The financial sector has a second threat beyond Harvest Now Decrypt Later (HNDL) that gets less attention. Researchers call it “Trust Now, Forge Later” (TNFL). HNDL is someone reading what they shouldn’t. TNFL is a rewrite of history.
A digital signature on a transaction is the only thing that proves it happened the way it happened. It’s the official stamp. An untrusted signature is open to disputes. A changed one could bankrupt a company and ruin reputations. It’s like if the Declaration of Independence could be changed so Benedict Arnold signed instead of John Hancock.
And that’s how nations will use it, not to steal money, but to change who signed what, or understand how money moves between governments and institutions. It’s not theft, its a rewriting of history.
For all but the smallest enterprises, there is likely some amount of time when the quantum threat is realized and the encryption is not fully updated.
A paper recently potentially halved the time to expect quantum computing to threaten RSA-2048, and de-risked quantum computer scaling. Estimates have put the time it takes for medium companies to do their quantum safe transitions up to 15 years, and large companies longer. When we look at quantum computer roadmaps and this paper together, the risk is moved five to ten years closer than previous estimates. Even the transition time estimates for small companies are no longer safe. We thought the transition would happen just in time. It turns out we are already behind.
The regulations are clear. We are running out of time. The older encryption schemes are to be deprecated in 2030, and fully phased out five years later. This must start, and as soon as possible. Other cryptographic migrations have shown it can take more than a decade to fully migrate. That’s not a small problem.
And finance has issues beyond just a simple software update. Hardcoded crypto modules, limited processing power on distributed devices. While some post-quantum encryption can run faster than its predecessors, others are just doubled key length. We didn’t make a lock harder to pick. We just made it deeper.
That’s the wall. The next three posts map where it’s already hitting: power grids, water treatment, and pipeline control. At least one of them is yours.
See the first in this series: Your Classical Computer Just Hit a Wall
And if you need an advisor or consultant in this area, I’m available.
