks they understand security. That's not their bread and butter. Amazon, another great example. I'm not trying to bad mouth or poo poo any of these guys, but security is not their first and foremost, business model.

Right? That's an afterthought for them. So any organization that looks at security second to their business model is not somebody that I really trust, at least not implicitly. Right? And the fact that these guys are kinda playing both sides of the fence has me a little skeptical about the whole thing.

And finally, we think about it again just as a as a kind of a wrap on where we're at. I I do believe time is running out. I I you know, I've been these I'm one of these guys shouting from the mountain top for over a year now. This is coming. It is not something that is gonna be postponed.

It's not going away. It will be in your face sooner than you realize. And don't believe this that they that they say it's still a five to ten year problem. It is not. It is a two to three year problem.

And I'll be surprised if in two years, we don't already have quantum chips that are marketable, right, that are out there on the market that any one of us can acquire with enough money to operate our own quantum computing environment. When that day comes, we are all vulnerable, one hundred percent. Everything you know today from an encryption perspective goes out the window. It's gone. Might as well forget about it.

That's how bad this is. It's not ninety percent. It's not eighty percent. It is all of it. And with these four algorithms, that's all we've got.

And until they approve additional ones to help bolster that portfolio of algorithms that you and I can choose from, this is what we're dealt with. So, you know, tread cautiously as far as I'm concerned. And finally, what should you do today? So this hopefully answers the question that, you had earlier about what can I do? You know, now I know there's a problem.

I know this isn't going away. I know it's coming up soon. What can I do to help my organization? Well, it starts with understanding where do you have your assets. Just like everything else, go out and inventory your cryptographic assets.

Know what systems are using encryption. Know how you're using encryption. Are you using legacy encryption solutions, which for most part, you probably will be. I I work with companies all the time that are still using TLS one dot one, and it it boggles the mind. I'm like, how are you still allowed to do that?

It's like you needed to upgrade it a long time ago and you're still behind the curve. So understanding your assets is the first step, and there are plenty of tools out there that can help you. AgileSec is a good one. Asara is another one. These will inventory your environment, not only tell you where your encryption's at, but also give you your vulnerabilities.

So it can tell you, hey. You're running TLS one dot one. You really need to fix that in movie one dot three. It's probably gonna break stuff, but that's the better way to go than to have this vulnerable cipher out there. Take a look at products that can give you the crypto agility.

And this is something that I kind of alluded to early in the conversation where when you look at solutions that can apply post quantum cryptography, make sure it's doing it in such a way that it is future proofing you. In other words, think about it this way. We talk a little bit about the one for one relationship between an encryption key and your data. Imagine if you had a solution that not only did one for one in that respect, but every piece of data had a brand new cipher pulled out of a list. So you're randomly selecting not only the cipher you wanna use, but as the final stage, you're also wrapping it with Kyber.

That means as an attacker, I'm not only slowing you down because you're post quantum resistant, but I'm also changing up the the algorithm and the cipher so many times that you're having to reset your attack structure every single time. It's not a one and done. I'm constantly put on my heels as a result of that. And if you know how threat actors work, they're generally pretty lazy. Yeah.

If they want your system, they're gonna find a way to get it. But if they feel it's too hard, you just move on to the next guy. They go after low hanging fruit. They're not gonna go after the ones that are securely, that are mature and have a proper program in place. Now as always, I don't say just blindly deploy this stuff.

Make sure you're testing these algorithms in your environment, find out what they break, what they what value they bring to you, maybe focus on specific areas of your business that have the most need upfront so that you're sure that this isn't gonna disrupt business operations. Because this is a relatively new space, there's still maybe some bugs, some gotchas, some things that we don't know about yet, because these things have only been out a year. So they haven't been fully baked yet with all the beat ups that we've seen with some of the the legacy algorithms. So these are three areas of of focus that you can put on things today to start thinking through the problem and being able to kinda build a strategy around, okay. How are we gonna address these things?

Can we retire some of it? Do we need to upgrade some of it to PQC? If so, what is that gonna look like? Do we start with our network first? Do we start with our datasets first?

