The Post Quantum Readiness Outlook

Hey everyone, welcome back here to Techstrong TV. My next guest is Kevin Hilscher. Kevin is the Senior Director of Product Management over at DigiCert, our friends at DigiCert.

First of all, Kevin, welcome to Techstrong TV. It's great to have you on here. Thanks for inviting me.

Good to be back. It is, and I apologize, we had some technical difficulties and a hiccup. Sometimes when things just go wrong, they snowball.

But anyway, it is great to have you back on. Kevin, I mentioned you're Senior Director of Product Management at DigiCert, but give people a sense of your journey. Yeah.

So I look after all things post-quantum at DigiCert from a product perspective. That includes getting our platform enabled for things like MLDSA, MLCamp, post-quantum, getting some new products to market, talking to customers about their challenges in this transition. And so that's my day job.

It's really fascinating, a lot of fun, and it's in a space that's moving very quickly right now. Yes, it is. But Kevin, when we talk about DigiCert, I don't want people to think that DigiCert is all quantum all the time, though quantum is a very big event horizon coming up for you guys.

But DigiCert's actually one of the leaders in the world in digital certificates and security, securing identities and so forth like that. But I work for Techstrong. I'm going to ask you as the DigiCert person to describe DigiCert.

Yeah. So DigiCert all up is one of the world's largest public issuer of SSL certificates or digital certificates for browsers, for websites, for all sorts of use cases. We've been in this space for many years.

We also sit in amongst many of the standards bodies that surround this whole industry and ecosystem, CA/B Forum or the CA Browser Forum, IETF. And we're a worldwide global company. We have our own offerings, private certificate issuance, certificate lifecycle management, IoT security solutions.

So we have a full portfolio of solutions at DigiCert, to your point, and we're not just about post-quantum or PQC. Absolutely not. It's not just about that.

But as I mentioned, this whole quantum thing is a big thing on the event horizon, not just for DigiCert, but for all of us, right? I was reading an article, it was an older article from June. It used to be June wasn't, and you're in July, it wasn't that old an article, but in this AI post-quantum world we're moving to- Mm-hmm ...

was a lifetime ago. Mm-hmm. But it was saying how they used a quantum computer, and that's always a little hokey at this point because we don't really have true qubit quantum stuff.

But they were using the computer, and it broke something. Oh, no, it took a problem that would take traditional computing centuries and basically did it in, I think, an hour or something like that. Like crazy.

Nevertheless, Kevin, I grew up where quantum was always five to 10 years out. Finally, we're not saying five to 10 years anymore, right? A lot of people have stuck flags in the ground saying '28, '29- Yeah ...

they'll have commercial quantum available. The good news is, for once in my lifetime anyway, the security industry seems to be getting out ahead, right? Post-quantum algorithms, quantum safe algorithms.

Post-quantum cryptography, the whole thing has really been gathering a lot of steam. It's gotten a lot of support from the federal government recently, the whole quantum computing piece of it. Yes.

So look, this is real, getting more real every day. Last year, we were really happy to be partnering with DigiCert on the Quantum Security 25 list, the top 25 people in quantum. I think we're going to maybe do something this year.

Something's going on. A World Quantum Day is coming. But Kevin, you guys also did your annual Quantum Readiness Outlook Report.

We did. Yeah. So we've had- Let's hear it Yeah.

So every year, we go to our customers and to the market, and we ask them around what they're doing relative to their journey to be quantum safe, right? And a few years ago, it was all about education. They didn't even know this was a thing.

When I talk to customers frequently, they're like, "We don't even believe quantum computers are even on the near-term horizon. " Right? So the whole education piece was a big challenge back then.

Now, the awareness is super high. And in our Quantum Readiness Outlook Report that we recent released, we found that readiness or awareness is really high. Eighty-five percent of our customers already believe that the current encryption standards will be broken within a decade.

Eighty-seven percent are starting to do something relative to quantum preparedness and PQC. But we're starting now in a spot where we're seeing a bit of a cliff. So awareness is high, and then there's a cliff actually doing something.

So meaning discovery, spinning up some sort of program within enterprise IT to start looking at this, getting funding. So there's a steep drop-off from awareness to execution. So that's what the survey results are showing now.

So it's- Still good. Everyone's now aware. NIST did us a huge favor by publishing the 2030 and 2035 timelines.

Kind of took that whole argument of quantum computers won't even be around in my lifetime, took that out and threw it away. Right? So now the- Yeah ...

focus is on let's start doing something and move to execution. Absolutely. And the good news is, as I mentioned, you mentioned this, the federal government, just around the world, you're also seeing- So I live in Boca Raton, Florida.

What is it? D-Wave, I think is the company, right? They're moving their whole headquarters and R&D down here.

It's making a huge splash. It's in the local news every day. Right?

They're taking over, not the whole campus, but where IBM actually was building their IBM PCs. They started here in Boca. They call it the Boca Raton Innovation Center.

Now, you could actually go in the room where Bill Gates signed the DOS licensing agreement with them still. But it's big news. Everybody's now, I think, getting on the quantum train.

What does that mean for DigiCert's customers? Yeah, so we got on the train many years ago. We were part of many of the standards bodies and groups that were- Mm-hmm ...

looking at this. We started preparing for it many years ago through updates to our crypto libraries. We have one ourselves, which is open source, called TrustCore, by adding the new algorithms into that so our customers could get a head start.

We built and launched DigiCert Labs, which is a free website where users can go and just create and download any types of these new post-quantum certificates so they can start playing around, look at the size, look at how they interact with their applications. We also had to prepare our entire platform. So, our platform issues hundreds of millions of certificates a month, and so everything from HSM updates to crypto libraries to our platform to our services all need to be updated.

3 and ML-KEM to mitigate that harvest now, decrypt later. So, kind of going back, we had to get ourselves ready as customer zero, and now we're really focused on getting our customers ready. Now that we've got the infrastructure ready for them, they can come to us and we can join them in this journey and help them.

I get it. Kevin, for people, can we dive into the readiness outlook a little bit more, if you don't mind? Yeah.

So we saw complexity is one of the other key things in this report. It was a huge barrier to quantum safe deployments. And complexity, when you think about it, let's take a web server, for example.

It's got an operating system that needs to support these new algorithms. That operating system trust store needs to support these new types of algorithms and certificates, like ML-DSA or SLH-DSA. We've got crypto libraries sitting on those web servers, like OpenSSL.

5, to support some of this new work. We need to have the apps like Apache or NGINX or Kubernetes need to also support it. So, the whole thought of like, "I'll just replace a certificate," is a bit of a misnomer.

It's actually a much bigger upgrade than people conceptualize. And it is complex. There's a lot of moving parts, and of course, our applications are all tied together, right?

So some apps will talk to other REST APIs, and mobile clients will talk to the app. So they're highly, highly interconnected, and so there is a blast radius when you do upgrades. You've got to think about that connected ecosystem in which that application or server lives in, right?

And so we see a lot of complexity around this and trying to invest in tools and solutions that help customers journey down this and not get stuck in that complexity. Love it. Kevin, for people who want a deeper dive, is this outlook available for download?

Yes, it absolutely is, and there's lots of great insights in there. It talks about what other industries are doing, in terms of the adoption. We also see adoption different from med tech to telecom, media, and retail.

So if you're in a certain industry, like retail, you can go look at this and look at some of the data and see what your peers are doing. Oh, you have slices by vertical like that? Yes.

Yeah. Oh, that's nice. So if you're in financial services, you can kind of see what your peers are doing and see are you ahead, behind, kind of on par with what your vertical is doing.

So where do we get this? com, and then what? Or Google?

What's the best way to do it? Yeah, just go to our website, search for the report. I think we've got links published on the main page there, and you can download the report and view it and provide us feedback, too.

Maybe we need to ask different questions next year, and we're happy to look at that as well. Hey, I don't want to get you in trouble, so don't say anything you're not allowed, but could you give us a little insight into what you guys have planned for World Quantum Readiness Day? Again, it's coming up in September again, so- Yes ...

the sign-up is on our website. We've got a great roster of speakers again, both those from a little bit of an academic side, but actually much more on the practitioner side. Consulting in companies that are actually boots on the ground doing this for enterprise customers, the challenges of this.

And so we're trying to make it much more practical now versus here's the algorithms and let's learn about them. It's more execution-focused now. So come join us.

We'd happy to have you join us in September for World Quantum Readiness Day. com again- Indeed ... and follow the links there.

Well, and it's funny you said what you said about its less... I want to say, Kevin, it's almost less theoretical and more boots on the ground. Right?

And that pretty much sums up where quantum is right now. That's right. Indeed.

Right? And so it'll be interesting to go there. So I encourage you all, if you have any interest in quantum computing, post-quantum algorithms, post-quantum cryptography, DigiCert is one of the leaders.

I've had the pleasure of interviewing and attending the DigiCert user conferences over the years, and I'll tell you, you've got some of the smartest people in the business at DigiCert, right? Some of the folks I've met, PhDs and everything on the, I think, is it the CEO? Yes.

He's a PhD as well, isn't he? He is. Yeah.

But he's not the only one. The people on the technical side of the house are phenomenal. I could sit and listen to them all day.

So I highly recommend you go check out that Quantum Readiness Day. And I guess we'll be hearing more and more about the quantum stuff in the months to come. Yes, Kevin?

Absolutely. We got an exciting roadmap of things that, again, solve that execution problem: discovery, remediation, governance. And so stay tuned.

Lots of exciting stuff to come. I appreciate you coming on, and we hope to have you on soon. Well, thank you for inviting me.

All the best. Always a pleasure. Kevin Haelstra, Senior Director of Product Management at DigiCert, handling the quantum and post-quantum market.

We're going to take a break here on Techstrong TV. We'll be right back.