Beyond Classical Cryptography: Building Quantum-Resistant Cloud Native Infrastructure With SPIFFE
Talkat KubeCon + CloudNativeCon Europe 2025 · on Friday, 2025-04-04· at 11:45· Platinum Suite | Level 3 | Room 1-2·
summary
Demonstrates a working Kubernetes proof-of-concept that integrates post-quantum cryptography into SPIFFE/SPIRE, Cilium and Envoy to deliver Kyber KEM hybrid key exchange and Dilithium3 X.509 signatures for mTLS, with L7 Cilium policies enforcing URL-level filtering across clusters. Uses Go 1.23’s hybrid KEX capability; OpenSSL on the demo node cannot yet parse the new signature format. Handshake overhead increases but noticably affects only high-throughput TLS terminators.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:04Quantum threat to crypto
- 3:33Shor’s algorithm breaks RSA/ECC
- 5:58Quantum threat timeline
- 7:20Why post-quantum matters
- 9:28NIST migration roadmap
- 10:11Kubernetes cloud-native prep
- 13:49Spiffe/Spire with PQC
- 17:31Quantum-resistant service mesh demo
- 24:27Key takeaways
- 27:37Closing remarks
- 28:52Q&A: Performance overhead
- 31:21Q&A: Lattice-based crypto today
related talks
15mSecuring Cloud Native Infra for the Post-Quantum Era
05mLightning Talk: Building Quantum-Safe Applications
44mPost-quantum cryptography migration strategy for cloud services
01h 05mChallenges and Opportunities from Quantum-Safe Cryptography
58mLet's Go Quantum
30mNavigating the Quantum Readiness Journey: Securing Kubernetes with Quantum-Resis...
10mSecuring Multi-Cloud APIs Against Quantum Threats
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE