Post-quantum migration can become unmanageable when enterprises treat every cryptographic dependency as a single replacement project. As organizations move from quantum awareness to implementation, the transition reaches across applications, infrastructure and suppliers, making coordination as important as algorithm selection.

At LGT Financial Services AG, quantum safety entered formal risk discussions in 2022, when the topic was raised at the firm’s annual risk and cyber risk management meeting. The company later created a competence center to connect security operations, architecture, public key infrastructure, application owners, vendors and risk stakeholders, according to Christian Pfister (pictured, right), team leader, IT security operations, and lead for LGT’s Quantum Safe Competence Center.

“Quantum safety is a resilience and risk management issue,” he said. “The key question for leadership was straightforward: Which information must remain confidential long enough that it may be exposed to a future cryptographic break? We then explained that waiting until there is a cryptographically relevant quantum computer would leave too little time to identify dependencies, upgrade product, coordinate suppliers and safely migrate.”

Pfister spoke with host Shane Kelly (left), principal crypto architect at DigiCert Inc., at DigiCert’s World Quantum Readiness Day event, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed LGT’s post-quantum migration strategy, early technical work and lessons for organizations beginning their own transitions. (* Disclosure below.)

Post-quantum migration moves in waves

LGT’s competence center provides security direction, but individual teams and service owners remain responsible for implementation. That structure allowed the company to begin targeted work while it continued developing its cryptographic inventory, according to Pfister.

“If you try to inventory, replace and validate every cryptographic use case at once, it makes the program unmanageable, and you can’t measure the outcome,” he said. “The [post-quantum cryptography] migration is not one project and one algorithm change; it’s a series of migration waves.”

Supplier engagement became another workstream involving vendor management and procurement. LGT began asking vendors about product roadmaps, supported algorithms, timelines and compatibility constraints in 2023 or 2024, according to Pfister.

“That vendor management, it seems now a very important part,” he said. “Therefore, we got connections — connections to DigiCert, to experts to talk with. That was also a very important part [that] we coordinated with the Quantum Safe Competence Center.”

Hybrid key exchange tests the full connection path

LGT began its technical work by modernizing its Transport Layer Security baseline and testing hybrid key exchange in controlled environments, Pfister noted. That work combined X25519 with the NIST-standardized Module-Lattice-Based Key-Encapsulation Mechanism, pairing a classical key exchange with a post-quantum mechanism.

“This pilot is now live, and our online banking system uses hybrid key exchange, and our customers don’t have any disruption,” Pfister said. “This principle we are going to follow in all areas.”

Testing exposed interoperability problems across the entire connection path, including load balancers and content delivery networks. Some connections failed or returned to the previous configuration, showing why organizations must test end to end rather than examine a server or connection component in isolation, according to Pfister.

“Most issues look familiar to anyone who has delivered major security changes,” he said. “We are all familiar with legacy hardware, unsupported firmware [and] unmanaged libraries. The [pilot] exposes technical debt that already exists, and that’s not the reason to wait. It’s precisely why starting early matters for us.”

Register for free to watch the complete video interview, part of SiliconANGLE’s and theCUBE Research’s coverage of DigiCert’s World Quantum Readiness Day.

(* Disclosure: TheCUBE is a paid media partner for DigiCert’s World Quantum Readiness Day event. Neither DigiCert, the sponsor of theCUBE’s event coverage, nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE