Black Kite launches Quantum Readiness controls to rate vendors' post-quantum cryptography posture
Black Kite announced Quantum Readiness, a new set of controls in the SSL/TLS Strength category of the Black Kite Cyber Rating. The controls assess quantum agility across an organization's third-party vendor ecosystem. They show which vendors are quantum-ready or adopting quantum-safe encryption. The release is product news, not an incident. It is motivated by 'harvest now, decrypt later' collection and by fixed post-quantum migration deadlines. The article states that 'Q-Day' could arrive as early as 2028.
Detalhes técnicos
- The controls assess observable signals of post-quantum cryptographic readiness: hybrid post-quantum key exchange, certificate signature readiness, and assets without an identified migration path.
- Regulatory drivers cited in the article: the NIST schedule deprecates RSA, ECDSA and ECDH after 2030 and disallows them after 2035. OMB M-26-15 requires US agencies to adopt post-quantum key establishment by the end of 2030 and digital signatures by 2031. Executive Order 14412 starts a federal acquisition rule requiring covered contractors to meet NIST post-quantum standards by December 31, 2030. EU Member States are expected to have national plans and cryptographic inventories by the end of 2026, with high-risk critical infrastructure migrated by 2030. NIS2 already covers supply chain security and cryptography.
Remediação
- Inventory the cryptography in your own systems and in those of your critical vendors.
- Track vendor post-quantum readiness over time.
- Plan cryptographic migrations early, since they take years.
Linha do tempo
-
Black Kite launches Quantum Readiness controls to rate vendors' post-quantum cryptography posture
ler a análise desta fonte ocultar
Black Kite announced Quantum Readiness, a new set of controls in the SSL/TLS Strength category of the Black Kite Cyber Rating. The controls assess quantum agility across an organization's third-party vendor ecosystem. They show which vendors are quantum-ready or adopting quantum-safe encryption. The release is product news, not an incident. It is motivated by 'harvest now, decrypt later' collection and by fixed post-quantum migration deadlines. The article states that 'Q-Day' could arrive as early as 2028.
Technical Details
- The controls assess observable signals of post-quantum cryptographic readiness: hybrid post-quantum key exchange, certificate signature readiness, and assets without an identified migration path.
- Regulatory drivers cited in the article: the NIST schedule deprecates RSA, ECDSA and ECDH after 2030 and disallows them after 2035. OMB M-26-15 requires US agencies to adopt post-quantum key establishment by the end of 2030 and digital signatures by 2031. Executive Order 14412 starts a federal acquisition rule requiring covered contractors to meet NIST post-quantum standards by December 31, 2030. EU Member States are expected to have national plans and cryptographic inventories by the end of 2026, with high-risk critical infrastructure migrated by 2030. NIS2 already covers supply chain security and cryptography.
Remediation
- Inventory the cryptography in your own systems and in those of your critical vendors.
- Track vendor post-quantum readiness over time.
- Plan cryptographic migrations early, since they take years.