The Quantum computing industry is making leaps and bounds towards developing quantum computers that can–among other things–break the encryption that keeps our data safe and confidential. Some say it will take place in as little as two years, but even the most conservative estimates are for four years or 2030. In either case, it is time to begin to prepare your network for the coming post-quantum world.
To learn more about this risk, see my interview with David Bombal on Quantum Computing here.
When that day arrives, all of our encryption– and therefore all our data– will be exposed to anybody who has a quantum computer. Initially, this will be only nation state actors such as the US, China, Israel, and Russia.
No need to fret or stress as people have been preparing for this day for many years and have developed post-quantum cryptography (PQC). This field is in constant flux and recently one of the post-quantum cryptographic algorithms (HAWK) was found to be breakable by quantum computers. The point here is that this field is changing rapidly, not unlike artificial intelligence.
Some people have compared this to the Y2K crisis that took place some 26 years ago. At that time, nearly everybody was looking for a crisis that would break systems once we transitioned from a two-digit year to a four-digit year.The fact that no crises took place in 2000 can be attributed to years of preparedness for that potential crisis. Companies and institutions spent at least two or three years preparing for it and as a result nothing adverse really took place. It all went very smoothly.
For your organization, you need to start preparing now. To help you to prepare, Hackers Arise has developed a course on preparing your network for the post-quantum world. The training will be offered over 3 days October 13-15.
Post-Quantum Network Readiness
Outline
1.What are Quantum Computers are What Makes them Different
2. The Quantum Countdown: Harvest-Now-Decrypt-Later & Why Your Network Is Already Exposed
3. Know Your Attack Surface: Automated Cryptographic Discovery & CBOM
4. The New Arsenal in Action: NIST PQC Standards (ML-KEM, ML-DSA, SLH-DSA) with OpenSSL 3.5 & liboqs
5. Hardening the Wire: Hybrid TLS 1.3 & Quantum-Safe Tunnels
6. Post-Quantum PKI at Scale: Certificates, Signature Bloat & Real Network Performance Impact
7. From Vulnerable to Quantum-Ready: A Phased Migration Roadmap, Crypto-Agility & End-to-End
Almost a year ago, OTW spoke about quantum computers and the risk of our encryption getting broken within three years. In March, Google shared its concern on the same issue, moving up its own post-quantum migration deadline to 2029. Some companies are migrating to mitigate that risk, but not many are taking it seriously. Eventually, a huge number of companies are going to get left behind with weak and breakable encryption. Hackers will only benefit from that negligence.
To help you minimize the risk and get an actionable plan with recommendations tailored to your company, we want to show you how AC-Scanner works.
AC-Scanner
AC-Scanner is basically a script for post-quantum cryptography exposure assessment. It maps your full cryptographic attack surface across TLS endpoints and SSH services, assesses every asset against NIST post-quantum standards and generates a structured Cryptographic Bill of Materials (CBOM).
Before we continue with the scan, you might want to watch a video by OTW and David Bombal on the risk of quantum computing being able to decrypt things at mass scale and expose session keys.
Setting Up
Docker is the easiest way to get started. We’ll start with the CLI version first, then show you how to get the web version up and running. They both work the same way, so you can choose any.
root > docker run --rm -it qubitac/acscanner:latest bash -c 'rm -f /.dockerenv && cd /app/scripts && ./scan.sh -h'
We’re only interested in the presets here. As you can see, you can test basically any of your assets.
Scanning Assets – CLI
Let’s choose some random Russian company for this scan. We don’t intend them to benefit from the results, we will just use it for demonstration to show how prevalent the issue is.
If you’re testing a big company, it will take time.
Results will be stored in ~/ac-scans
Here we only need crypto-bom.json that’s hiding in cbom.
Results
Upload crypto-bom.json to the dashboard by clicking Load CBOM. You will see the overview.
You can already see the infrastructure is not PQC ready and has several critical issues.
The next step is HTTPS. Although 9 of their endpoints are using HTTPS, it’s vulnerable and the risks are high.
The scanner tried to fingerprint the SSH endpoints too, but they weren’t open.
Let’s look at the issues that the company has. It will show all the affected hosts with severity assigned to each.
Quantum risks may help tracking the progress of your migration. The results below are from a different company, but you can see they have only 3 PQC ready hosts out of 308.
Recommendations will help you address issues by giving you prioritized actions.
The recommendations were intentionally redacted by us to make them unusable. However, you can still clearly see how the page is structured.
Finally, your main goal is migration. Here it lists all the migration phases and gives you deadlines by which they need to be completed.
As you can see, legacy TLS should be abandoned by 2027 and hybrid PQC key exchange should be introduced no later than 2028. That applies to everyone, not just this organization in particular. The report gives clarity and orients your client so there’s no confusion.
Scanning Assets – Web
If you don’t want to work in the terminal, you can use the web version.
It’s available in the browser on http://localhost:8080/.
Summary
AC-Scanner is easy to work with if you use Docker, otherwise you’ll run into some incompatibility issues. The dashboard has all the valuable information and most importantly it’s actionable and orienting. You don’t just see the vulnerabilities, you get a guide with recommendations on how to fix them too. Your client will definitely appreciate that.
