How can we find where we use quantum-vulnerable cryptography?
Start with an inventory: certificates, VPNs, TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. on your servers, SSH, code signing and the libraries your applications use. Network traffic shows a large part of it, because the key exchange of each TLS connection is visible without decryption. NQCI, the NetSenX crypto inventory (in preview), is visible on every plan and active from the Pro plan: it shows which connections use quantum-vulnerable key exchange and which use hybrid post-quantum key exchange. It needs the packet-capture sensor, which is off by default: switched on for a Linux agent, or a sensor on a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. port. The agent's basic mode, used on macOS, does not see TLS handshakes. It gives visibility; the migration itself stays with you and your vendors.
This answer is part of the guide: Post-quantum readiness: where to start
Read next
Related questions
Terms used here
- TLS (Transport Layer Security)
- The encryption that protects most internet traffic, such as HTTPS.
- SPAN (switch port analyser)
- A switch setting that sends a copy of network traffic to one port, where a sensor can watch it.
- TAP (test access point)
- A small device that copies the traffic on a network cable for a sensor to watch.