Several tech giants, including Apple and Google, have embarked on their post-quantum cryptography (PQC) transition journey. PQShield CEO Al El Kaafarani noted that 20% of the dominant players in each industry are expected to begin the PQC migration process this year.

The National Institute of Standards and Technology (NIST) is expected to release its long-awaited PQC standards in the next few weeks. “This switches the whole scenery from readiness and preparing for post-quantum cryptography to compliance,” Kaafarani told SDxCentral.

Kaafarani emphasized the importance of the NIST PQC standard release, noting that many organizations are ready to move to the next phase but are held back by the lack of formal standards. “Some of the partners that we've worked with are super ready now to move to the next phase, where they can actually start selling products with post-quantum cryptography in it. But they can't do this because that's not compliant with any standards,” Kaafarani said.

Tech giants taking the lead Significant strides have been made by leading tech companies in PQC implementations.

Apple earlier this year introduced iMessage with PQ3, which is its first post-quantum cryptographic messaging protocol to reach what the vendor calls “level-3 security.” Google followed suit with its Chrome 124 update that enabled a new quantum-resistant X25519Kyber768 encapsulation mechanism by default for TLS 1.3 and QUIC protocol connections on all desktop platforms to protect Chrome TLS traffic against quantum cryptographic analysis.

Zoom Video Communications announced the global availability of post-quantum end-to-end encryption for Zoom Workplace; Meta initiated a multi-year plan to migrate toward PQC spanning from its internal infrastructure to user-facing apps; and AMD partnered with PQShield to deliver a demonstration of quantum-resistant algorithms deployed on AMD’s high-performance Versal products.

These moves signal the seriousness with which large corporations are approaching the transition to post-quantum cryptography, Kaafarani said.

“But also it shows that sectors are ready, and the guidelines are not things that will stop them if they are drafted and transformed into final guidance, because guidance will always change, but they change at a very high level, they don't change the details of how things should be implemented and where and why,” Kaafarani added.

The supply chain needs to sync on PQC A large number of companies involved in different layers of the cybersecurity supply chain have begun the PQC transition process, or at least the discussion. Other organizations “need to have a complete picture of what are the things that they need to do themselves, which is usually less than 20%, and what are the things that their suppliers have to do and understand from their supplier their timelines,” Kaafarani said.

Banks, for example, rely on hardware security modules (HSMs) and network security from suppliers, and need to know if and when these will be post-quantum secured. Network security vendors need to talk to their semiconductop-of-rack (TOR) suppliers who work with PQC companies for the fundamental post-quantum capabilities.

Everyone in the supply chain needs to be in sync, Kaafarani stressed.

“If someone is using post quantum and others in the sector are not using post quantum, it's going to create some compatibility problems. And therefore you can't isolate yourself from the rest of the crowd by not being able to speak the post-quantum cryptography language,” Kaafarani said. “There's this risk also of falling behind and not being able to continue to work with other providers and other protocols around the world.”

All major web browsers are expected to migrate to PQC in 2024 Kaafarani expects all the major web browsers to support and enable PQC in the second half of this year, noting “if 90% of web browsers are using post-quantum cryptography … then the cloud side or the server side can also switch and use it.”

Kaafarani also predicts that 20% of the dominant players in each sector will start the PQC migration process this year. “You will see that the 20% of the companies that cover 80% of use cases and protocols and solutions and control the market will be the first to move. And then you will see that the rest of the cards will start following suit,” he said.