The Quantum computing industry is making leaps and bounds towards developing quantum computers that can–among other things–break the encryption that keeps our data safe and confidential. Some say it will take place in as little as two years, but even the most conservative estimates are for four years or 2030. In either case, it is time to begin to prepare your network for the coming post-quantum world.

To learn more about this risk, see my interview with David Bombal on Quantum Computing here.

When that day arrives, all of our encryption– and therefore all our data– will be exposed to anybody who has a quantum computer. Initially, this will be only nation state actors such as the US, China, Israel, and Russia.

No need to fret or stress as people have been preparing for this day for many years and have developed post-quantum cryptography (PQC). This field is in constant flux and recently one of the post-quantum cryptographic algorithms (HAWK) was found to be breakable by quantum computers. The point here is that this field is changing rapidly, not unlike artificial intelligence.

Some people have compared this to the Y2K crisis that took place some 26 years ago. At that time, nearly everybody was looking for a crisis that would break systems once we transitioned from a two-digit year to a four-digit year.The fact that no crises took place in 2000 can be attributed to years of preparedness for that potential crisis. Companies and institutions spent at least two or three years preparing for it and as a result nothing adverse really took place. It all went very smoothly.

For your organization, you need to start preparing now. To help you to prepare, Hackers Arise has developed a course on preparing your network for the post-quantum world. The training will be offered over 3 days October 13-15.

Post-Quantum Network Readiness

Outline

1.What are Quantum Computers are What Makes them Different

2. The Quantum Countdown: Harvest-Now-Decrypt-Later & Why Your Network Is Already Exposed

3. Know Your Attack Surface: Automated Cryptographic Discovery & CBOM

4. The New Arsenal in Action: NIST PQC Standards (ML-KEM, ML-DSA, SLH-DSA) with OpenSSL 3.5 & liboqs

5. Hardening the Wire: Hybrid TLS 1.3 & Quantum-Safe Tunnels

6. Post-Quantum PKI at Scale: Certificates, Signature Bloat & Real Network Performance Impact

7. From Vulnerable to Quantum-Ready: A Phased Migration Roadmap, Crypto-Agility & End-to-End 

The post Post-Quantum Network Readiness first appeared on Hackers Arise.

Welcome back, cyberwarriors! 

Almost a year ago, OTW spoke about quantum computers and the risk of our encryption getting broken within three years. In March, Google shared its concern on the same issue, moving up its own post-quantum migration deadline to 2029. Some companies are migrating to mitigate that risk, but not many are taking it seriously. Eventually, a huge number of companies are going to get left behind with weak and breakable encryption. Hackers will only benefit from that negligence.

To help you minimize the risk and get an actionable plan with recommendations tailored to your company, we want to show you how AC-Scanner works.

AC-Scanner

AC-Scanner is basically a script for post-quantum cryptography exposure assessment. It maps your full cryptographic attack surface across TLS endpoints and SSH services, assesses every asset against NIST post-quantum standards and generates a structured Cryptographic Bill of Materials (CBOM).

Before we continue with the scan, you might want to watch a video by OTW and David Bombal on the risk of quantum computing being able to decrypt things at mass scale and expose session keys.

Setting Up

Docker is the easiest way to get started. We’ll start with the CLI version first, then show you how to get the web version up and running. They both work the same way, so you can choose any.

First install Docker on your system:

ubuntu > sudo apt update
ubuntu > sudo apt install docker.io

Then switch to root and pull it:

root > docker pull qubitac/acscanner:latest

Now it’s ready, so let’s see the help menu. 

root > docker run --rm -it qubitac/acscanner:latest bash -c 'rm -f /.dockerenv && cd /app/scripts && ./scan.sh -h'

We’re only interested in the presets here. As you can see, you can test basically any of your assets.

Scanning Assets – CLI

Let’s choose some random Russian company for this scan. We don’t intend them to benefit from the results, we will just use it for demonstration to show how prevalent the issue is.

For our scan we used –all to scan everything: 

root > mkdir -p ~/ac-scans/example.com && docker run --rm -it -v ~/ac-scans/example.com:/app/scripts/example.com qubitac/acscanner:latest bash -c 'rm -f /.dockerenv && cd /app/scripts && ./scan.sh --noinstall example.com --all'

If you’re testing a big company, it will take time. 

Results will be stored in ~/ac-scans

Here we only need crypto-bom.json that’s hiding in cbom.

Results

Upload crypto-bom.json to the dashboard by clicking Load CBOM. You will see the overview. 

You can already see the infrastructure is not PQC ready and has several critical issues. 

The next step is HTTPS. Although 9 of their endpoints are using HTTPS, it’s vulnerable and the risks are high.

The scanner tried to fingerprint the SSH endpoints too, but they weren’t open.

Let’s look at the issues that the company has. It will show all the affected hosts with severity assigned to each. 

Quantum risks may help tracking the progress of your migration. The results below are from a different company, but you can see they have only 3 PQC ready hosts out of 308. 

Recommendations will help you address issues by giving you prioritized actions. 

The recommendations were intentionally redacted by us to make them unusable. However, you can still clearly see how the page is structured.

Finally, your main goal is migration. Here it lists all the migration phases and gives you deadlines by which they need to be completed. 

As you can see, legacy TLS should be abandoned by 2027 and hybrid PQC key exchange should be introduced no later than 2028. That applies to everyone, not just this organization in particular. The report gives clarity and orients your client so there’s no confusion.

Scanning Assets – Web

If you don’t want to work in the terminal, you can use the web version. 

root > docker pull qubitac/acscanner
root > docker run -d --name acscanner -p 8080:80 qubitac/acscanner:latest 

It’s available in the browser on http://localhost:8080/.

Summary

AC-Scanner is easy to work with if you use Docker, otherwise you’ll run into some incompatibility issues. The dashboard has all the valuable information and most importantly it’s actionable and orienting. You don’t just see the vulnerabilities, you get a guide with recommendations on how to fix them too. Your client will definitely appreciate that.

Want to learn how to prepare your network for the post-quantum world? Join our Preparing Your Network for the Post-Quantum World training, taking place October 13-15 at 3 PM UTC. Available exclusively to Subscriber PRO students.

The post Quantum Resistance: Scanning Company Assets for PQC Readiness first appeared on Hackers Arise.