RSA-nxiety: Coping in a Post-Quantum World (If you cant beat em, join em post — could not

RSA-nxiety: Coping in a Post-Quantum World

(If you cant beat em, join em post - could not make funny enuff for a friday drop - so it's not going to be as funny as Fentanyl...)

I am only saying this as lots of noise in this echo chamber, but not much advice, well ho hum...

Q-Day isn’t doomsday. It’s due-day. Adversaries already run Harvest-Now-Decrypt-Later; we’re still arguing about slide templates. Here’s the anti-panic plan that ships.

What’s actually true (no hype, some dread):
Shor is real; timelines aren’t. Plan for uncertainty, not comfort.
Archive risk > transit risk. Backups, archives, CA roots, code-signing = soft belly.
Crypto-agility beats clairvoyance. If you can swap algos fast, dates matter less.

90-day protocol (speed with receipts):

0–30: Inventory or it isn’t real. Map where crypto lives (TLS, IPsec, SSH, at-rest, HSMs, firmware, appliances). Tag: Algo | Key length | Lifetime | Owner. Start with roots, archives, signing.

31–60: Triage by decrypt-later pain.
Tier 3: CA roots, code-signing, archives/PII lakes.
Tier 2: TLS for high-value apps, VPN, S/MIME.
Tier 1: Internal chatter.
Shorten lifetimes. Re-key crown jewels.

61–90: Build agility, then swap. Abstract via KMS/HSM front-ends so apps speak interfaces, not curves. Use hybrid key exchange (classical + PQ) where supported. Standardize on NIST PQC families (Kyber/Dilithium) as they harden. Timestamp code-signing.

Vendors & verification:
Contracts include PQC support + dated roadmap.
SBOM + Crypto BOM or it didn’t happen.
Metrics: % assets profiled, % critical flows on hybrid/PQ, median key lifetime, TB re-encrypted/week, # vendors with signed roadmap.

Common face-plants in the sh*t (and fixes):
Boil-the-ocean scans. → Start with roots/archives/signing, fan out.
Wait for perfect standards. → Ship crypto-agility now; swap algorithms later.
One-and-done “migration.” → Treat crypto like patching: continuous.
Tattoo line: Curve your enthusiasm. Lattice your future.

We don’t predict Q-Day—we make it irrelevant.

That's it - not that exciting really 🚾

— Scott G