Cloudflare and Signal Are Already Quantum-Safe: Is Your Organisation?

[Sienna74]

IBM's Q-Day article from yesterday features two companies whose behaviour is more instructive than any timeline prediction. Cloudflare started preparing for post-quantum cryptography in 2017. Signal has implemented post-quantum cryptographic protocols in its messaging. These are not quantum computing companies. They are infrastructure companies that looked at the threat landscape and concluded that waiting was more dangerous than preparing early.

Cloudflare's motivation is scale. A quarter of internet traffic flows through them. Upgrading their cryptography means upgrading the default security of a significant portion of the internet. They couldn't wait for Q-Day to be officially declared because by then the damage to the traffic they handle would already be in progress.

Signal's motivation is confidentiality. Messages that need to remain private for years into the future are vulnerable to harvest now decrypt later. Their users include journalists activists and people in authoritarian states whose communications could be harvested today and decrypted later. The threat is present for Signal users in ways that justify the engineering investment now.

What do these examples tell organisations that aren't Cloudflare or Signal? That the migration is achievable, the technology is available and the planning horizon is now not later.

Q-Day has already begun. Are you ready? | IBMwww.ibm.com