The founders of Public-Key Cryptography can’t agree on how we replace it

Disclosure: This piece is based on a panel at Quantum Tech World in Boston, MA. It was a showcase from American Binary, and included advisors Bruce Schneier, Whitfield Diffie, and Brian LaMacchia. I’m an investor in American Binary. Reporting, not investment advice.

For years, cryptography was the side track at quantum conferences. Qubit counts got the main hall. Post-quantum sessions ran in the small room down the corridor, if they ran at all. This year, Peter Shor opened Quantum.Tech World with a keynote on his algorithm, which was, frankly, the first killer app for quantum computing — back in 1994, before quantum computers were even a dream.

Three days before that keynote, on June 22, the President signed Executive Order 14412. Federal high-value systems have until the end of 2030 to move key establishment to post-quantum cryptography (PQC), the end of 2031 for signatures, and federal contractors face proposed rules requiring validated post-quantum modules by the end of 2030.

The day after Shor’s keynote, I moderated a panel with the people who built the infrastructure that these deadlines are applying to. And they’re thinking a lot about the next era.

The panelists:

Whitfield Diffie co-invented public-key cryptography and was the Chief Security Officer of Sun Microsystems. Thank him for the data privacy we have had so far.

Bruce Schneier wrote the book most of us read first in cryptography. For me, that was in 2014 when I was living in DC, doing my Physics PhD and my three-letter agency friends started asking about Shor’s algorithm. He’s a board member of the Electronic Frontier Foundation, Access Now, and The Tor Project. So really takes privacy seriously.

Brian LaMacchia ran cryptography at Microsoft through two of the largest algorithm migrations the industry has ever attempted, as well as had a leading role in the design of XKMS, the security architecture for .NET and Palladium, and establishing the MIT PGP Key Server. He’s seen a lot.

Andrew McElroy, the CTO and Co-Founder of American Binary, which building the first CNSA 2.0 compliant quantum-resistant VPN, and has partnered with Oracle to deliver it to the enterprise and defense sectors.

The conference happened during an extraordinary week for the intersection of AI, quantum, and security. The government had just banned Anthropic’s Fable and Mythos models from foreign nationals after the NSA's director reportedly told the Senate Intelligence Committee that, in a red-team exercise, Mythos broke into "almost all" of the agency's classified systems in hours.

I brought this up on stage because the Mythos episode illustrates something Diffie had just said about complexity being the enemy of security: the AI wasn’t finding individual vulnerabilities; it was finding new ways to stack them together. The more complex the system, the more paths an attacker has to chain into something weird and exploitable. That’s the argument against the very thing the industry is proposing as the solution to the post-quantum migration.

While the questions I posed were high-level, the conversation really went deep on the practical ground. Non-quantum companies ask me constantly what they should do to prepare; the standard advice is to check the CISA/NSA post-quantum migration playbook, run a cryptographic inventory, and start evaluating NIST-approved algorithms. That’s a fine starting place. But the book assumes you’re migrating to a known target. The disagreements between the people who designed the systems you rely on matter when you are a CISO evaluating what to do next (and how you can keep your job).

They agreed the migration is coming. But what do we do?

The first practical problem is that the two largest regulatory blocs on earth are telling you to do opposite things.

The US answer is commit to PQC. NSA’s CNSA 2.0 does not require hybrid classical-plus-post-quantum constructions for national security systems, and actually discourages it. It defines a standalone target suite built on ML-KEM-1024 and ML-DSA-87, as well as retires the Diffie-Hellman Key Exchange and pre-shared keys.

Europe went the other way. Germany’s BSI, in its January 2026 technical guideline (TR-02102-1), recommends hybrid deployment through the transition, and France’s ANSSI has said hybridization will be mandatory, with no new certifications for products without a post-quantum component from 2027.

If you are a multinational buying security products today, you are choosing between two government postures that contradict each other. Do you need to build two products?

