Unspoken Security Ep 36: How Post-Quantum Computing (PQC) Will Save the Internet

these quantum effects can be realized and worked with. And they're very different. We can do amazing things with them. Certain problems, certain mathematical problems and other problems that are difficult for quantum computers to solve can be, that might take thousands or even millions of years, could be solved today or perhaps in the future with larger quantum computers. Computers in literally seconds or minutes.

Welcome to Unspoken Security, the raw and gritty podcast for security professionals who are looking to understand the most important issues related to making the world a safer place, including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry.

Hello and welcome to another episode of Unspoken Security. I'm your host, AJ Nash, and I spent 19 years in the intelligence community, mostly at NSA, and I've been building and maturing intelligence programs in the private sector for about 9 years now. I'm passionate about intelligence, security, public speaking, mentoring, and teaching, and I also have a master's degree in organizational leadership from Gonzaga University. Go Zags! So I continue to be deeply committed to servant leadership. This podcast brings all of these elements together with some incredible guests to have authentic, unfiltered conversations on a wide range of challenging topics. This is not gonna be your typical polished podcast. My dog occasionally makes appearances, but they're both in the other room today, so we're probably fine. People argue and debate here. We even swear sometimes, and that's all okay. I want you to think of this podcast as a conversation that you'd overhear at a bar after a long day at one of the larger cybersecurity conferences, whether it's RSA or Black Hat or DEF CON. These are the conversations we usually have when nobody's listening. Now, today is different. You may have noticed among other things, there's 3 people on the screen if you're watching. So we have 2 guests today. I've only done that once before. And this is the first time we're having two guests that are not geographically with each other. So, it'd be interesting to see how all of our technology pays off. I will tell you, tech check to start this program was a new adventure. But today I'm joined by Robert Clyde and Jamie Norton. So Robert is the managing director of Clyde Consulting LLC. That is because his last name's Clyde. They provide board and advisory services to cybersecurity software companies. He's currently chair and board director at Cybrel. Executive chair of the board of White Cloud Security and past chair of the board of directors for ISACA, a global professional association committed to advancing trust in technology. Now turning to Jamie. Jamie's got a stack of credentials: CISA, CISM, CGEIT, CISSP, CIPM. He's collecting the entire alphabet. He's not leaving any letters for the rest of us. He's also a board director at ISACA, and he's on the advisory board for Averto, a cybersecurity startup enabling informed and defensible data-driven decisions. Now, gents, impressive resumes. Anything I left out? Anything you wanna add?

Well, I, I might mention I'm also, particularly for today's discussion, chairman of the board for CryptoQuantique.

Oh yes, I left that out. I'm glad you mentioned it. That is important for this discussion.

Very relevant to today's discussion, doing post-quantum cryptography and security for the Internet of Things. So, so kind of an important one. One.

It is. Yeah, I'm glad you mentioned that one. Anything I left out for yours, Jamie?

What's that, Rob? Too many companies.

That's true.

How about you, Jamie?

Anything I left out from yours?

I don't think anything, anything too significant. I do moonlight occasionally as, as a, with the Australian government, but, but for the purposes today, SACA is, is where it's at.

Well, that's, that's very impressive as well. I don't, moonlighting, I don't know, I see these resumes, I don't know how you actually have time to do other things on the side, but And I appreciate that you had the chance— we actually had the chance to meet in person to prep for this. That rarely happens. And as Rob mentioned, you know, we're going to hint what we're talking about today. So today's discussion is going to be about quantum computing in a lot of ways, right? So today's discussion actually is quantum computing breaking the internet and how post-quantum cryptography, PQC, is going to prevent this. So I want to jump right into the discussion on this. Listen, quantum computing is not my strength. This is not where I come from. As I said, I'm an Intel guy. I'm learning as fast as I can, but it is like drinking water from a fire hose. So I think the audience may— we're going to have a whole range of people listening and watching this, I'm sure, and some will understand quantum better than others. But I want to make it easier for everybody and I'll be the dummy in the room. So can you briefly overview what we mean by quantum computing and how it differs from conventional computing? Rob, why don't you kick us off on that?

Sure. So I think the first thing to understand is that The base of quantum computing is different than what we call classical computing, which is all the computers that we use today. And the basis, if you think about it, at the, at the bottom are zeros and ones and the ability to do instructions based on those zeros and ones, primarily Boolean logic related to zeros and ones. And from there we build up to all the higher languages and even artificial intelligence and everything else that is is based off of something could be a 0 or a 1. And we call those bits. So imagine in quantum computing, we have something different. It's not a 0 or a 1. We call those qubits, q-u-b-i-t-s. And what that means is that at the base of quantum computing, we have these quantum effects with qubits, which can be a 0 or a 1. And kind of at the same time. And the probability of whether they will resolve to a 0 or a 1 is infinite. So you could also say they could be a 0 or a 1 or everything in between, all at the same time.

Like Schrödinger's cat for computing.

You got it. And then when you go to measure it, when you measure the qubit, it resolves to a 0 or a 1. And, and so we have these principles, and I'm not going to go into tremendous details because I'm not a quantum physicist, and I'm guessing most of our attendees are not quantum physicists.

I'll be shocked if there's any. If there is, I hope they reach out and let me know why they're watching.

Superposition and entanglement come into play. And the cool thing, though, is an interesting thing is to get these quantum effects to take place. You have to cool a quantum computer to absolute zero. So the cost is not just the quantum computer itself, the unit that has the qubits and the ability to affect those, but in fact, the refrigeration unit to get it down to near the temperature of outer space. And then these quantum effects can be realized and worked with. And they're very different. We can do amazing things with them. Certain problems, certain mathematical problems and other problems that are difficult for quantum computers to solve, can be— that might take thousands or even millions of years, could be solved today or perhaps in the future with larger quantum computers in literally seconds or minutes. And so that's just a a huge change that we're looking at, really a sea change that's coming about.

That's impressive. And for those who don't know, Jamie, I'm going to have you jump in with your thoughts on quantum as well. But for those who don't know what absolute zero is, I realize many will. But if you haven't studied, you know, chemistry in a long time or some of these things, absolute zero is 459 degrees and change below zero Fahrenheit. It's 273 degrees and change below zero Celsius. I don't know these off the top of my head. This is why Google exists. I was able to look that up, but for, for anybody who wants that in context, so the computers have to run at this super cooled temperature. Yes. At all times because they're computing so, so much, so fast, they generate heat is, is what I'm understanding, right? And they would, they would otherwise melt down if they're not kept as cool. So Jamie, what can you add to us when we talk about the difference between quantum computing and regular compute? Obviously it's, it's exponentially faster. And therefore can solve problems exponentially quicker if we don't melt down the systems, you know, but can you talk a little bit more about the history of quantum, about how we've gotten to where we are today in quantum computing, you know, the value that goes along with that?

