FUD

We need to replace all cryptography immediately

A measured, risk-based transition to post-quantum cryptography is appropriate. Panic-driven wholesale replacement creates more risk than it prevents.

#migration #pqc #risk-management
FO

FUD or Fact Team

The Claim

“Organizations need to immediately replace all their cryptography with post-quantum alternatives to avoid catastrophic security failures.”

The Verdict: FUD

While PQC migration is important, panic-driven immediate replacement is neither necessary nor advisable.

Why Immediate Replacement is FUD

  1. Quantum computers aren’t here yet - Cryptographically-relevant QC is years to decades away
  2. Rushed migrations introduce bugs - Cryptographic changes require careful testing
  3. PQC implementations are maturing - Early adoption carries implementation risks
  4. Not all systems are equally at risk - Risk-based prioritization is appropriate

NIST Guidance

NIST recommends a measured approach:

  • Inventory your cryptographic usage
  • Identify high-priority systems
  • Test in non-production environments
  • Plan hybrid deployments
  • Monitor industry guidance

Risk-Based Prioritization

Focus migration efforts on:

  1. Systems protecting long-term secrets (10+ year confidentiality)
  2. Systems vulnerable to HNDL attacks
  3. Critical infrastructure
  4. Systems with long deployment cycles

The Real Timeline

Priority LevelWhen to Migrate
Critical (long-term secrets)Start now
High (sensitive data)Plan for 2025-2027
Medium (general enterprise)Plan for 2027-2030
Low (consumer apps)Follow platform updates

Risks of Panic Migration

  1. Implementation bugs - New cryptography needs time to mature
  2. Performance impacts - PQC algorithms often have larger keys/signatures
  3. Compatibility issues - Not all systems support new algorithms
  4. Resource misallocation - Focus should be on highest-risk systems first

Verdict: FUD - Measure twice, cut once. A careful, prioritized approach is more effective than panic.