Post-quantum cryptography is moving from a future concern to something developers need to start preparing for now. Recent research has found that 87% of organizations are planning, testing, or implementing post-quantum cryptography, but only 7% have deployed it across most of their digital certificates.
SecureFlag’s Post-Quantum Cryptography course gives developers hands-on experience working with quantum-resistant cryptography, combining post-quantum and classical algorithms, and understanding the security challenges that come with it.
What Is Post-Quantum Cryptography?
Most of today’s encryption, including RSA and elliptic-curve cryptography, relies on math problems that are extremely hard for classical computers to solve. However, a powerful enough quantum computer could solve those same problems quickly, making today’s encryption vulnerable.
That kind of quantum computer doesn’t exist yet, but encrypted data being stolen and stored today could still be decrypted later, once one does. This is often called “harvest now, decrypt later,” and it’s why organizations with long-lived sensitive data, such as financial records or health information, are under pressure to act now rather than wait.
The good news is that organizations don’t have to wait for quantum computers to arrive before planning for the change. Post-quantum cryptography (PQC) uses algorithms designed to protect against attacks from both classical and quantum computers. In 2024, NIST finalized its first PQC standards, including ML-KEM for key exchange and ML-DSA for digital signatures, giving organizations a clear set of algorithms to start using.
Preparing Applications for Post-Quantum Cryptography
Access to new cryptographic algorithms is only part of the challenge, since how they are used can introduce security weaknesses that attackers may exploit.
SecureFlag’s Post-Quantum Cryptography course gives developers hands-on experience working through these challenges, and is designed for those with a basic knowledge of cryptographic protocols. It’s currently available in Go, with Python, Java, .NET, and Node.js versions coming soon.
The labs cover topics such as:
-
Using the ML-DSA algorithm for post-quantum digital signatures.
-
Combining classical and post-quantum approaches for key exchange.
-
Generating encryption keys securely.
-
Protecting against attacks that can weaken cryptographic protections.
-
Making applications easier to update as cryptographic algorithms change.
Working With Hybrid Cryptography
Applications won’t necessarily be able to switch from classical to post-quantum cryptography overnight, and existing systems and protocols may need to support both approaches for a while.
The course explores hybrid post-quantum key exchange, combining X25519 with ML-KEM. Developers can see how classical and post-quantum algorithms can work together, and how the resulting shared secrets can be safely turned into encryption keys.
It also looks at what can happen when the shared secrets produced by a hybrid exchange aren’t handled correctly before they’re used by the application.
Preventing Post-Quantum Downgrades
Supporting quantum-resistant cryptography does not help much if an attacker can force the application to fall back to weaker algorithms.
When there’s a downgrade attack, an attacker finds a way to make an application choose a weaker cryptographic option. In a post-quantum context, that could mean forcing it to use classical cryptography instead of the quantum-resistant option it was designed to support.
Developers also work through a scenario involving post-quantum downgrade attacks in recipient key exchange, identifying and fixing the conditions that could allow this to happen.
Preparing for Future Cryptographic Changes
The cryptography an application uses today may not be suitable for the future because algorithms can become outdated or new weaknesses can emerge. Applications that are difficult to update can make those changes much harder to manage.
The course also explores crypto-agility, showing how developers can prepare applications for future cryptographic changes while making sure attackers cannot force the application to use weaker cryptography.
Building Post-Quantum Skills with SecureFlag
SecureFlag helps organizations build safer software through realistic, hands-on labs rather than theory or multiple-choice questions. With over 70 programming languages covered across the platform, developers can build practical security skills in the technologies they already use.
The Post-Quantum Cryptography course gives developers a practical way to explore these concepts and prepare for the changes ahead.