Yeah. And the quantum concept was sort of originally theorized in, I think, in the '70s. So it's, it's been with us, you know, for 50 years now. So it's not, it's not a new concept or even, you know, new from an innovation perspective. But we have and we're still you know, it's fair to say we're still relatively in its infancy where, you know, the quantum computers that exist today and they do exist doing, doing some of the work that we're, you know, we're starting to progress down, down this path that they're, you know, 150 or less than 150 qubits, as Rob mentioned, the qubits there. So that's still by quantum terms quite small. So the problems that they're currently solving is still quite small. But where we, where we sort of look into the future is where the potential for quantum to be very disruptive, both in a positive and potentially negative way. Is when we get those qubits and the processing power up above sort of the million qubits level, which, which could happen rapidly depending on, on innovations. We're sort of looking at what innovations might provide that sudden escalation. And, and there's also a few other things that they have to solve as well. And one of them is around the error correction or the noise that is created through the, through the, through the, you know, the process. So we can get innovations in some of those spaces and there's this rapid acceleration. Then all of a sudden, you know, quantum could be much closer than we think at the moment. I think we could almost take bets on whether it's sort of 5, 10 to 15 years depending on some of those innovations. So I think, you know, for me, I think maybe somewhere in the middle there is where it'll land.

Is quantum, I mean, is there going to be a day when all of our computers are quantum computers? Is this going to replace computing? Is my phone going to be a quantum computer someday? Or is this still going to continue to be specialized? I mean, obviously the temperature, I would think, would be one of the issues.

Yeah, you know, a little hard to wear that big refrigeration unit that takes the size of a small room on your—

but then again, if you think about it, if you think about the big mainframes that we used to have once upon a time, it was a little hard to think you'd have that much power in the palm of your hand, right? So I'm with you. I don't think that's— this translates to temperature.

I mean, there's absolutely people working on trying to have quantum computers without the cooling requirements. So maybe someday, I don't know if it'll be in our lifetime when we'll be wearing one on our wrist, but you asked, will we only be doing quantum computers? And, and most people feel no. That there are so many problems that a classical computer is probably better suited to solve. We don't even have the typical programming languages. So think of what we write programs and software in today. Those don't exist for quantum computers. So you, you, if you ask a simple question, do you have to be a quantum physicist and really understand quantum principles to program a quantum computer, the answer is yes. Do you have nice high-level languages? So, so think of the old days when you wrote in assembler or machine code for today's computers. We would probably consider that task easier than programming a quantum computer today, just to kind of put it in context.

So there's no Windows working on quantum then?

Is it not user-friendly like that? Yes, so, and people are working on those higher-level languages and ways to make it easier, ways to make it easier for the average software developer. So think of all the software developers on the planet. Most would struggle to program a quantum computer today. So just getting enough software engineers to do it, even just interconnecting classical computers and quantum computers is not straightforward and something that your typical high-performance computing centers. Think of some of the largest supercomputing centers in the world. Those are the kind of places that are working with quantum computers and attempting to find ways by linking them to classical computers to make the overall system easier to, to access, easier to program, et cetera. I think for the future, the foreseeable future, we will generally see quantum computers, other than a few specialized use cases, used in conjunction with classical computers.

Okay. Jamie, now Jamie, you'd mentioned that obviously quantum is growing. You both have said that and it's, you know, in its infancy, right? But you mentioned we're already using quantum computers to solve some things. Like what are applications right now? Where are we seeing quantum computers change our lives in ways that maybe I wouldn't know, that maybe the average person wouldn't even realize is happening?

Yeah, I mean, I think it's, we're still from what I've, what I've seen very much in that, you know, developmental research phase. So, so the, the use cases tend to be more doing some pattern matching type things, some sorting type stuff. You know, clocks I think was an interesting use case in terms of using, using it for, for time. So I think that fairly, fairly discrete kind of niche areas at the moment as we, as we test and, and as I said, the error correction and some of these things are become problematic even, even at those levels where they're trying to manage software essentially on top of quantum to, to account for the fact that it's getting so many, you know, there's so much noise within the, within the sphere. But, you know, as, as, as that ramps up, I think the, the applications are gonna, you know, potentially increase dramatically and, and things that take a lot of computation today and take traditional classical computers a long time, that will, will become much, much quicker to, yeah, instrumentally quicker, I suppose, under, under quantum.

Hmm. Yeah.

All right.

Well, and that leads right into the next question then. So, because we're trying to figure out what's happening and, you know, as you said, we're in infancy today, but there are some, some things, you know, progressing, but then there's challenges. But what do we mean then when we're saying that quantum computing could break the internet someday? And, and when is someday? Listen, just for those who weren't there for the prep call, which is everybody but the 3 of us, these gents introduced me to the concept of Q-Day, which if you don't have anything on your plate right now that scares the hell out of you for the future, feel free to get really acquainted with Q-Day that they're about to talk about here. 'Cause there's a whole nother thing can worry about when you go to sleep at night. So again, what do we mean when we say that quantum computing could break the internet someday, Jamie?

Well, I mean, I'm happy, happy to start off and I'll let, I'll let Rob talk about Q-Day. But yeah, there's, there's a, an algorithm called, called Shor's algorithm, which is, has been around also for a little while and, and kind of hypothesizes or provides a way— it's not a hypothesis, it's actually a proven, proven algorithm— to basically factor prime factors, create prime factors of large integers. So, which is exactly the thing that that our public key cryptography is sort of based around. So if there's an ability to kind of reverse engineer those algorithms and end up with the integers or the keys essentially that are the building blocks of our public key cryptography, then all of a sudden we have a problem. And with quantum, there's, you know, the potential to actually be able to do that algorithm, you know, with the sizing of the numbers and the sizing of the key space that is currently present in our sort of 2048 or 1024-bit sort of public key keys. So the, the challenge is, I guess, you know, as we go forward, if Shor's algorithm suddenly becomes a reality, then, then, you know, a lot of the underpinnings that we have in terms of cryptography on the internet, in terms of public key, so our, our web-based transactions, our banking transactions, data at rest, you know, whole range of things become, become at risk. And I mean, in terms of the, the sort of the raw numbers, as I said, we're, we're sort of at less than 150 qubits today. I think, it's around, you know, give or take, that 15 to 20 million qubits, Shor's algorithm starts to be something that becomes reality. And so, you know, we're still a little way away, but the challenge, I guess, is that that's coming in a space of time, 5 years, 10 years. So we know we're within the frame depending on innovations and depending on what happens in the broader research space. But from most people's perspective, it is coming. So the question is that we should start looking at having a plan today because it's, And that's going to be happening thanks to Nick Shor.

So just to clarify the numbers, and Rob, then I'm going to ask you to follow up on this. How many qubits are we at today in quantum computing?

