The document outlines strategies for building quantum-safe applications using open-source tools, emphasizing the importance of post-quantum cryptography and risk mitigation. It covers key aspects such as understanding risks, protecting applications, and integrating quantum-safe algorithms into existing systems. Additionally, resources for further learning and inventorying cryptographic assets are provided.

1. Building Quantum-Safe
Applications with Open
Source Tools
Paul Schweigert
IBM
psschwei.com

2. Agenda
1. Understand the Risk
2. Becoming Quantum Safe
3. Protecting Applications
4. Next Steps

3. 1. Understand the Risk
2. Becoming Quantum Safe
3. Protecting Applications
4. Next Steps

4. Hard problems
(NP)
Why quantum?
Quantum easy
Quantum easy
Easy problems
(polynomial)

5. Ex: Shor’s algorithm for factoring

8. Source:
GlobalRiskInsitute.org

9. 1. Understand the Risk
2. Becoming Quantum Safe
3. Protecting Applications
4. Next Steps

12. Open Source
https://pqca.org
To advance the adoption of post-
quantum cryptography, by producing
high-assurance software
implementations of standardized
algorithms, and supporting the
continued development and
standardization of new post-quantum
algorithms with software for evaluation
and prototyping.

13. PQ Code Package
Open Quantum Safe project
Library of many PQ
algorithms
• Main profile: standards-
track algorithms
• Experimental profile:
new algorithms, NIST
signatures on-ramp etc.
Initial Projects Overview
“Kyber” code
package
High-assurance production
source-code implementations of
Kyber
• C, x86_64, ARMv8, …
• Rust, Go, …
• audited/certified/formally
verified
Plus appropriate wrappers /
providers, e.g. Kyber OpenSSL 3
provider
OQS OpenSSL 3
Provider
Integration of PQ + hybrid
algorithms from liboqs into
OpenSSL 3 via OpenSSL
provider interface
• TLS key exchange,
authentication
• X.509
• S/MIME, CMS, CMP
OQS demos
Prototype integrations of
PQ into protocols and
applications to support
experiments,
standardization,
interoperability
Potential Phase 2
projects
• Dilithium
• XMSS, LMS
• SPHINCS+
• Falcon (-> Phase 3?)
Production track: safe for use in production environments, with external audits or certification
Experimental track: primarily for prototyping and experiments, mindful of potential production use
liboqs

14. Becoming Quantum Safe
Discover: Scan source and object code to locate cryptographic
assets, dependencies, and vulnerabilities. Build a cryptography
bill of materials (CBOM).
Observe: Create a dynamic cryptographic inventory to guide
remediation. Analyze cryptographic posture and compliance to
prioritize risks.
Transform: Learn and apply quantum-safe remediation patterns
in a development environment. Prepare to deploy quantum-safe
solutions to your stack.

15. 1. Understand the Risk
2. Becoming Quantum Safe
3. Protecting Applications
4. Next Steps

16. https://www.ibm.com/quantum/blog/iqp-quantum-safe

17. 3. Be Prepared
Public Internet
User Internal Network
Client Web Application
Firewall
Entrypoint Application Application 2…
Quantum Safe Flow
High Level View

18. Quantum Safe Client:
Configuring OpenSSL
18
• Install liboqs & oqs-provider
• https://github.com/open-quantum-safe/liboqs
• https://github.com/open-quantum-safe/oqs-provider
• Configure OpenSSL to use Kyber algorithm

19. Quantum Safe Service Mesh:
Updating Istio
19
• Envoy
• QSafe BoringSSL:
https://github.com/google/boringssl/blob/45cf810dbdbd767f09f8cb0b0fcccd342c39041f/src/ssl/ssl_key_share.cc#L285-L293
• Istio
• Add QSafe supported group: https://github.com/istio/istio/commit/7635f7ea50514958518eb17b631682f953e723cc
• Secure mesh traffic: https://github.com/istio/istio/issues/52290

20. Kubernetes
Pod
Kubernetes
Pod
Quantum Safe Flow
WAF
QS Client
User (Laptop)
Existing Components
Non-
QS API
GW
QSafe TLS - X25519Kyber768
Legacy TLS - X25519
Layer-4
VPC LB
Client containing
required libraries
supporting OpenSSL
3 and QSafe
Providers
Public Cloud
Non-QS
Client
Remediations
Standard setup
QSafe
Istio
ingress
QSafe
Side
Proxy
QSafe
Side
Proxy
Pattern
repeats for
other services
Detail View

21. 1. Understand the Risk
2. Becoming Quantum Safe
3. Protecting Applications
4. Next Steps

22. Next Steps
Learn about post-quantum cryptography Start inventorying your crypto

23. Next Steps
Learn about post-quantum cryptography Start inventorying your crypto
https://learning.quantum.ibm.com/course/practi
cal-introduction-to-quantum-safe-cryptography
https://github.com/IBM/CBOM