Many of us are being pushed toward insecure messengers and social networks. These communication channels may be monitored and are not trustworthy. That does not mean private communication is impossible. Far from it. One of the oldest and most practical problems in cryptography is how to send a secret message through an open channel without making the message obvious to anyone who sees it. And that problem has already been solved very well.
The encrypted text does not always have to look like encrypted text. A message can be hidden in plain sight so that it looks like ordinary content, or it can be embedded inside something else entirely, such as audio, video, or text that does not raise suspicion. That is the realm of steganography. Cryptography protects the meaning. Steganography helps hide the fact that a message exists at all.
For most people, though, the real need is much simpler. They want a practical and convenient way to encrypt messages quickly and reliably. So let’s look at some easy tools that make that possible.
Workflow
The workflow is always the same. First, the sender and recipient agree on a secret password or passphrase. A short sentence made up of several words is often better than a single word because it is easier to remember and usually much stronger. Then the sender pastes the message into the tool, clicks Encrypt, enters the password, and sends the resulting encrypted text through whatever channel they want, even if that channel is insecure. The recipient then uses the same tool and the same password to decrypt the message.
That is the basic pattern, and it stays consistent across different tools and platforms.
Web-Based Encryption Tools
There are browser-based applications that can encrypt text very effectively, and they are often the easiest place to begin. But there is one very important detail. You want to make sure the encryption happens entirely on the client side. That means the message is processed inside your browser, on your own machine, and the password never leaves your device. If the server never sees the key, the risk of leakage is much lower.
That point is worth checking. A good looking website is not automatically secure. One way to verify local processing is to monitor browser traffic using Developer Tools, or DevTools, and see whether your password is being sent over the network. Another way is to use a firewall application such as Little Snitch and observe whether the service tries to communicate with remote servers during encryption or decryption. If the system is truly local, the encrypted message can later be decrypted either through the same browser-based Decrypt form or offline with OpenSSL.
There are a few websites out there.
The first one is Encrypt Online. It uses AES-256-CBC to encrypt text, strings, JSON, YAML and config data directly in your browser. It’s considered to be a strong, mathematically unbreakable encryption algorithm.
Paranoia Text Encryption uses AES-256 in EAX mode with keys derived from passwords using Argon2. That combination is strong and modern.
LOCK.PUB is another browser-based option, focused on creating encrypted online notes, polls, images, audio and a lot more. The content can only be accessed with the correct password.
For users who want something more flexible and technical, GCHQ CyberChef is a powerful open-source option from the UK’s GCHQ intelligence agency. It supports many encryption and encoding operations.
AES Utils is another choice, using AES-256-GCM with PBKDF2 while keeping the interface simple.
Warning
As a contrast, it is useful to look at what should not be considered a proper secure solution. MagicTool encrypts and decrypts text without requiring a password.
At first glance that may sound convenient, but from a cryptographic point of view it means the same built-in secret is used every time. If anyone knows the website and the service’s behavior, they may be able to infer or recover the messages. In that setup, the tool itself is functioning like the secret key simply by existing.
That is not a strong cryptographic model. However, in some situations, “encryption” without a user-provided key could still serve a purpose. For example, it might be used to deceive an adversary into believing you are an inexperienced user who does not know how to encrypt messages properly, when your real objective is to feed them specific information in a controlled manner.
Offline Encryption Software
Browser tools are convenient, but sometimes you want something local, traditional, and fully under your control. Linux, Windows, and macOS all have native or widely trusted applications that can encrypt text and files without relying on a remote browser service.
Common examples include command-line tools such as GnuPG, OpenSSL, and ccrypt, along with password managers, VeraCrypt, Cryptomator, and a wide range of similar utilities. These tools are often used not only for text messages but also for file encryption, container protection, and secure storage.
Offline tools have an advantage because they reduce the number of outside systems involved in the process. You are not dependent on a remote website staying available, and you do not need to trust a third-party server with your content or password. For many users, that is a better model from a privacy perspective. At the same time, it is important to understand that privacy tools still leave traces. On a Windows system, a digital forensics investigator may be able to see installation artifacts, program execution history, registry keys, recent files, shortcut files, jump lists, user activity traces, prefetch data and remnants of encrypted containers or text editors. Even when the content itself remains protected, the fact that you used a particular application may still be visible in the system’s history.
That is why privacy-conscious users often prefer systems that are designed to leave fewer traces by default. A privacy-oriented operating system, live environment, or hardened Linux distribution can be a better choice when your goal is to reduce unnecessary local exposure.
Summary
Encrypting messages is a simple and useful privacy skill. Whether you use a browser-based tool or you prefer offline software the basic principle is the same.
The right tool depends on the situation. Browser-based tools are convenient and fast. Offline tools give you more independence and more control. Some systems are designed for strong cryptography, while others are only suitable for demonstration or deceptive use. Understanding the difference matters.
If you want to go deeper into how privacy can be preserved on real systems and how forensic traces are created and analyzed, our Anti-Forensics training is your next step. We covered advanced techniques for preserving your privacy and understanding what investigators can still see even when you think you have covered your tracks.
Login