I believe we're with some of the ones, the IBM and other ones are sitting around that just below 150 qubits.

I understand. About 150. And you're saying how many do we need before we're looking at disaster, essentially, if something hasn't changed?

Again, it's, it's, you know, open for debate. But I've seen numbers around that sort of 15-20 million mark for Shor's algorithm. There's— there's, there's definitely things though that start to kick in from sort of that million-qubit mark, you know, north of there.

So 150 to a million does seem— I mean, as a layman, it seems like a pretty big gap, right? But I, I— is this something we're expecting it to— does this pick up speed? Is this like momentum? Hey, getting from 1 to 100 is really hard, but then 100 to 1,000 gets easier, and 1,000 to 10,000 gets easier still. Is that sort of the thought process here? Because otherwise I'd be looking, going, well, 150 to a million, I guess I won't spend a lot of time thinking about this. But I have, I have a feeling based on our previous discussions that that this is picking up speed and that's why we should be concerned now.

Yeah, I mean, D-Wave just announced a 1,000-qubit system, for example. Whether or not that system is capable of implementing Shor's algorithm is open to debate. It's interesting because the qubit question really depends on, do we mean by what we call logical qubits, or in other words, qubits that are not subject to errors. And today's are subject to errors, and because of that, we need more qubits. That's why we might need 10 to 20 million if we just go on today's course and speed. Interestingly enough, if we could get 3,000 to 4,000 logical qubits— in other words, error-free qubits— you can implement Shor's algorithm to break—

oh, that gap just got a lot smaller. 150 to millions. Sounded a lot better than 150 to a few thousand. And there's my nightmare fuel. Thanks.

Yeah. All it takes is a breakthrough. And we've seen this happen in so many other areas. Do we know when that breakthrough will happen? No. Do we know if it will happen? No. If it doesn't happen, then we just kind of consider continue on the scaling trajectory we're on right now. And it's more likely to be more in the decade kind of range before we get to this issue. My own, my own opinion, by the way, you can show many others. However, I'm a big believer in breakthroughs. We keep having them. We had a big one in AI when, you know, for most of us, it was, seemed to break through when ChatGPT was released. I'll tell you, the breakthroughs were happening behind the scenes years before, but they were happening. And it went unnoticed by many of us. So it shocked us with how quickly AI will get here. My own prediction is we're likely to see the same thing with quantum computing, and it could be a bit of a shock. And let's also remember, governments are heavily behind this effort. China certainly has a major effort. The US government is intensely interested in this. I'll just ask a rhetorical question. When we have a quantum computer powerful enough to break the internet, Will we even know it, or will it be kept secret by a government?

Well, it's a good point, right? It depends on who gets there first, I suppose. And, and, you know, that doesn't necessarily mean there's good guys and bad guys. I don't care which side you're on, everybody wants to get there first, right? Nobody wants the other side to get there first. You know, it's— this isn't— there's no right or wrong answer onto who should get there first. It's just a matter of who does get there first. And then how they choose to act, as you said, you know, are they going to be public about this or are they going to be quiet about this? And, and meanwhile they have taken apart all of the— well, they've, they've overcome all of the security protocols, all the thing, all the underpinnings of the internet, and now suddenly have full access to everything that we think is secure and, and don't tell anybody about that. And I have no misgivings in saying that could just easily be our government as anybody else's. Governments are pretty good at getting a strategic advantage, informational advantage, coming from a guy who spent almost two decades at NSA and not telling people. That's, that's part of government's role sometimes. So I wouldn't be more or less concerned depending on which side ends up with it. But Rob, I got to have you define Q-Day then. So, you know, what happens if we get to Q-Day? First of all, explain what Q-Day is and then, you know, what the challenges are. What happens if you get there?

Yeah. So, so Q-Day is the day when we have a quantum computer powerful enough to break the public-private key that the internet is based on today. And to give you an idea, the underlying math for today's internet is, is really very simple. It is either based on the problem of factoring very large semi-prime numbers into the two prime numbers. So think of 15, the semi-primes are 3 and 5, and you and I in our heads can factor that very quickly. Now imagine a huge number, hundreds of digits long, that is put together by two other huge numbers. You and I can't factor that easily. Guess what? Neither can today's computers. So today's internet uses a 2048-bit key.

Mm-hmm.

And that's both for digital signatures and as a way to do the key exchange to set up, say, a secure session. When we're going to buy something or do a transaction on the internet. So once the, the, to do the key exchange, we get to symmetric keys, that encryption is better. It will take quantum computing much longer to get to. But to break the internet, we don't have to break all of symmetric key, which will take longer. By the way, there's another algorithm for quantum computers to have a speedup for it as well called Grover's algorithm. But that algorithm will take longer. Both Shor's algorithm and Grover's algorithm work. These are not theories. They work. Shor's algorithm has actually been implemented on, today's quantum computers and can break, quickly factor small semi-primes, or there's another method using logarithms, same kind of principle though. Shor's algorithm will break both of those for all of today's public-private key. So the day that happens, when the public-private key encryption that we all use, and it's crucial. Without it, we can't exchange the keys for symmetric key encryption. Symmetric key means if you and I were talking, you and I both have to know the key.

Mm-hmm.

In the old days, one of us got on an airplane with a briefcase attached to our wrist with the key inside. Literally, that's how banks and others exchanged keys.

Sure.

And thanks. That would be impossible to have an internet. Think of it. It would be impossible to have the internet today. If we didn't have a secure way without getting on airplanes to exchange keys.

Sure.

So it's absolutely crucial. It also gives us the way that we can prove that I can prove to you it's me and not a fake me. So I have— we have digital signatures as well. And I know I'm talking to my bank and giving my credentials to my bank and not a fake bank. These are all crucial. So Q-Day is the day when that's broken by a quantum computer.

And then that means that whoever does that could do all these impersonations. So I could be certain that I'm dealing with a bank because that's the encryption I've always believed in, and in reality I'm dealing with somebody else. I would assume nation state. I don't think Bob down the street's doing this. So, but now a nation state's actually in there, so they could take my money or they could take my information. And it would be all of the things that we currently consider secure on the internet because, you know, once upon a time we thought 2048 was, you know, was unbreakable. Nobody's ever going to be able to to handle that, right? And it's funny how no matter what we think is impossible as humanity, we continue to make the technology that, that makes those things obsolete. And then we have to find a new thing that's even better. For anybody who wants some real light reading, I, I highly recommend checking out Grover's Algorithm. I'm over here reading it on the side. And if you didn't like Shor's Algorithm, you're gonna love Grover's Algorithm. But no, it's, it actually talks about quantum search algorithm. It's, it's, it's very interesting talking about the high probability with, with searches. So as somebody who's not a mathematician, I'm actually, it is kind of interesting. But it's— all of this is fascinating, right? All of us use the internet. Pretty much all of us use the internet every day, all the time, right? We're on it right now. It's on my phone. It's everywhere. And I don't think most people understand, myself included by the way, how most of this works, right? And I say that and people are gonna go, Jesus, he's in cybersecurity, he doesn't understand how the internet works. I understand the basics of how the internet works, but really the complicated factors I don't. Just as I honestly don't understand when I turn the light switch on why electricity actually works. And my— I I didn't take the time to learn these things. I'm not an engineer. I trust these things. I know enough. But, but it's fascinating when you dig into these details with experts like yourselves, who, by the way, I appreciate you've been able to make this as simple as possible. I do understand it a bit, at least. It's cuz it is very complicated. But, but it's fascinating to see, you know, what's happening in this, this constant game of, of evolution of technology and how we're challenging ourselves to, to be better with these things.

