Viewing profile — bwesterb

Most approaches have missing "capabilities" that can be tracked. Adam Zalcman lays them out for superconducting qubits here. https://westerbaan.name/~bas/rwpqc2026/adam.pdf For the…

Scott used to be that guy.

The abacus thing is pretty funny, but it's dangerously uninformed. https://bas.westerbaan.name/notes/2026/04/02/factoring.html

It'll be a 90/10 rule: 90% of the upgrades will be straightforward. It's important the 10% that'll be hard early. For many it's probably already too late.

QKD is cool and all, but it just doesn't scale to the whole Internet. https://blog.cloudflare.com/you-dont-need-quantum-hardware/

Where available, you can migrate. Even if PQ is not yet available it helps to: 1. Make sure your dependencies are up to date. Move to a recent version of your crypto libraries. 2. …

We're almost done countering store-now/decrypt-later, but the biggest part of the job, post-quantum authentication, still remains. Like Google, we target 2029 to be done .

SSH is working on a drop-in as we speak. TLS is further along: most stacks already support X25519MLKEM768 (by default!) to counter store-now/decrypt-later. PQ certs are not widely …

When it's real, it's too late.

You sure? Defenders get funding if things break—not when they actually did their job.

Yeah, it's rough. Important to understand now for each product / system what the business impact is if it's not upgraded in time.

They are large, but they're not that slow actually. We've been testing them for almost a decade now. I agree that rushing is bad. That's why we need to start moving now, so that we…

Yeah, PQ certificate transparency is crucial for downgrade protection: https://westerbaan.name/~bas/rwpqc2026/bas.pdf

> I could also be misremembering our conversation, but I thought you had said something like 2029 or 2030 in our 2020 conversation Think that must've been around 2022. It'd have be…

No need for a TLS 1.4. Leaf certificates don't last long, but root CAs do. An attacker can just mint new certs from a broken root key. Hopefully many devices can be upgraded to PQ …

Waiting now means rushing even more close to the deadline! We added stats on origin support for post-quantum encryption. Not as much support as browsers of course, but better than …

If we do our job, it changes nothing. Problem with security generally: no spectacle if it's all correct. :)

At least it's time bound: hope to have this job done by 2029!

Don't recognise you from your username, but thanks for the respect. (Update: ah, Vitali! Nice to hear from you.) If you look back at my writing from 2025 and earlier, I'm on the co…

The key will be 40x larger. Not that bad for the certs. It'll be about 15kB extra. Will depend on your use case if that's bad. For video it's fine. But not all browsing is video. A…

Also just now Chrome published https://www.chromium.org/Home/chromium-security/post-quantum...

Yeah, filed https://github.com/mozilla/ssl-config-generator/issues/342

Merkle Tree Certificates basically uses the same structure as Certificate Transparency today. Merkle Ladder uses a weird variation claimed to be useful to DNSSEC. I think it's rath…

Client would check perhaps once a day. Similar to how Chrome checks about once a day for urgent revocations.