Do we start with our data lakes? Think of it in those terms. What's the highest priority for your organization and put some focus on that? And then, again, as you mentioned earlier, you can use any of those four that come out. Again, Kyber's a little different because it's gonna protect your existing key infrastructure.

But if you need a new signatory, if you need something that allows you to have that resilience when it comes to, integrity and, reliability and that nonrepudiation capability, you need to move away from something like Diffie Hellman, which is used to be a great signatory or Shaw. Right? Shaw two two fifty six. You can move into using something like the lithium or Falcon to get you that post quantum resistance signatory capability. Alright, that is it.

I'm open to questions. Thank you everybody for taking time out of your day and good luck. I know this is a pretty scary thing to be dealing with. We'll all get this together and, this won't be the end of the discussion I'm sure. So if you have anything outside of this webinar that you wanna talk about, again, feel free to connect with me on LinkedIn.

Happy to share more details about what we've been investigating, some of the things that I'm involved in that'll help with this problem, and some of the big brains that are being put on this problem.

Speaker 0: Well, that was, that was great, Tommy. I'm, scared and less scared at the same time. I don't know how you made that possible. Couple questions. I'm gonna roll through the questions in the chat maybe in reverse order.

When you're going through the people that are in the quantum chip game

Speaker 1: Mhmm.

Speaker 0: Kenny Connell, who organizes so I don't know if NVIDIA's in the in the quantum, in the quantum game?

Speaker 1: If they are, they haven't made any significant announcements that I've seen. I think they're more focused on the GPU space for AI at the moment. So as far as I'm aware, they have not made any big reveal that they're they're they've got some sort of QC chip that's out there.

Speaker 0: Okay. Cool. I'm gonna roll back, up through here. We went through the preparation areas. One moves out of security and and back to the when you're talking about quantum and AI kind of merging together.

Mhmm. Rashida asked, has AR and VR become more immersive?

Speaker 1: Mhmm.

Speaker 0: Do you have any opinion where should we draw the the ethical line between enhanced reality and manipulated reality? Because I could have I could have, like, some VR goggles on and walking in reality. I mean Yeah. Any,

Speaker 1: Yeah. The augmented reality scene is is pretty spooky. I know Microsoft had a a big one. Google the Google Glass stuff was a a big one for a while. I'm not sure exactly what happened with both of those, activities, but that could be the near future.

You know, we see stuff in Blade Runner where they see things all the time, advertisements and different, replicas. QC can help render a lot of that activity. So I think that we will probably see, augmented reality pick back up because of the processing power. I don't know if VR will ever outpace augmented, in my opinion. We still want semblance of reality when we're walking around.

I I don't know about you guys. I get motion sick, and it doesn't matter how fast the refresh rate is. I wanna vomit. Augmented reality, on the other hand, allows me to have that spatial awareness. So I do think QC and augmented reality can help.

I think if we look at it from a point of how can it benefit mankind, medical procedures. Imagine augmented reality being involved with medical procedures and having the ability to compute things a lot faster than what we see today. There's all kinds of benefits to mankind. There's also a lot of negatives. So it depends on how you look at the approach.

But I do see eventually that marrying of QC and Augmented, probably more so than VR, to make that a more immersive experience.

Speaker 0: Alright. A question from, Rashida. It was back when you're talking about, drug discovery. You may have answered it already, but combining quantum with AI, definitely accelerating things. These I did you see it accelerating like discovering drugs, figuring out molecules, those type of things?

Is that just is it just over the the tip of the horizon?

Speaker 1: I I think we're if we see benefits, I think that's a huge area. Health care is gonna be massive because it'll expedite and accelerate the ability to treat and to create cures. So quantum computing can do simulations way faster than classical computing. Right? So think about all the different ways I can simulate attacking the AIDS virus or, COVID.

