From Bank Heists to Forklift Jobs
The nature of cyber threats has fundamentally changed. As our team noted during our KubeCon EU presentation, cyberattacks used to be like bank heists: quick, frantic, and loud. Now they look more like forklift jobs: the attacker lifts the entire vault, data, credentials, and systems, then takes it somewhere quiet.
Organizations now face store-now-decrypt-later attacks, where adversaries steal encrypted data today and wait for quantum computing to help decrypt it in the future. Our security practices must evolve accordingly.
Why Post-Quantum Cryptography Matters Now
A common misconception is that post-quantum cryptography only matters once large-scale quantum computers exist. The practical benefits of modern PQC algorithms matter earlier: constant-time operations, reduced dependence on dangerous randomness patterns, safer parameterization, and better implementation properties.
Understanding the Threat Window
Mosca’s theorem frames the problem clearly: if the time data must remain secure plus the time needed to migrate exceeds the time until current encryption can be broken, then the risk window is already open.
For mission systems, long-lived intelligence, healthcare data, and sensitive government records, that risk window is not theoretical.
SPIFFE at the Cryptographic Crossroads
The SPIFFE ecosystem relies on cryptography for TLS key exchange, X.509 SVIDs, and JWT-based identity documents. Our research and implementation showed how quantum-resistant algorithms can be integrated into SPIFFE/SPIRE patterns using ML-KEM-aligned key exchange and ML-DSA-style certificates.
Practical Implementation in Kubernetes
The highlight of the presentation was a live demonstration of quantum-resistant identity in a cloud native environment on ruggedized field equipment. The demonstration included a PQC-enabled SPIRE server, quantum-resistant mTLS, Cilium enforcing L7 policy, and secure cross-cluster communication through Envoy.
The lesson was simple: quantum resistance is not just theoretical. It can be demonstrated today with existing cloud native tools and hardened operational hardware.
Security Is Never Done
Migrating cryptographic systems takes years. The best time to start was years ago. The second-best time is now.