Why Post-Quantum Cryptography Starts With Credentials

Summary: The article states that public-key cryptography protecting credentials will eventually be broken by quantum computers, and that attackers are already capturing encrypted traffic to decrypt later under a tactic called Harvest Now, Decrypt Later. It cites the Global Risk Institute's 2025 Quantum Threat Timeline report, in which 51-70% of surveyed security specialists said a cryptographically relevant quantum computer is likely within 15 years, and notes NSA's CNSA 2.0 requires new national security systems to support quantum-resistant algorithms starting January 1, 2027, while NIST's draft IR 8547 deprecates RSA-2048 and ECC P-256 after 2030 and disallows them after 2035.
What's compelling: A full enterprise transition can take 5 to 15 years, with the discovery phase alone taking 1 to 2 years in large enterprises, so data harvested today should be treated as already exposed. Non-human identities such as service accounts and API keys are long-lived, often uninventoried, and therefore the credentials most worth harvesting now.

Read the original at The Hacker News ↗