What should a small company do about post-quantum cryptography now?

Mostly cheap, ordinary things. First, keep browsers, operating systems, VPN clients, servers and libraries up to date: much of the post-quantum change arrives through updates, and modern browsers already use hybrid key exchange by default. Second, list where you use cryptography you control yourself: your website and its hosting, remote access, e-mail, file transfer with customers, and any appliance with its own certificates. Third, mark the data that must stay secret for many years. Fourth, add one question to every new purchase or contract renewal: does the product support hybrid post-quantum key exchange, and if not, when? Fifth, prefer suppliers that can change algorithms through updates. Buying special quantum products is not on the list. NetSenX can help with the second step: NQCI, in preview, is visible on every plan and active from the Pro plan, and needs the packet-capture sensor, off by default, switched on for a Linux agent or a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it./TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. sensor; the basic macOS mode does not see handshakes.

← All 33 questions on Post-quantum cryptographyAll topics