You know, I guess, as I mentioned, instead of taking years to develop any kind of a cure, we can do it literally in days because it can think through all the different outcomes and come to some sort of conclusion on what is the best approach moving forward. Classical computers take too much time to do that. To crunch all those data points and to be able to correlate all that information and then do simulations to see how this plays out if we treat it in a certain way is something that quantum computing can bring to the table. I think what you'll start to see is a it'll offset the need to do human trials or animal trials with a lot of these things because I can build it in a simulated environment with so much realism. I don't need to plug a human to see how it's gonna react.

I'll have all that information already defined, and now it's just a matter of simulating it as we go through it. So the simulations are where I see a big win for quantum computing because of the way it can calculate all that. Hopefully, that answered your question.

Speaker 0: I think so. And I, there's a story recently not about quantum computing, but I'm, creating custom, medications for, there's a baby. It has some kind of double mutation. Mhmm. They created a a gene editor specifically for that person after a bunch of not trials, not long trials, but lab experiments.

Appears how it works. Maybe Yeah. Maybe there's custom medicine. Well, on the on the good head on the positive shiny side, there's potentially custom medicine for everybody.

Speaker 1: On the bad side. Medicine. Just plug in the genome. Right? Plug in your your DNA.

Now that we can do DNA we've got DNA sequence, plug that in, and then we can actually say, alright. Here's what your children are gonna look like if you were to have a baby with this person. And here's all the the deficiencies and things that we can attack well before inception. So I I look at it like, yes, it has massive benefits, but so did dynamite. And and, unfortunately, it turned into a weapon.

Right? And so everything has a a a a black and white approach. We like to think it's only gonna be used for good, but, unfortunately, it'll be weaponized far before it becomes beneficial to mankind. And that's, again, that's the cynic in me saying that this is kinda what we should expect, And and that's kinda how we're we're we're looking at it.

Speaker 0: Yep. Alright. Rolling back up to a couple questions from Tui. She's gonna she had a drop off for a team meeting, but she'll catch these on the on the recording. So do you see quantum I can just read these out.

You can take them in any any order. Do you think quantum computing will affect unemployment? We're hearing, you know, scares about AI, you know, taking jobs. I guess you did ask answer some questions what encryptions could resist those, so she'll see those later in the video. Do you see quantum affecting blockchain tech as well?

Does it have the same problem as

Speaker 1: It could. You know, blockchain is all about calculations and, you know, compiling and things of that nature. And so when you think about how quantum computing can accelerate that process, it can come on that it can basically process that ledger much faster than classical computing, which on the good side means less data centers. Right? We don't need to have data harvesting farms that are out there just doing nothing but crunching blockchains all day long to try to mine Bitcoin.

Quantum computing will change the game. And, honestly, the reason why Bitcoin can be so expensive is because the amount of time it took to process. This is why it's out of our hands. I'm not gonna run something like that on my Mac. But give me your own chip, and I can do the same thing as a massive data center, and I'll see the value of Bitcoin drop because it's not that hard to mine anymore.

So I I think it's it's gonna benefit that in a sense if that if you believe in Bitcoin, which those of you who know me know I'm very skeptical about Bitcoin. I'd be love to come back and do a talk on that and release that again for you. So, but now I do see it have an impact directly on that just due to the calculations that are required.

Speaker 0: Yeah. We haven't had any crypto or Bitcoin presentations. That's a good idea. Maybe we'll we'll put it down on the black book of ideas. Yep.

And you did give some examples on on, algorithms to look at. Mhmm. Jess, to AS, what skills, training, knowledge do we need to to prepare ourselves to get ready for these new threats? Any I know there's the the NIST documentation. Anything else that you found worthwhile to build up from beginner to being able to protect our systems?

Speaker 1: Yeah. I mean, fortunately, a lot of the start ups that are in the industry are trying to make it easy for this to be consumed and operationalized. So you don't have to have a lot of skills to understand how it's gonna impact your environment. If you wanna understand the mathematics, like, I'm I'm a guy that operationalized encryption, but if you ask me the underlying math behind these algorithms, I don't know that stuff. And those are for mathematicians.

So I I would say, maybe be aware of the progress with NIST When these algorithms get announced and they get, have a discussion built around them, be involved in that. A lot of people didn't know that there were four that were released last year. Right? On on top of Kyber, we had the other three. Mhmm.

