Future: post-quantum cryptography
This course covers post-quantum cryptography from an engineering angle. It starts with the harvest now, decrypt later threat, where recorded traffic is decrypted once a capable quantum machine exists. It separates what breaks (public-key key exchange and signatures) from what survives with larger parameters (symmetric encryption and hashing). It names the NIST standards ML-KEM, ML-DSA and SLH-DSA, explains hybrid TLS key exchange, and walks a Rails application to mark who owns each exposure. It ends with crypto-agility, policy timelines and a one-page migration plan.
What you'll learn
- ✓How the harvest now, decrypt later threat works and how data secrecy lifetimes rank the risk
- ✓Which primitives break (RSA, Diffie-Hellman, elliptic-curve schemes) and which survive with larger parameters
- ✓The published standards FIPS 203, 204 and 205, the ones still in progress, and hybrid TLS key exchange
- ✓How to inventory the cryptography in a Rails application and assign an owner to each surface
- ✓Crypto-agility: algorithm tags, versioned keys and rotation exercised on a schedule
- ✓How to build a migration plan with policy deadlines, triggers and review dates
Harvest now, decrypt later
Someone is recording your HTTPS traffic. They can't read it. They're storing it anyway.
Read the full lesson free →Curriculum
7 lessonsHarvest now, decrypt later
Explains the harvest now, decrypt later threat and how data secrecy lifetimes rank the risk.
What breaks and what survives
Separates public-key cryptography, which falls, from symmetric encryption and hashing, which survive with larger parameters.
The standards and their names
Covers FIPS 203, 204 and 205, the algorithms still in progress, and hybrid TLS key exchange.
Where this touches a Rails application
Walks a Rails application to mark TLS, signed tokens, keys at rest and its own cryptography by owner.
Crypto-agility in practice
Shows crypto-agility through algorithm tags, versioned keys, practiced rotation and triage of artifacts that cannot be assessed.
Timelines and an honest posture
Covers policy deadlines, the four conditions for deliberate inaction and which work pays off this year.
A migration plan you can defend
Assembles a one-page migration plan and an ordered answer to the question of quantum exposure.