Two papers came out last week that suggest classical asymmetric cryptography might indeed be broken by quantum computers in just a few years.
That means we need to ship post-quantum crypto now, with the tools we have: ML-KEM and ML-DSA. I didn't think PQ auth was so urgent until recently.
@filippo you mentioned that file encryption is particularly vulnerable to store-now-decrypt-later – do i understand correctly that e.g. an old passage database which uses pre-quantum recipients is vulnerable if the encrypted files are leaked or compromised?
the mitigation here would be to migrate to a new passage db using *only* post-quantum-proof recipients *and then also* rotate all the passwords in the database, right?
Filippo Valsorda
multi