Most people don't know that they've built the fifth standard. Right? So understand where the progress is. And that's why I was saying it's not fully operationalized yet according to NIST. It's close, but it's not fully baked like we see with RSA and Diffie Hellman and ECC, those standards that have long since been evaluated and beaten up on.

So keep ahead of that by keeping, you know, an understanding of where their progress is. But under the hood stuff, no. I wouldn't expect anybody to need to know that. If you're familiar with your common encryption mechanisms such as TLS, HTTPS, SSH, anything that uses encryption as far as the way it works in your environment today, that's what you need to be aware of. And then applying Kyber to that, how that gets applied to your existing key infrastructure.

Speaker 0: Okay. So unless I wanna become a cryptographer, I don't need a PhD in math. I just understand the tools where they apply, recommendations. Yeah. Okay.

That I don't think I could get a PhD in math.

Speaker 1: Yeah. I don't think I'd want to. Every time I'd start looking at algorithm, this one, but yeah. Yeah.

Speaker 0: Alright. Yeah. Kenny says some reason he can't hear me. I don't know. May just be on your end, Kenny.

But I do have one question. It's nontechnical. Ask it to everybody. It's a career question. Sometimes we get, some college age kids or just out of college.

Yep. People that that join us. And it's kind of career advice. Any, any tips to, I don't know, to make a career smoother or more successful or anything that you learn along the way or observed along the way that, you know, that you maybe you wish that you knew when when you were younger?

Speaker 1: You know, it's a great question and it can go in a number of different ways. To me, what I typically tell people is find something that you're passionate about in this industry and stick with that. It's gonna take a couple if you're coming out of college, you're not gonna know. It's gonna take you three or four years to figure out what really gets you motivated in in in the morning. And once you find that, make a career of it because it will help you in the mornings when you're having a bad day, and it will accelerate you when you're having a great day.

This is why data protection and data privacy hit so close to home for me because I'm extremely passionate about it. Mostly because it impacts all of us. When I'm not at work, I still have to worry about data privacy. I still have to worry about data protection. I gotta worry about all the same crap at home as an individual as my company does with protecting organizations.

So find something that's near and dear to your heart that you can really gravitate towards, and if it if it makes you passionate, make a career out of that. And then you'll love your job every day. You won't hate it. Because we all know in cyber, eventually, you get this, you know, cynicism and the fatigue and the battle scars, and you're just, like, like, become a curmudgeon about the whole thing. And and it's probably pretty rare to find somebody as hyped as I am about this kind of stuff, but it's because I love what I do.

I love the passion that I have for the topic.

Speaker 0: And this is not, just for those that haven't met Tom before. He is definitely hyped about it. He didn't get he didn't get extra hyped for the presentation. This is how excited he is about, cybersecurity, all the time, which is, always brings a smile to my face.

Speaker 1: Yep. I did wanna point out that there was one follow-up question to the NVIDIA question about is NVIDIA doing processor chips mostly around, what do these platforms do to help with quantum research? And that's actually a good question. So what NVIDIA is doing, and same thing with AWS, is that instead of building their own chip, they're building out a space where when these chips come online, you'll have a place to test them. Like, they're building out the architecture saying, we'll build it like a cabinet, basically.

Not that that's, you know, a cabinet. You know what I mean. They're building in all of the electrics and all the cooling and everything you're gonna need so that when you bring your chip to the table, you plug it into their environment, and that will help you research a lot of how this is gonna function, does it meet the metrics and the benchmarks that you're looking for. And there seems to be a market for that because I know AWS is doing the same thing, where they're building out environments for people that have quantum chips to come in and play in their space. And, hopefully, that answers your question on that one.

Speaker 0: Yeah. Alright. I'm not seeing any new questions. Rashida, if that answered your question. Hopefully, it did.

And, yeah, definitely appreciate all of the questions in the chat. Thank thank you everybody for that. Well, you leave it open ten seconds, see if anything else, comes through. Yeah. Tommy, definitely appreciate, your time that you've, put into this.