It's interesting too, as you know, we've been, we sort of touched on the military aspects and largely the civilian aspects. But if you look at history, you know, in terms of the World Wars and other conflicts, that the breaking of codes and crypto is at the heart of, you know, human conflict over many generations. So you've got to imagine in terms of what's driving some of this innovation is the fact that if you can break codes and reverse cryptography on a in terms of conflicts, then that absolutely is an advantage for whoever can do that. So as you say, that's probably a key factor in driving some of this innovation. And you'd imagine, you know, how some of these breakthroughs might actually start to happen because there'll be aspects that will be, you know, advantageous for nation states.

Yeah, I mean, that's a good point. Listen, if China or the US or the governments are working hard at this, which we all know they are, it probably is not actually to steal money from my bank account. North Korean government, I'm sure they'd have an interest in that. That's part of their business plan. But they're probably a little further back on quantum, if I had to guess, based on what I know of North Korea. But, but yeah, breaking it from a military standpoint, you know, it, this reminds me going way back to like the Enigma machine.

Yeah.

And how that changed World War II. You know, the Germans felt that they had really solid encryption and, and that their, they had a key and it was, you know, their code was unbreakable. I guess everybody thinks your code's unbreakable until somebody breaks it. And you know, it was broken by Allied forces. And so then we understood. What the Germans were saying and where they were going, and their U-boats started sinking, surprisingly. And it changed the war, right? So this is obviously on a much larger scale, but you make a very good point when you mention, you know, governments and military. The military and the governments, they're not interested in doing this so they can steal our money. It's— it is for advantage, right? If I continue to believe I'm speaking encrypted— again, as a guy who spent a lot of time at NSA, I'm very familiar with encrypted comms. I'm very familiar with people who believe they're on secure communications and it turns out they are not. And and in war times, those people end up having much shorter times on the battle— battlefield. So, so there's huge advantages or disadvantages if you're on the wrong side when it comes to this from a, from a nation-state standpoint that could change— it could change obviously wars, it could change peacetime negotiations. You know, if you're gonna go into negotiations for like, you're gonna have bilateral talks or multilateral talks, say at the UN or NATO or something like that, it's really advantageous if you already know what everybody else is gonna say before they get there., and you might know that because they've had all these conversations that they thought were encrypted while they talk to each other to make their plans. And it turns out somebody's listening because they've broken encryption and haven't told anybody. So yeah, there's, there's all sorts of applications that, that I, that hit home for all of us. I think that's certainly myself that go beyond just like our, our daily life. So I guess the big question then, so the technology's advancing, Q-Day is coming faster than maybe we want to believe. How do we avoid breaking the internet? Because, because I kind of like the internet and I'd like to continue to use it, you know, so how, how is this gonna be stopped? How are we gonna avoid doing this, Jamie?

Well, this is, this is, this is, I guess, the interesting piece. And, and, you know, ISACA has been very interested in this, in this exact question. We did, so a little bit about ISACA. First of all, we're, we're, I guess, the glo— a global professional association focused on digital trust. So, so assurance, audit, cybersecurity, and, and governance is, is sort of our key areas. But we're also very interested in you know, AI, quantum, and some of these other technologies and innovations. And we surveyed our constituents and some really interesting responses we got back in terms of just where quantum sits, I guess, in the broader, you know, the broader ecosystem, I guess. And I think the majority of our— certainly the majority of our surveyed members were aware of quantum and aware of some of the risks, I think 62%. So that was really a positive. Still a little bit concerning that 40% are not aware, but we're sort of past that halfway mark. What was really concerning is only 5% at the moment are doing anything. So their organizations, only 5% are doing something about it. So we do have this gap, I suppose. Quantum's, you know, we're talking about it here today, but it is still very much a bit of an under-the-surface problem for most people. AI is taking up a lot of that vacuum of discussion and quantum's And that's becoming, uh, becoming more of an issue as we get closer to Q-Day, I suppose. But interestingly, we also have this concept of, of, you know, harvest now, decrypt later, which is, which is another challenge that we, we work with. And that's, you know, again, if we're talking nation states, we know that nation states harvest data and, and on every, you know, on citizens, on, on every manner of things. So potential to decrypt those in 5 or 10 or whenever Q-Day, you know, finally hits as well. So that, that timeline becomes a concern, which, which kind of pushes forward the preparation to more now or over the next little while rather than waiting until Q-Day is on us and then sort of there becomes a bit more of a mass panic. So interesting dynamic, definitely. From my perspective, how do we avoid it is we start now. And as organizations, the key thing to start with is education and actually understanding what the challenge is. This podcast is great. It gives some really good background and then just making sure that not only as practitioners we're educated, but our executive are educated and organizations in general have an understanding that this is going to become a problem if we don't start to action it now. Right.

And so with almost everything in cybersecurity, our first response is education, right? And it's for good reason. It's always true, right? How do we stop phishing? Well, we've got to educate people on what phishing attacks look like. How do we stop malware? Pick a, pick a thing, right? It always starts with the users 'cause the users are, you know, the, the problem usually. So we start there, but I'm curious in this case, so my guess, I don't wanna put words in your mouth, but this one's a little different. It would appear to me we're not gonna try to educate everybody on quantum, right? It seems impossible. I, I consider myself relatively bright. I've been in the industry for decades now and I barely understand this. I'm certain that my, you know, relatives, you know, grandma and, and whatnot are not going to, like, it's, it's not gonna be the same.

This is, it, we can't get them to understand phishing still.

Deal, right? So, so when we talk about educating our stakeholders, where are we drawing that line? I mean, obviously government leaders, you know, the, you know, the people who have the power to invest in, in the solutions to this. If they don't even understand that, at least they have the power to make decisions, you know, legislation, that kind of a thing. And then technical experts. But where, where do— where's the line? Like, who are the stakeholders here? Who are the people we have to make sure understand this and are working on it? And, and then the rest of us are just going to be dependent on those smart people keeping us from losing the internet, I suppose.

