Transitioning to Post-Quantum Cryptography in IAM
summary
Urgent migration plan prioritizes TLS and PKI first, because TLS sessions and long‑lived certificates are highest risk with a likely Q‑day around 2030. Deploy ML-KEM (Kyber) in hybrid TLS paired with RSA/ECDH so key exchange combines classical and PQC secrets; use nested and parallel hybrid signatures for OIDC/SAML tokens; use composite hybrid public‑key encryption for encrypted tokens. Operational requirements include crypto agility: abstraction layers, no hardcoded algorithms or key sizes, planned certificate/key rotations (47‑day rule), and password migration strategies; major cloud vendors and libs are starting PQC support.
AI-written summary · about
chapters (15)
- 0:00Welcome
- 1:26Post-quantum crypto in IAM
- 3:15IAM core functions
- 5:02IAM crypto risks
- 7:11Risk-level crypto assets
- 8:59Harvest now decrypt later
- 11:51Hybrid algorithms recommended
- 12:36Post-quantum TLS and key exchange
- 14:00Hybrid signatures for SSO
- 15:46Hybrid encryption in IAM
- 17:31Migration challenges
- 18:58Quantum-safe IAM future
- 20:45Crypto agility best practices
- 22:53Certificate and password upgrades
- 23:54Zero trust for quantum security
related talks
47mReal-World Lessons in Post-Quantum Cryptography Migration
46mFrom Theory to Practice: Real-World Lessons in Post-Quantum Cryptography Migration
13mNavigating the Quantum Readiness Journey: Open-Source Cryptography, PKI and Signing Tools
44mPost-quantum cryptography migration strategy for cloud services
15mSecuring Cloud Native Infra for the Post-Quantum Era
59mPost-quantum cryptography for .NET developers
22mPost Quantum Policy and Roadmap of the BSI
10mSummary and Closing