For federal civilian agencies, the post-quantum cryptography migration clock is now ticking toward a major accountability deadline.

© Federal News Network

The department wants an interim solution to protect programs of record as it works to adopt post-quantum cryptography by the early 2030s.

© Getty Images/iStockphoto/ktsimage

Bitcoin Magazine

The Quantum Issue: Letter From The Editor

Quantum this, quantum that…who put a stupid cat on-chain!?

Ahem. 

Alright, let’s be serious. The threat that a viable, actually functioning, quantum computer would pose to Bitcoin if it were to be built is very serious. It is the concrete example of an existential threat, in every sense of the word. 

One of the bedrock foundations that Bitcoin rests upon is the assumption of a functioning cryptographic system that can be used to produce unforgeable signatures, i.e. that if you follow that system’s protocol properly when signing things, there is no way that anyone but a bitcoin’s rightful owner could produce a signature needed to spend it unless the rightful owner failed to secure their private key from theft. 

Quantum computers toss that right out the window. There goes the integrity of the entire mechanism that is used for owners of bitcoin to authenticate their ownership for the protocol to process their legitimately authorized transactions, and ONLY their legitimately authorized transactions. There’s no way for anyone to actually own anything in the context of the Bitcoin protocol if that assumption breaks. 

Bitcoin breaks if that assumption breaks. 

Thankfully, there are many different cryptographic systems that exist, and not all of them rest on assumptions that a quantum computer breaks. That’s the good news. The bad news is that its all a set of tradeoffs, none of them are ideal, and there are going to be some hard choices that have to be made. 

But there are solutions to just about every one of the problems that a viable quantum computer would create…except the problem of choosing which solutions to use. So in light of that, here is The Quantum Issue. 

This issue is a lot more structured than most past issues, and that is to ensure that it guides a reader through the entirety of the problem space and solution space without assuming any prior understanding (this is a very deep and technical subject). 

The first set of articles goes through the general issue of quantum computing itself, how it differs from classical computing, why that matters, how likely it is one is developed soon, etc.

The second set examines Bitcoin’s exposure. How is it exposed? How badly is it exposed? How can that degree of exposure change? 

The third set examines concrete (or developed enough to not be too hard to get to a concrete place) solutions to securing your bitcoin in a quantum safe way, and handling a network wide migration to those solutions. 

Don’t miss your chance to own The Quantum Issue — featuring articles written by many influential figures in the space working on the necessary pieces for a post-quantum Bitcoin!

This piece is the Letter from the Editor featured in the latest Print edition of Bitcoin Magazine, The Quantum Issue. We’re sharing it here as an early look at the ideas explored throughout the full issue.

This post The Quantum Issue: Letter From The Editor first appeared on Bitcoin Magazine and is written by Shinobi.

Federal agencies need to recognize that the quantum attack surface extends far beyond the cryptographic systems currently prioritized for migration.

© Getty Images/iStockphoto/ipopba

CISA’s top quantum security expert says agencies will need to work closely with industry on the cryptographic transition.

© Getty Images/Dragos Condrea

Welcome back, cyberwarriors! 

Almost a year ago, OTW spoke about quantum computers and the risk of our encryption getting broken within three years. In March, Google shared its concern on the same issue, moving up its own post-quantum migration deadline to 2029. Some companies are migrating to mitigate that risk, but not many are taking it seriously. Eventually, a huge number of companies are going to get left behind with weak and breakable encryption. Hackers will only benefit from that negligence.

To help you minimize the risk and get an actionable plan with recommendations tailored to your company, we want to show you how AC-Scanner works.

AC-Scanner

AC-Scanner is basically a script for post-quantum cryptography exposure assessment. It maps your full cryptographic attack surface across TLS endpoints and SSH services, assesses every asset against NIST post-quantum standards and generates a structured Cryptographic Bill of Materials (CBOM).

Before we continue with the scan, you might want to watch a video by OTW and David Bombal on the risk of quantum computing being able to decrypt things at mass scale and expose session keys.

Setting Up

Docker is the easiest way to get started. We’ll start with the CLI version first, then show you how to get the web version up and running. They both work the same way, so you can choose any.

First install Docker on your system:

ubuntu > sudo apt update
ubuntu > sudo apt install docker.io

Then switch to root and pull it:

root > docker pull qubitac/acscanner:latest

Now it’s ready, so let’s see the help menu. 

root > docker run --rm -it qubitac/acscanner:latest bash -c 'rm -f /.dockerenv && cd /app/scripts && ./scan.sh -h'

We’re only interested in the presets here. As you can see, you can test basically any of your assets.

Scanning Assets – CLI

Let’s choose some random Russian company for this scan. We don’t intend them to benefit from the results, we will just use it for demonstration to show how prevalent the issue is.

For our scan we used –all to scan everything: 

root > mkdir -p ~/ac-scans/example.com && docker run --rm -it -v ~/ac-scans/example.com:/app/scripts/example.com qubitac/acscanner:latest bash -c 'rm -f /.dockerenv && cd /app/scripts && ./scan.sh --noinstall example.com --all'

If you’re testing a big company, it will take time. 

Results will be stored in ~/ac-scans

Here we only need crypto-bom.json that’s hiding in cbom.

Results

Upload crypto-bom.json to the dashboard by clicking Load CBOM. You will see the overview. 

You can already see the infrastructure is not PQC ready and has several critical issues. 

The next step is HTTPS. Although 9 of their endpoints are using HTTPS, it’s vulnerable and the risks are high.

The scanner tried to fingerprint the SSH endpoints too, but they weren’t open.

Let’s look at the issues that the company has. It will show all the affected hosts with severity assigned to each. 

Quantum risks may help tracking the progress of your migration. The results below are from a different company, but you can see they have only 3 PQC ready hosts out of 308. 

Recommendations will help you address issues by giving you prioritized actions. 

The recommendations were intentionally redacted by us to make them unusable. However, you can still clearly see how the page is structured.

Finally, your main goal is migration. Here it lists all the migration phases and gives you deadlines by which they need to be completed. 

As you can see, legacy TLS should be abandoned by 2027 and hybrid PQC key exchange should be introduced no later than 2028. That applies to everyone, not just this organization in particular. The report gives clarity and orients your client so there’s no confusion.

Scanning Assets – Web

If you don’t want to work in the terminal, you can use the web version. 

root > docker pull qubitac/acscanner
root > docker run -d --name acscanner -p 8080:80 qubitac/acscanner:latest 

It’s available in the browser on http://localhost:8080/.

Summary

AC-Scanner is easy to work with if you use Docker, otherwise you’ll run into some incompatibility issues. The dashboard has all the valuable information and most importantly it’s actionable and orienting. You don’t just see the vulnerabilities, you get a guide with recommendations on how to fix them too. Your client will definitely appreciate that.

Want to learn how to prepare your network for the post-quantum world? Join our Preparing Your Network for the Post-Quantum World training, taking place October 13-15 at 3 PM UTC. Available exclusively to Subscriber PRO students.

The post Quantum Resistance: Scanning Company Assets for PQC Readiness first appeared on Hackers Arise.

GSA is updating its Federal Identity, Credential and Access Management architecture as Treasury launches a new task force for the financial sector.

© Federal News Network

American Binary: Why “Mostly Post Quantum” Is Another Way to Say Vulnerable If you’ve sat through a vendor briefing in the last 2 years, you’ve been told your stack is...

The post Innovator Spotlight: American Binary appeared first on Cyber Defense Magazine.