tag: Post-Quantum-Cryptography · 4 items
- Engineer — Learn: A top-tier nation-state actor integrating PQC into payload delivery may eventually require reassessing TLS inspection and endpoint detection capabilities, but no specific software vulnerability or configuration change is indicated today.
- SOC/IR — Learn: No IOCs, ATT&CK mappings, or detection-ready artifacts are provided; monitor for follow-on reporting with PQC-obfuscated C2 indicators before tuning rules.
- Leader — Learn: Lazarus’s operational use of post-quantum cryptography signals growing adversary sophistication — useful context for board threat-landscape briefings, but no immediate vendor exposure or disclosure action is triggered.
- Engineer — Learn: Formal proof that hybrid ML-KEM combiners without transcript binding can be fully downgraded by an active attacker; engineers designing or auditing custom hybrid PQC handshakes (TLS, SSH, IKE) should verify their key schedule binds the session key to a transcript hash, not just the raw KEM output.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: PQCensus scans repos for quantum-vulnerable cryptography and produces SARIF/CycloneDX output — worth evaluating as a low-friction way to build a crypto-agility baseline ahead of NIST PQC migration deadlines, but requires no immediate system change.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: Broad academic survey of PQC migration building blocks across TLS, IoT, and blockchain — useful background for planning crypto-agility work but requires no immediate action on running systems.
- SOC/IR — Skip
- Leader — Learn: Provides a framework for understanding where PQC migration stands and what domains face the hardest challenges — useful input for future roadmap discussions or board-level quantum risk narratives, but no near-term deadline or vendor exposure to act on.