On stage, the field’s founders lined up on both sides of the fork. Schneier, who spent the first half of the panel arguing that complexity is the enemy of security, still came down for hedging:

We’re very young in our cryptanalysis of these sorts of systems. We have nothing like the decades of experience we have with something like RSA. I like hybrid right now because of the uncertainty.

This deserves some nuance, because the families of mathematics underneath these algorithms are not young at all. Both ML-KEM and ML-DSA, the two algorithms at the center of CNSA 2.0, are built on lattice problems; specifically, on a variant called Module Learning With Errors. Lattice-based cryptography as a research field dates to Ajtai's foundational hardness results in 1996, and the LWE problem itself was introduced by Regev in 2005. What is young is the specific construction. CRYSTALS-Kyber, the scheme that became ML-KEM after NIST standardization, was submitted to the NIST competition in 2017 and finalized as FIPS 203 in August 2024. The underlying hard problem has thirty years of study; the specific algorithm, with its parameter choices and encoding, has nine years as a design and two as a standard. RSA, by contrast, has had forty-nine years of sustained cryptanalysis. However, RSA and ECC have been in the wild for a long time, whereas LWE and lattice-based haven’t been evaluated at that scale. And AI is a new problem, of course.

That gap is what Schneier means by "very young," and we have already seen this happen in the evaluation stage. SIKE, another NIST post-quantum candidate that made it to the fourth round of evaluation, was broken in 2022 by two researchers at KU Leuven in about 62 minutes on a single core of an Intel Xeon processor from 2013, using a theorem from 1997 that nobody had thought to apply yet.

Diffie, when asked to choose between full ML-KEM-1024 and a hybrid tunnel at equal performance, he called the framing itself a trick: “that’s begging the question. If you believe ML-KEM-1024 is better, of course you would choose it.” His deeper objection is that giving a system a menu of algorithms is the thing that gets you attacked:

If you offer to use a variety of algorithms, your opponent may be able to pick the algorithm you use, and if they can exploit one and not another, they’ll pick the one they can exploit.

The usable takeaway from the exchange is that hybrid versus pure is not a settled engineering that choice you can look up that is being followed worldwide. You may be compliant in Washington, and non-compliant in Paris. And that takes away a market.

The industry’s answer to the doctrinal split is that it doesn’t matter, because you build systems that can swap algorithms either way. The word for this is crypto-agility, and every vendor now sells it. Schneier gave it this definition: “Crypto-agility is not convert from A to B. Crypto-agility is the ability to convert when necessary. So when you become crypto agile, you didn’t get a new algorithm set.” LaMacchia sells the same idea as an argument to spend now; pay the cost once, and every future transition is cheaper.

If you’re evaluating products, crypto-agility sounds like the safe bet. Buy the system that can be configured to either doctrine, and you don’t have to pick a side.

Then Diffie mentioned that just the crypto-agility is not enough:

TLS has crypto-agility in it, and yet that doesn’t solve the problem…. I’d put my money on people coming up with places where it’s hard for the agile thing to jump as far as you want it to.

Andrew McElroy added: “In the case of TLS, that’s been the poster child of the downgrade attacks.”

This is the problem with the basic playbooks. As Kevin Kane, CEO of American Binary, said on LinkedIn, “The terms “post-quantum” and “quantum-safe” are not interchangeable. If a system uses post-quantum digital signatures but still relies on a classical Diffie-Hellman key exchange, it is not Quantum Safe by NSA CNSA 2.0 requirements.”

Diffie’s claim is that the mechanism you build to stay agile is itself a new attack surface, because you can weaponize more of the pieces against itself.

This is where the Mythos flailing happened. What happened with the NSA’s systems wasn’t a single vulnerability being exploited; it was an AI model finding novel ways to stack vulnerabilities together, chaining them into attack paths nobody had mapped. The more complex a system, the more seams there are for something to chain through.

