OpenSSL at Waseda University: Seminar on Post-Quantum Cryptography

Great initiative, the kind of academic exchange we'd like more of.

Two things: please drop the recording (and slides, if you can) here once ready. And a standing offer — for events like this, OpenSSL can usually field a representative from the Foundation or the Corporation, whether a talk, a Q&A, or just someone in the room. Anyone organising something similar, at any institution: don't be shy to ask.

@Anton Arapov Folks , please note , Your focus is on Academic community and hope my question falls within the scope and I posted it here because this recording pertained to Waseeda university in. Japan,🎈

@anton Slides are uploaded. Recording will follow

Hello , Great and look forward to be able to review the slides to better understand how PQC works actually protecting digital identity, since you mention “ crypto agility “ , Do you have an approximate time frame between harvest of sensitive data and decryption. Is there any way to classify this concept based on industry verticals like say Healthcare or Finance for example, Risk and cost analysis will be different in each scenario, FYI ?Please share your suggestions , Thank you

@ravgade PQC protects/is about the cryptographic mechanisms supporting a digital identity. This includes quantum-resistant key exchange, digital certificates, authentication signatures, software or firmware signing etc. Crypto agility is the ability to replace these algorithms and keys without redesigning or disrupting the entire identity platform/system. NIST describes it as the capability to adapt cryptography across applications, hardware, protocols, and infrastructure while maintaining operational continuity.

Regarding the interval between harvesting sensitive encrypted data and decrypting it, there is no reliable fixed time frame. Data can be collected today and retained until a cryptographically relevant quantum computer becomes available. No one currently knows when this will happen, although some forecasts suggest it could be within ~ten years. Therefore, information that must remain confidential into the 2030s or longer should already be considered potentially exposed to a "harvest now, decrypt later" scenario.

So a practical assessment would compare:
* How long the information must remain confidential
* How long the PQC migration will take
* The expected lifetime of the affected systems
* The consequences if the information is eventually decrypted
* Regulatory, operational, and reputational exposure...

For healthcare, I can think of long-lived patient records, genomic information, digital prescriptions, clinical research data etc. that may remain sensitive for decades. Migration costs may also be higher here because of many legacy systems, connected medical devices, interoperability requirements, and long equipment-replacement cycles.

For financial services, priorities may include customer identity and KYC records, payment infrastructure, interbank communications, and long-term financial agreements. Challenges I can think of are transaction latency, large-scale PKI and HSM replacement, regulatory things.

So my recommendation - although I am not an expert in this regard - would be to begin with a cryptographic inventory and then ranking each use case according to data sensitivity, required protection time, migration complexity, and business impact. Internet-facing communications, identity and certificate infrastructure, code-signing systems, and long-term archives would normally receive early attention. CISA, NIST, and NSA similarly recommend creating a quantum-readiness roadmap and prioritizing systems that currently depend on vulnerable public-key cryptography.

Hope this helps!

@Nikolas Gauder Hello , Is there a way for me to message you directly as all my questions may not be relevant to the whole group, Could you please clarify as there are many important questions you have raised , Thank you

@ravgade I've sent you a DM. For any questions that are related to what we're covering though, feel free to ask them here in the group thread as well so everyone can benefit from the answers. Maybe it will help others who have the same questions too 🙂

@Nikolas Gauder Of course that’s quite a Valid point , I will post my questions here as long it’s fine with the general guidelines of the community and feel free to respond and I will learn along the way also Have a good evening , thank you

👋,! Great answer with an in-depth analysis and explanation of the topic in question, I have read your response and it helped me understand my question from your perspective or point of view 🙂, Thank you to start with,

Thank you folks ,pausing to reorganize my thoughts 💭