The cryptography we rely on is going to be replaced. Standards bodies have published the successors, suppliers have started shipping them, and regulators in several sectors have begun attaching dates. The mathematics is not our problem and will arrive more or less on time.
Our problem is that almost no organisation can say where its cryptography currently is, and I include my own.
We tried to produce the list. The certificates we issue were straightforward, because we already run an inventory for expiry reasons. Everything else was archaeology. A payment file signed daily with a key generated in 2014 by a process nobody documented and a person who has retired. A partner integration where the algorithm is agreed in both directions, so we cannot change ours without their supplier changing theirs, on a timescale neither of us controls. Appliances with trust stores that can only be updated by a firmware release, from two vendors whose support for those models ends before the deadlines do. Archived data encrypted with keys that must outlive the data they protect, which turns a retention policy into a key management commitment nobody has costed. And a quantity of code, written by us, in which an algorithm name is a string literal.
There is also a timing argument that makes this present rather than future work. Anything confidential with a long life can be captured now and read later, so the material that matters most is the material we are protecting today.
The work that pays is not cryptographic. It is an inventory, an owner for every key, a supplier question asked at contract rather than at renewal, and the ability to change an algorithm through configuration rather than through a project. We have started by adding cryptographic use to the asset record, and by deliberately shortening certificate lifetimes, because frequent renewal exercises exactly the muscle a migration will require.
Two suppliers have given us a plan and a date. Four could not say who in their organisation owns the question.
The change itself will be handed to us. Finding every place it has to be applied is the decade of work, and it belongs entirely to us.
– Serguey Shinder