Yeah, well, certainly it would be cybersecurity professionals and absolutely certain that CISOs understand and also IT auditors, the people who are gonna assure the systems, regulators. Yes, board of directors, you know, management has to understand at a high level the risk. I would say probably not much deeper than what we just discussed on today's podcast is the level of understanding that yes, There is a risk. Q-Day is coming. It will come. The question now is, and there is good news, NIST has known about this issue for a while. Uh, they've been working on this for almost a decade. And many, many potentially solid algorithms that would be able to not be subject to Shor's algorithm have been proposed. Large number, over 60 that the NIST looked at and the cryptographers all over the world have looked at over the last decade. They came down to 3 now that are— we actually have FIPS standards, just like we have FIPS standards for the, for the encryption that we've used previously. And so you can now actually implement those algorithms for both digital signatures and for public-private key encryption. So for doing the key exchange, And then when it comes to symmetric key and Grover's algorithm, the simplest today is just simply increase the key size. So, so even with a quantum computer, Grover's algorithm has trouble as you keep increasing the, the key size. Shor's algorithm, just increasing the key size, say, from RSA 2048 to RSA 4096, once we have a large enough computer, it's not going to make much difference. So So Shor's algorithm is a bigger problem in public and private key that underpins the internet. So we have these algorithms. They are starting to be implemented. And so a lot of the march to preparing for Q-Day is about, okay, what's the right process to take so that we can all begin moving to post-quantum cryptography that is not based on factoring large semi-primes or certain logarithmic problems, but encryption that actually the largest quantum computer isn't going to break. And that we— fortunately, we have those algorithms. We have new mathematical algorithms that are out there. There's actually a couple more coming, a couple of backup algorithms that NIST is working on just in case a cryptographer somewhere figures out a genius way to break it. Always a possibility. So nice to have a backup that we can quickly move to as well in case that occurs.

I mean, that's all very encouraging, right? I mean, it's also very scary, but I mean, at least this is encouraging. And it's good to know, you know, that we've got a good definition of the stakeholders. Like I said, if this was dependent on, you know, our relatives and friends around the world being able to understand this thoroughly, I think we're in a lot of trouble because phishing is still very, very effective and it's very simple comparatively. So it's, it's good to know that the stakeholders are understood. It's good to know that NIST has been working on this for a long time. And, and, you know, there's a lot of things that go on in the background that most people don't know about. That's how the world works, and that's a good thing, I think. So two things I wanted to mention. First, for those who don't know, I, I should have said in the opening, we keep saying ISACA. It's I-S-A-C-A. For those who don't know, that's the Information Systems Audit and Control Association. I should have defined that for everybody. I don't think everybody knows that. It's very important. Organization though. So if you're not familiar with ISACA, you know, please check it out. You know, as most people know, don't do a lot of plugs on the show for companies, things like that, but that's not what ISACA is. You know, this is, this is a, an association. This is important. And what we're gonna talk about and some of the solutions that go along with this, I, I highly encourage people who wanna know this better or, or a stakeholder as, as was defined here to reach out to ISACA on this. I know that actually you guys developed a new preparation checklist. That walks through some of these things, right? Can you talk a little bit about the checklist, what's in it and who it's designed for and how it's going to help?

Yeah.

So SACA has pulled together a checklist which is, which is available on our website at SACA.org, and it distills down, you know, all that we'll be talking about today into, into a very simple kind of checklist of things to do to become prepared for Q-Day, essentially. So, or at least for the quantum, the quantum challenges that are coming forward. So education is definitely part of that. And then that next phase is sort of where we, I say, start to eat the elephant. It depends on the size of the organization, but it's really understanding where you have those crypto, particularly public key, you know, usages within the organization, whether they're repositories or whether they're, you know, transactional, but start to identify those and start to build out a plan of how, as Rob said, you can move that towards post-quantum cryptographic algorithms. So it may sound like it's, you know, this quite challenging sort of esoteric concept. But the reality is the rubber hits the road and we can start to identify where in the environment we have exposures to traditional crypto crypto and then have a plan to start moving that through over the next period of time. So it's not something that needs to be done, you know, it needs to start today. It doesn't have to be completed today, but it has to be something that's in focus over the next little while so that when that day arrives, whether it's 5 years, whether it's 10 years, whether there's innovation tomorrow and it happens next week, it's It's definitely, from my perspective, it's coming and being, being as well prepared as we can and having a good understanding of, you know, what's at stake, I think is really important so that, so that we can achieve a good result.

Well, let's hope it doesn't come next week. I mean, none of this sounds like something we're ready for. So I'm— this is a rare occasion where I'm going to root against science having a breakthrough. I'd like to see that not happen for a while. I guess this is maybe teleportation would be another one that comes to mind that I'm in no hurry to see happen. That could be— that could be some other generation that manages those problems. So a couple of thoughts I wanted to post. These were not things you were prepped for, but in going through the discussion. So again, we've talked about this is complicated, right? I mean, in general terms, it is not if you're a quantum physicist, but for the rest of us, this is somewhat complicated and, and that's fine. But for, for the rest of us who are so dependent on the internet for everything, right? So it puts you in a position where, okay, there's something very bad that could happen. There's a lot of very, very smart people that are working on solutions to this. Most people are never going to understand this with any real depth, myself included, frankly. And so that requires you to just have some faith and trust in science, in technology, in good people, which historically has not been a problem. We're in a different part of history right now, it would appear. So, you know, how do we manage those challenges? You know, if, if we have people that just don't understand this and now and refute it and say, oh, this isn't happening, it's, you know, it's a It's a hoax, or it's, you know, somebody's just doing this because they want money. You know, we're doing it at a time right now with a lot of government funding is being cut. And, and I think sometimes in cases where people just don't understand things, so they think they're waste. I, you know, is there a risk, or, and I don't want to make you into a political discussion, I'm not trying to put you guys on a hot seat when I say this, but is there a risk in that area of ignorance resulting in lack of faith or trust and confidence in these things and then undermining all of this and putting our country or any country for that matter at a disadvantage? And if so, are any thoughts on how to counter that? How do we educate even the average Joe like myself enough to have faith in science and technology on something that is instrumental to the future of all of us if we want to continue to use the internet?