For anyone building a vendor shortlist, this means crypto-agility is necessary but not sufficient; you need the flexibility to support multiple doctrines, and you need to ask how that flexibility is implemented, because the implementation is where the downgrade attacks live. On top of that, you need solutions that are quantum-safe today, not just ones that can become quantum-safe later.

The clock is running out due to regulations, not end of life of equipment. Think of data centers that are buying hardware with security chips that can only run ECC or RSA.

Schneier’s position is that you should move now:

The reason you do it now is because it’s not urgent. The last thing you want to do is a transition like this under a deadline. It is precisely the non-urgency that makes it important.

He was dismissive of the timeline arms race in a way a room full of quantum vendors did not entirely enjoy. “All those numbers are made up,” he said, when I pointed out the industry consensus has slid from 2035 to 2030 to 2029. Whitfield Diffie added: “We can get experts who’ll tell you it’ll be one year, and experts who’ll tell you it’ll be a hundred. If the hundred-year people are right, all we waste is time and money. If the one-year people are right and we did nothing, we’re in real trouble.”

That is a risk argument, not a forecast, but it’s important for anyone holding data with a long confidentiality life.

Where he and the American Binary diverge on is how much people actually care. Schneier thinks most organizations will be close to passive. “A lot of the cryptography organizations use is thrust upon them,” he said. “For most, it’s going to be buying products that use quantum-safe algorithms, and it’s a transition they won’t even notice.” He points to Signal, already quantum-safe (though not CNSA 2.0 compliant), as the model: one entity controlled every instance and pushed the change. His conclusion is that the hard problems here are organizational, not technical, which makes them harder, not easier.

An Entrust/Ponemon study from early 2026 found that only 40% of US organizations are actively working on PQC transition. Half of organizations say nobody clearly owns the migration. Forty-three percent cannot inventory their own cryptographic assets. The KPMG Cybersecurity Survey puts the number of organizations actively implementing PQC at 27%.

The problem isn’t that CISOs don’t know about the threat. It’s that they have no incentive to act on it. Security budgets are growing at their slowest pace in five years, and only 47% reported an increased budget. PQC migration lands in the “deal with it later” pile because spending millions on a threat that might materialize in five years means less budget for the ransomware that will hit this quarter. Making the call to spend now is career risk without career upside, though some businesses have used this transition as an opportunity to stand out in the market.

The companies actually making moves are the ones that control both ends of the communication and can push the change without waiting for anyone. Though none comply with CNSA 2.0, Signal did it. Apple did it for iMessage. Google did it for Chrome. WhatsApp did it. Cloudflare deployed hybrid post-quantum key exchange across its network. Coinbase stood up a quantum advisory board and told blockchain developers to start planning. These are entities that own their own stack or their own protocol; they didn’t have to convince a procurement committee or justify it to a board. But they aren’t covering everything that you are interacting with, just pieces, and you hope every piece lands in time?

Andrew McElroy, American Binary’s CTO and co-founder, and LaMacchia sell the active path, because it’s what they do. McElroy’s version is blunt: “It doesn’t take a cryptographic inventory to know you need a post-quantum VPN.” LaMacchia’s is a procurement discipline:

If you’re putting out an RFP today, ask your vendors what their PQC transition plan is. Otherwise you’re digging your hole deeper. You’re buying more legacy that you just have to solve later.

Where does the burden fall?

LaMacchia has the best stories because he has done the thing everyone else is theorizing about. He ran the transition off MD5 after it got broken spectacularly at Crypto 2004.

When we started pulling MD5 out of Windows, we found over fifty instances of the MD5 source code within the broader Windows source tree. We actually searched the source for the initialization constants, because those couldn’t change.

