Running complicated algorithms on quantum computing hardware is going to require the use of logical qubits, where collections of hardware qubits are linked together in ways that allow errors to be detected and corrected. In general, the more hardware qubits you dedicate to each logical qubit, the better the chances are of identifying errors. But, given that the hardware qubits are prone to errors, adding more of them also increases the probability that errors will occur. If the hardware error rate is too high, then growing the logical qubit will only make matters worse.
Fortunately, several companies have demonstrated hardware where the error rate is not too high. Several demonstrations show logical qubits are beyond the breakeven point, where adding more qubits improves performance. The problem is that the improvement isn't very dramatic. To lower error rates to levels we'll need to run complex algorithms, we'd have to add a completely impractical number of qubits to each logical qubit.
On Monday, Quantinuum announced that its current generation of hardware is capable of scaling well beyond the breakeven point. Each step up in the size of logical qubits improved some measures of their performance by a factor of over 10.
Quantum Readiness Day on September 24 is a useful reminder that the security work we do today is not only about preventing breaches tomorrow. It is about protecting data and digital trust for years to come.
The Quantum computing industry is making leaps and bounds towards developing quantum computers that can–among other things–break the encryption that keeps our data safe and confidential. Some say it will take place in as little as two years, but even the most conservative estimates are for four years or 2030. In either case, it is time to begin to prepare your network for the coming post-quantum world.
To learn more about this risk, see my interview with David Bombal on Quantum Computing here.
When that day arrives, all of our encryption– and therefore all our data– will be exposed to anybody who has a quantum computer. Initially, this will be only nation state actors such as the US, China, Israel, and Russia.
No need to fret or stress as people have been preparing for this day for many years and have developed post-quantum cryptography (PQC). This field is in constant flux and recently one of the post-quantum cryptographic algorithms (HAWK) was found to be breakable by quantum computers. The point here is that this field is changing rapidly, not unlike artificial intelligence.
Some people have compared this to the Y2K crisis that took place some 26 years ago. At that time, nearly everybody was looking for a crisis that would break systems once we transitioned from a two-digit year to a four-digit year.The fact that no crises took place in 2000 can be attributed to years of preparedness for that potential crisis. Companies and institutions spent at least two or three years preparing for it and as a result nothing adverse really took place. It all went very smoothly.
For your organization, you need to start preparing now. To help you to prepare, Hackers Arise has developed a course on preparing your network for the post-quantum world. The training will be offered over 3 days October 13-15.
Post-Quantum Network Readiness
Outline
1.What are Quantum Computers are What Makes them Different
2. The Quantum Countdown: Harvest-Now-Decrypt-Later & Why Your Network Is Already Exposed
3. Know Your Attack Surface: Automated Cryptographic Discovery & CBOM
4. The New Arsenal in Action: NIST PQC Standards (ML-KEM, ML-DSA, SLH-DSA) with OpenSSL 3.5 & liboqs
5. Hardening the Wire: Hybrid TLS 1.3 & Quantum-Safe Tunnels
6. Post-Quantum PKI at Scale: Certificates, Signature Bloat & Real Network Performance Impact
7. From Vulnerable to Quantum-Ready: A Phased Migration Roadmap, Crypto-Agility & End-to-End
Almost a year ago, OTW spoke about quantum computers and the risk of our encryption getting broken within three years. In March, Google shared its concern on the same issue, moving up its own post-quantum migration deadline to 2029. Some companies are migrating to mitigate that risk, but not many are taking it seriously. Eventually, a huge number of companies are going to get left behind with weak and breakable encryption. Hackers will only benefit from that negligence.
To help you minimize the risk and get an actionable plan with recommendations tailored to your company, we want to show you how AC-Scanner works.
AC-Scanner
AC-Scanner is basically a script for post-quantum cryptography exposure assessment. It maps your full cryptographic attack surface across TLS endpoints and SSH services, assesses every asset against NIST post-quantum standards and generates a structured Cryptographic Bill of Materials (CBOM).
Before we continue with the scan, you might want to watch a video by OTW and David Bombal on the risk of quantum computing being able to decrypt things at mass scale and expose session keys.
Setting Up
Docker is the easiest way to get started. We’ll start with the CLI version first, then show you how to get the web version up and running. They both work the same way, so you can choose any.
root > docker run --rm -it qubitac/acscanner:latest bash -c 'rm -f /.dockerenv && cd /app/scripts && ./scan.sh -h'
We’re only interested in the presets here. As you can see, you can test basically any of your assets.
Scanning Assets – CLI
Let’s choose some random Russian company for this scan. We don’t intend them to benefit from the results, we will just use it for demonstration to show how prevalent the issue is.
If you’re testing a big company, it will take time.
Results will be stored in ~/ac-scans
Here we only need crypto-bom.json that’s hiding in cbom.
Results
Upload crypto-bom.json to the dashboard by clicking Load CBOM. You will see the overview.
You can already see the infrastructure is not PQC ready and has several critical issues.
The next step is HTTPS. Although 9 of their endpoints are using HTTPS, it’s vulnerable and the risks are high.
The scanner tried to fingerprint the SSH endpoints too, but they weren’t open.
Let’s look at the issues that the company has. It will show all the affected hosts with severity assigned to each.
Quantum risks may help tracking the progress of your migration. The results below are from a different company, but you can see they have only 3 PQC ready hosts out of 308.
Recommendations will help you address issues by giving you prioritized actions.
The recommendations were intentionally redacted by us to make them unusable. However, you can still clearly see how the page is structured.
Finally, your main goal is migration. Here it lists all the migration phases and gives you deadlines by which they need to be completed.
As you can see, legacy TLS should be abandoned by 2027 and hybrid PQC key exchange should be introduced no later than 2028. That applies to everyone, not just this organization in particular. The report gives clarity and orients your client so there’s no confusion.
Scanning Assets – Web
If you don’t want to work in the terminal, you can use the web version.
It’s available in the browser on http://localhost:8080/.
Summary
AC-Scanner is easy to work with if you use Docker, otherwise you’ll run into some incompatibility issues. The dashboard has all the valuable information and most importantly it’s actionable and orienting. You don’t just see the vulnerabilities, you get a guide with recommendations on how to fix them too. Your client will definitely appreciate that.
Login