Yeah, I think, I think part of it is most people don't know how today's cryptography works and why the browser is safe. So probably part of it is just explaining it in simple terms, as I tried to do using Five and 3 and 15. And now imagine that you got this really big number, takes millions of years, and all of a sudden you can break it in seconds. Now we're, now we're in trouble. But for most of us, you know, for like, uh, say my, my children who are not into— many of them not into technology— they're just gonna one day be using browsers and going to sites, and unbeknownst to them, it's going to be using post-quantum cryptography. Instead of the method that's being used today. And this is already being worked on. So if you already have faith in the major providers of browsers and the major websites that you're going to, say your bank, say where you buy goods, et cetera, chances are those places are gonna move along as quickly as possible. Where we're gonna struggle is, is you get a little more fringe and it's going to be slower. And, and I would just suggest we're a little more dubious of some of those sites already, and maybe with good reason in the future. If any of us are in a buying position, simple questions to ask of vendors who provide us software in particular, or sell us the Internet of Things devices— so say a security camera So imagine you buy a security camera, it's cheap, it's great, but quantum computing can easily break it. And you could use quantum even through the cloud and the cloud service someday in the future and easily break it. That would be a big mistake. So we're going to want to start looking for certifications and you, you will be able to get certified against these FIPS standards. That's what they are. They're certifications you can go through and start just simply, if we're in a buying position, asking our vendors, are they certified against the NIST post-quantum cryptography algorithms with the specific certification names that are there? It's not difficult. We do that today. Those are easy questions that we can ask of our vendors. We don't have to be brilliant to do that. And we can— if we are in a position of control over our own teams, when it does come to cybersecurity, you know, there are important questions to ask, as Jamie was saying, about the state of our encrypted data relative to that. And that go beyond just education. And now we got to start making plans and, and figuring out what we do first and what the prioritization is. And there's a lot of advice relative to that. It, this is not so hard to do, and you don't have to be a quantum physicist to figure out how to do it. This is straightforward process and security stuff. Not that different than we all did for, say, Y2K in terms of the kind of process and thinking that has to be put in place. The one difference is we don't know what the date, the actual date is for Q-Day.

That's a good point. Jamie, anything to add to that?

Yeah, I think there's, I mean, we've seen with the survey results, which are also available on our website, that there's definitely an amount of inertia here, which is not unsurprising, I suppose, but it's still there nonetheless, that inertia, that just taking, you know, taking the steps to start the preparation and getting across what the issues are. As you say, we're not all quantum physicists, but it doesn't take a lot to become aware of the challenges and aware of what the implications are. So I take your point too, that there's often a fair amount of skepticism when we're trying to kind of shift mindset. And the other interesting dynamic here, which we sort of haven't sort of touched on, but With the, with the, you know, potential crypto, you know, the, the privacy aspects, I suppose, of crypto. And if that's— if data becomes very accessible in a very quick time, sensitive datasets, then you've got privacy issues. And if you look at GDPR and some of these things, there's, there's, there's these big rocks coming for companies that, that aren't moving to more quantum-resistant or post-quantum encryption because those datasets suddenly become potentially harvestable or accessible. And if you're looking at privacy of user information, you're looking at all these aspects that all tie— like we rely today on on, oh, and we assume privacy of our data when it's at rest or wherever it is on the internet. We know that that's an ongoing challenge, obviously, that we're fighting with today, but that privacy aspect is a fundamental aspect. And this whole issue plays right into that in terms of ongoing privacy of data and whether it's consumer data, whether it's business data. So I think the time to act is now. And I think we, you know, owe it to get across the issues and be aware of what's coming down the path.. And somber professionals.

Yeah. I mean, it's, it's really a fascinating topic. You know, it's, I'm in a, I'm in a lucky position doing this show because, you know, some topics show up and I just know what they're gonna be and they're gonna be easy to talk about and I understand them well. You know, something in inter— in international relations, something in, you know, in, in intelligence, things I grew up, I've grown up doing, you know, for years. And then every once in a while I get a show where somebody brings me a topic and I'm just like, I don't know anything about this. And it also may or may not be interesting. This is fascinating though. Like, the more we talked in prepping for this, I don't understand as much as I'd like to, but I understand more than I did. And maybe in a sense I wish I didn't know because I'm a little scared, but, but it is fascinating to, to recognize what's happening, you know, and, and that escalation, you know, the speed at which technology changes, right? That we can go from 15 qubits and it could be 1,000 and, and who knows where it goes from there. And, and maybe it doesn't take millions, maybe it only takes a few thousand if they're really good as opposed to being, you know, noisy. To get someplace. So I gotta ask the obligatory question that goes along with all this. Where does AI fit into this? You know, it— Rob, you mentioned a while back, you know, the challenges in programming, for instance, you know, that qubits, you know, computers, you know, quantum computing isn't like computers we use every day. We don't have Windows, we don't have, you know, iOS, right? It's, it's a totally different system and it's, it's harder to do and most people in the world can't do this. What about AI? Is this, is this gonna be another thing where, you know, I'm sure somebody's gonna sell it, like whether it's real or not, let's face it, this will, this will be the heart of, you know, some company relatively soon is gonna be AI writing code for quantum computing. If somebody hasn't already put that on a billboard somewhere, I'm sure they will. But what are your thoughts there, if any? And maybe AI doesn't apply and just tell me it doesn't, I'd be thrilled. But what are your thoughts there about where AI is gonna fit into this, you know, going forward? Because, you know, having just come back from, you know, RSA conference, uh, everybody's got AI and everything now. So, you know, is that the solution to this or is that the, the danger?

Yeah, I mean, AI actually has several aspects relative to quantum computing. One is the one you mentioned of actually writing the quantum computing code. Will that happen someday?

Absolutely.

We're already at the day now where AI can write conventional code. I want to emphasize, most developers say maybe it does about half the job.

Yeah, it's pretty bad at it from what I understand still.

And let's remember, I was a programmer. When I started my career, I'm the first one to tell you, when you still have 10% of the code left to do, you're about halfway done.

That's right. Yeah.

So when it writes half the code, you're like 20% done. You're not even close to done. So I want to temper that with reality that other than specific problems, AI is still not— it's helpful in writing code. But it's, it's got a lot of work to do to get there, and it'll have a lot of work to do to get to writing quantum computing code. It's almost certainly part of the answer though for us getting there. Secondly, because of the quantum natures of quantum computing, it is ideally suited to certain aspects of AI. So if you ask, will AI run on quantum computers? Absolutely. It's really good at optimization on quantum computers, something that AI, we ask AI to help us with constantly. Think of the traveling salesman problem, very hard to solve on a conventional computer in any reasonable amount of time. So we don't usually do it. Now you could do it easily with a quantum computer and have been able to do for many years. So AI will be running on quantum computers, very good at pattern matching, ideal for AI. And then finally, a last aspect. What slows us down on AI? If we just ask that question, much like we asked what slows quantum computing down from growing faster, brought up the issue with error correction, of course, the cooling, which keeps it from being ubiquitous and ever wearing one on our wrist. So what slows AI down is the sheer size of the data centers and the energy consumption that those data centers require. Interestingly enough, while it sounds very expensive to build the refrigeration unit for a quantum computer, here's what's unique. As we build larger and larger classical computing data centers, they require continually more power.

Mm-hmm.