So fifty copies of one broken hash, findable only by grepping for the magic numbers; that is what “inventory your cryptography” means inside a real codebase, and it’s why he keeps insisting the job isn’t deploying the new primitive but deprecating the old one. “You can’t just say I got the new stuff out there. I actually have to deprecate the older stuff and pull it out.” Diffie added the complication: even if the copies were functionally equivalent, a developer who pulled a local copy and changed it a little for performance reasons may have introduced a subtly different implementation.

LaMacchia also brought up Flame malware in 2012 is his cautionary tale: it forged a Microsoft signature through a corner of the PKI that still signed with RSA-MD5, years after the transition was declared done. That corner wasn’t under central management; a product team had retained it locally, and it became the entry point.

When NSA published Suite B and told everyone to move to elliptic-curve cryptography within about ten years, LaMacchia saw what happened ten years later: “they had to basically recertify RSA-3072, because some of their own internal products hadn’t been able to make the transition in time.” So, the agency that sets the deadlines missed its own deadline?

He is equally concrete about the systems that will age worst. His answer for critical infrastructure is not to fix the endpoints, because you can’t: “Your solution to making SCADA [Supervisory Control and Data Acquisition] quantum-resistant may be to wrap a VPN between two bumps in the wire, because you don’t control the endpoints and the manufacturer isn’t servicing them anymore. Maybe you only get to change the sensors in the road once every fifteen years.”

And on the smallest form factors, a story from 2018 about federal identity cards: he asked the program whether they’d planned for signatures three to six times larger, they said they didn’t have the space on the card, and his reply was “then we’d better go buy bigger cards.” Post-quantum key sizes are not a software concern that stays in software. This surfaces as physical bills of materials, including memory, storage, card real estate, and packet budgets. McElroy put numbers on that last point: exceed 1,500 bytes of MTU in an IPv6 5G core and the packet is dropped, because the rule is set to not fragment.

Everything above assumes the threat clock will come slowly and we have time.

At the end of March, two papers landed on the same day, and they clearly knew about each other because one cites the other. The neutral-atom resource estimate is Cain et al., the Oratomic-Caltech paper showing Shor’s algorithm runs at cryptographically relevant scale on as few as 10,000 reconfigurable atomic qubits, submitted March 30. The Google work is the ECC whitepaper co-authored with Dan Boneh and Justin Drake, dated March 30.

Google withheld the circuits themselves, allegedly at a government request, and offered a zero-knowledge proof that it possessed them rather than publishing them. But a team took that obfuscated output and threw AI at it, getting a 44% efficiency improvement on the circuit in 14 days. It’s now at 49.2%

LaMacchia said:

It was the knowledge that Google claimed it could do something and prove it that led others to figure out how to do it. Export controls on that don’t work. Attempts to stifle publication aren’t going to work. The information is going to get out there.

I tied this back to the Fable ban on stage, because we had just lived through the same pattern: the government tried to contain a capability by restricting access, and the knowledge that the capability existed was itself the catalyst. GPT-5.6 launched anyway. Technology will always move forward in some way, and regulatory containment has a poor track record, as LaMacchia himself pointed out by recalling the failed attempts to block cryptographic software exports twenty years ago.

The boring conclusion is “post-quantum is real, buy the vendors.” But the specification these vendors sell against is a moving, politically forked target, and it’s a really hard problem, no matter what some Bitcoin core devs think.

A pure-PQC product tuned to CNSA 2.0 is selling a spec that BSI and ANSSI reject, and a hybrid product is carrying the complexity Schneier and Diffie both named as significantly risky. The pragmatic thing to do is figure out which standards apply to your use case. If you are worried about nation-states harvesting your data, CNSA 2.0 is the US’s answer. If you aren’t, then other standards may be sufficient.

The buyers with real urgency are the ones LaMacchia keeps describing: operators of endpoints they don’t control and can’t service on any normal cycle, and holders of data with a confidentiality life measured in decades. For everyone else, Schneier’s passive path is probably right and it might lead to legacy companies being replaced by startups, since it might just be so much easier to start from scratch.