So, so much power that many of the largest ones are the same power as a small city. And we're talking about now small nuclear reactors to power those data centers. With a quantum computer, once you've spent the effort to get it down to absolute zero with your refrigeration unit, add as many qubits as you want. You don't need additional power.

Really?

The power is static. It's fixed.

What about the power to keep it at absolute zero, though? If you're adding more computers, you're adding more qubits, right?

But if you add more qubits, this is what makes it cool. As you add more qubits, you don't need more refrigeration.

Huh.

It's amazing, isn't it?

That is amazing.

Yeah, that would, that would not have been my thought. I was figuring it was gonna be a conflict.

Yeah. So, so the reality is quantum computing could actually be one of the answers for today's power-hungry data centers, especially for AI. Because once you've— even if we still have to cool to absolute zero, that cost is fixed, so we can get ever more powerful without having to consume more energy. So you could argue quantum computers are quite green.

But can I crypto mine with a quantum computer?

That's a very interesting question. So today, Shor's algorithm is not what you need to help you. And more importantly, could you break blockchain so that all the crypto is yours?

There's the question, yeah.

Another question. So the quick answer is no, Shor's algorithm is not the one that will let you break blockchain. However, there is risk just that other things will come along that will let you do it. Almost certainly with some work, they might help you crypto mine faster, thereby reducing the value, by the way, of those coins. So there's risk there as well. So yes, quantum computing could pose a potential threat to— far into the future, I don't want to say soon. Far into the future for the cryptocurrency that we're using today. Very important that we begin to use post-quantum cryptography and methods like that embedded into the blockchain and ensure that the blockchain is as quantum resistant, if not quantum proof, as we can make it.

It's amazing. We're living in a sci-fi future and we're talking about cryptocurrency, fake, you know, fake money, like for, for like a better way of putting it. And no offense to anybody, I've got some as well, but I mean money that's made outta nothing essentially. We're talking about AI, you know, the future is, is nearly here and it's not human anymore apparently. We got crypto computing on top of all this. And, and so just as we've spent the last few years talking about blockchain, blockchain's the answer for everything. It's gonna make everything safe and secure. Nothing's gonna be able to break it, et cetera. And now we're like, well, wait a minute, crypto might come up, crypto computing might come along and, and that might break it. It's, you know, quantum computing might show up and break crypto just like that. You know, there's all this trillions of dollars of valuation in crypto and everybody's been very excited about it and maybe it'll be fine, but also maybe quantum will have a breakthrough and somebody will just come in and take all your coins and all your magic money will become nothing again. And of course, so would the whole world economy would crash if somebody does that. But it's, it's a remarkable world that makes me sometimes wish I was just a wee bit more arrogant, ignorant, not arrogant. God. A wee bit more ignorant of all of these things. Don't worry, I'm plenty arrogant, ask anybody. But a wee bit more ignorant of all these things because it's, it's scary stuff, but also just super exciting and interesting. And I'm going to tell you, just self-serving, I spent years working a while ago with a team where everybody was infinitely smarter than myself, mostly mathematicians, PhDs, true rocket scientists. And now I'm very excited to pass this along, be like, hey, you got to listen to this episode. I finally had a conversation with people that are that kind of smart. And, and it's amazing. And this will be very interesting because, you know, most of my conversations are interesting and exciting but in a different area. So I'm looking forward to reaching out to all my math PhDs and, and having them come in and tell me how great this, this episode was, how interesting this is, because I find it fascinating and I still only understand about half what we're talking about. So, but it is interesting. Jamie, before we get to the closer, and, and you guys are both gonna get stuck with that same closing question everybody gets But is there anything you want to add to the technical part of this discussion? You know, whether it's, whether it's AI, whether it's the future, any, you know, any parting thoughts on are we in a good place or in a bad place? Should I, should I pretend I don't know any of these things or should I be excited for the future?

I think we've, we've sort of highlighted just that. You're right. It's such a fascinating area. And whilst we want, we're trying to build awareness here, we're not, we're also not trying to suggest that it's time to panic. It's, it's you know, it's a measured approach and get, you know, educate, educate yourself, educate your stakeholders that are key to kind of building the steps to address this and then start working towards it now. But absolutely fascinating. I mean, we've seen just in the last, I mean, it's been a long journey for manufacturers like NVIDIA, but in the last few years with how that's just exploded with their computational services around AI, you can imagine you know, what the vendor landscape and just the broader ecosystem is going to look like when you've got quantum with AI running on top and then you've got, you know, blockchains and cryptocurrency and everything kind of in that ecosystem. It's just going to be fascinating to watch the dystopian future that we're building for ourselves.

No, we're building dystopian future so AI can take all of it. I've seen how those movies end. It's never good for us. So we're, it seems like we're trying very hard to, to make sci-fi real as if we don't understand what the results are going to be. I'm hopeful it won't be my generation, but it's a possibility. So listen, I want to thank you guys. This has been a fascinating discussion and I know we didn't give it justice. An hour is just— it's all you can really do right now. But I mean, it's enough for people to understand, hopefully, and want to learn more. And again, you can reach out to ISACA to learn more about, you know, how to— what quantum computing is, where we're going, you know, the checklist to help get prepared for this. It sounds like just about every CISO at a minimum should understand these things and know what to do, probably into the board levels as well. You know, the, the people who run companies and, and keep all of us, you know, safe or moving forward or whatever it is, we're all gonna be very dependent on them. And of course, nation states as well. So as we're getting to close out the show, listen, the name of the show is Unspoken Security, so everybody gets the same question to close the show. And in this case, both of you get it, so you get double the answers. So again, name of the show, Unspoken Security. With that in mind, tell me something you've never told anyone, something so far that has been unspoken. Rob, you're gonna go first on this one.

Sure. Yeah, well, I'm gonna show my security ignorance when I was a young programmer. So I actually started programming as a teenager, which you can tell by my age, that was quite unusual in those days, not unusual at all today. And actually built an accounting system that was used by a number of customers. And as often happened, you, I had to also do the customer support. When there were issues with the accounting system. And in order to avoid all the hassle of getting credentials and being able to get into the customer system, I put in a backdoor.

Oh.

So that I could easily get in as age 16 into the accounting system and quickly help my customers. I did it for a benign reason. That seems like— I didn't even know what a backdoor was, by the way. So I was helping customers for a year. And finally, this one customer said, wow, you help us so fast. How do you do it? You know, you usually have to go through this process and we have to give you access and all the rest. And I said, oh, I just programmed in this capability that only I have access to. And he looked at me and he said, that's called a backdoor. I said, backdoor? Yeah, I guess that's what it is. He says, you can't do that, and explained to me why. And that was in many ways my first introduction to security concerns at a, at a very early age, kind of a negative way to learn about it. I promise you, I never put in a backdoor again into anything. I was quite chagrined by making what was obviously a rookie mistake.

I'm assuming you didn't have to spend any time in a courtroom explaining this to anybody, that it was understood that this was not nefarious and you just had to clean this up. I mean, these are, these are regulatory organizations. No, I mean, he was kind.

He was not happy. I did get yelled at. He was kind to me, realized that I didn't mean to do this. I promised to go through the front door from then on, and I dutifully removed the back door. And, and, you know, as a company, we had to assure them actually legally that there were no back doors.

Sure.

There was a legal consequence to this with an addendum to the license agreement. Today, very common that that's written in. Back then, not that common. They weren't, they were not a, not a common concern. And it was a word I had never heard. Today, most youth have probably heard that word.

Well, you created it. You're the reason all of our contracts have these.

I would love to say I'm the first one, but I seriously doubt it. I'd at least like to say it was through ignorance and not, not through for some nefarious purpose.

No, I mean, I love it. It was very efficient. I'm sure you triggered a whole bunch of lawsuits.

I was super fast. People loved me. They were amazed at how quickly I got to the bottom of their—

Yeah, it's magic when you live inside the environment. You were, you were an advanced persistent threat before that existed, and I'm sure you triggered an all, all sorts of audits for these accounting firms. You're gonna have to go through and make sure that you weren't moving money around. So well done, Rob. And 16 at this time, you're saying? So that's impressive, and you avoided jail. So thanks for sharing the story. Jamie, you get to try to top that story in some fashion. What have you got that's so far been unspoken?

I'm not sure I can talk, but I thought I'd keep it on theme. And we've talked about software development. We actually briefly mentioned sort, and I think it was in the context of quantum sort. But in the '90s, about 30 years ago, when I was at university and I was doing one of my degrees with software engineering, and I was doing a second or third year top subject on algorithms, advanced algorithms, and our assignment, a coding assignment, was to do a complex sort routine that, that required manipulating many, many tree nodes, which just was, was a little bit complicated and for my head to get around. And so I'm developing this code, pulling this all together, and it was, it was awful. The code, I couldn't decode it. There was things not working. I was supposed to have 99 or 100 nodes in my sort tree, and it was just, I was getting out of hand and I couldn't, you know, I couldn't, couldn't work it through. So in the end, I got desperate. I commented out my entire code and then right down the bottom, called the operating system sort routine right at the bottom to go and do its thing. So confident that I was just gonna get zero for that. But as it turned out, they ran them through automated testing, and because I'd called the operating system sort, it passed with flying colors. No one actually looked at my code to realize that it was all just comments and there was actually no code. So I still to this day have a software engineering degree from that university. So I'm not going back now to hand it back.

I'm sure they're proud. Do you want to, do you want to tell us what university this is, or should we keep this to ourselves?

Maybe, uh, it's probably on the public record somewhere, but it's been 30 years, so hopefully, hopefully everyone's forgotten.

I think you're safe at this point. I think you're safe. Listen, it's— everybody's got, like I said, everybody's got a story. That's why we have these discussions, right? And I think that's great. I mean, you didn't do anything— both of you, it's interesting, both your stories were no effort to do anything nefarious. You know, Rob was just trying to be more efficient. Jamie, you just accepted it. You're like, I'm getting, I'm getting a zero. I'm just terrible at this. This is not working the way I want it to. I'm just gonna be honest and throw it forward. And it just worked out in both cases. So I mean, it's a good story. Both are good stories about, you know, sometimes you just don't know what's gonna happen. You're gonna make the best effort and, and see what comes out. Listen, I'll, I'll add a confession. Sometimes I add my own and sometimes I don't, but I'll add one here that I'll probably regret later. So when I was in grad school, So I, before I went to Gonzaga, actually, I started grad school at University of Louisville. I was going to do a program in administration of justice. I was very interested in criminal justice and, and thought that would be a great place to, to put my time and effort, you know, restorative justice, things like that. For those who don't know administration of justice, it turns out that's a degree if you want to be an administrator in the justice, if you want to be a warden for a prison, basically. So I should have done more research. It's not, not really where I wanted to spend my time. But I admit, my first grad school class and I was overwhelmed. You know, I'm, I've always been a decent student, but there's a leap at grad school at first. You have to understand things like, hey, don't try to read every word of everything they give you to read. You don't have enough time in the day. And then you have to write papers on top of that. And I was overwhelmed. And so at one point in that first class, I considered reaching out to somebody to, to write work for me. You know, I actually did the investigating to look out and see, like, you know, there are people that'll do that if you pay them and give them a topic. They'll write things for you. And you know, I'm, I'm not proud of it. I, I consider myself a pretty good writer, but there was a point when I was concerned that it might happen. So, you know, academic challenges happen to everybody. Uh, I did manage to make it through that class as it turns out, and then I went and changed universities and I never really felt that way again cuz I got over that hump of the one class and then realized, hey, try to read about 30% of what they give you in grad school for anybody who's going to grad school and then figure out the rest as you go and skim through. You can't read every word of everything., and don't worry about the writing, just, just knock it out. Right. So, so we've all got stories like that someplace, you know, it's, yeah, I've never cheated in my life and I actually seriously considered hiring somebody to write paper for me because I was afraid I wasn't gonna be able to succeed otherwise. And apparently I wasn't gutsy enough as Jamie was to just say, I don't know, hell with it. I'm just gonna submit it and take the zero. It's just not gonna work. I should've just done that. I, I, it would've been better, but ultimately I, I thankfully was able to, to whip something together. Granted, my writing is not nearly as complicated as, as the kind of work that you do. So most people can whip something together. I can't whip code together. So anyway, thank you for sharing that, by the way. Both your stories, I think, are interesting stories. I think they're good pieces for people to take something away personally from this. And thank you for the time today for going through this very important and somewhat complicated topic that you both managed to make understandable. I feel like I understood enough, enough to be dangerous and, and a little scared, but also a little optimistic. And I think that's, I'm hopeful that's what the audience takes. And again, if, if anybody listening or watching wants more information, you can reach out to Rob or Jamie or reach out to ISACA directly to learn more about, you know, what's gonna happen if we don't take action, you know, and, and how to avoid having quantum computing break the internet, you know, and, and what's gonna happen in this post-quantum, you know, cryptography world that we're headed for. So with that, I'm gonna wrap up the show because we, we've run a little bit long, which is fine. That's what editing's for. But again, I wanna thank my, my guests, Rob Clyde and Jamie Norton for being here today. And for everybody who's been listening or watching and made it through all these episodes, thank you. Please feel free to, you know, like and repost and comment and all the things, right? Subscribe, you know, so we can keep the show going. If you like the show, let me know. If you don't like the show, let me know. Like, let's figure out how to make these things better every week. But until next time, I'm going to sign off today. I'm AJ Nash, and this has been another episode of Unspoken Security.

That's a wrap for this episode of Unspoken Security. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.