Data Encryption Methods

✏️CEPS (Centre for European Policy Studies) has just published the report "Strengthening the EU transition to a quantum-safe world" This 125-page publication offers a comprehensive and very timely analysis of the global transition toward quantum-safety, highlighting key recommendations and identifying the hurdles that we, as a community, still need to overcome. Accross its 10 general recommendations and 16 additional sector-specific ones, two key aspects take a prominent role: 👉 Operational challenges of the transition, like establishing business-level priorities, building executive support, addressing the limited cryptographic talent issue, cryptographic homogeneization in products, and building cryptographic inventories based on priorities. 👉 Coordination and the role for regulators, identifying that the EU lacks a coherent, unified transition framework, the need to ensure alignment and coherence across roadmaps and the risks of a fragmented transition. Key conclusions on the later, aligned with previous statements from the Europol Quantum Safe Financial Forum and FS-ISAC, is that quantum-safety is already part of the EU's operational resilience compliance through the “state of the art” security principle embedded in GDPR, DORA, CRA and NIS2. However, there is a recognised need for further guidance that can be achieved through open collaboration between the public and private sector. Although the report focuses on the financial, public, and defence sectors, its main takeaways can easily be extended to other critical domains—transport, energy, healthcare, and many more. The principles are the same, and the urgency is the same. This report is an important step forward, and my hope is that the ideas it lays out help shape the conversations and, more importantly, the actions we need across the EU. A well-aligned and coordinated transition is essential if we want the whole ecosystem to move toward a new age where we manage cryptography in a more mature, proactive, and resilient way. Kudos to CEPS, lorenzo pupillo, Carolina Polito, Swann A. and Afonso Ferreira, PhD for achieving this milestone. https://lnkd.in/dpWJ86q2

🚨Quantum computing is no longer a theoretical debate for blockchain. It is becoming a strategic infrastructure risk. After reading the latest Coinbase Independent Advisory Board report on Quantum Computing & Blockchain, I believe there are 3 critical points every executive in digital assets, banking and blockchain infrastructure should understand: 1️⃣ The real quantum threat is NOT today… but waiting is dangerous One of the strongest conclusions of the report is surprisingly balanced: 👉 the cryptographic collapse is not imminent 👉 but preparing late would be a massive mistake Breaking current blockchain cryptography requires a fault-tolerant quantum computer (FTQC), something enormously more complex than today’s machines. But here is the critical insight: Migration to post-quantum security may take a decade or more across: • blockchains, wallets • exchanges, custodians • validators, institutions NIST is already recommending PQ migration strategies before 2035. This means the strategic problem is no longer “if”. It becomes: “How do we migrate global blockchain infrastructure without breaking scalability, performance and trust?” 2️⃣ The biggest blockchain challenge is NOT encryption. It is consensus. Most people think the problem is simply replacing wallets signatures. The report explains the real issue is much deeper. Modern blockchains depend heavily on: • BLS aggregation • threshold signatures • validator synchronization • consensus-level cryptography And today… There is NO clean post-quantum replacement for many of these systems. This is critical because: • Ethereum • Sui • Aptos • many PoS chains depend on aggregation mechanisms that quantum-safe cryptography still struggles to replicate efficiently. Meaning: Post-quantum migration may require redesigning parts of blockchain consensus itself. Not just changing wallets. 3️⃣ Quantum simulation may become the hidden accelerator of the threat This is probably the most important strategic takeaway in the entire paper. The report explains that the main commercial driver for quantum computing is NOT breaking crypto. It is: financial, liquidity and reserve business Why does this matter? Because if quantum simulation becomes economically valuable, investment and hardware progress could accelerate dramatically. And cryptographic capabilities would emerge as a byproduct. In other words: The future quantum risk to blockchain may not come from “hackers”. It may come from successful industrial adoption of quantum computing itself. My conclusion? The blockchain industry needs to stop treating post-quantum security as a theoretical research topic. This is becoming: • a governance problem • an infrastructure problem • a migration problem • a consensus architecture problem And the organizations that begin preparing now will likely become the trusted infrastructure providers of the next era of digital finance. Alfredo Joaquim John David

Europe is finally asking the right question — but it’s still early in the game. The €180M sovereign cloud initiative is not the destination. It’s table stakes. Digital sovereignty is not a hosting problem. It’s a control problem. And control does not live in infrastructure — it lives in the layer above it. The real battleground is the trust and control layer: Who owns identity? -Who governs authentication and authorization? -Who controls cryptographic keys? -Who enforces policy across systems? -Who guarantees provenance, traceability, and continuity? That layer defines whether sovereignty is declared… or actually executed. This is where Europe has a unique strategic opportunity. Because European Business Wallets, Digital Product Passports, and Trusted AI are not just digital tools — they are control primitives for a new economic architecture. They enable: → Programmable trust → Verifiable ecosystems → Cross-border interoperability with embedded compliance In other words: they operationalize sovereignty at scale. But there is a non-negotiable constraint most strategies are still underestimating: If it’s not quantum-resilient, it’s not sovereign. Any identity or trust system built today on vulnerable cryptography has a built-in expiration date. So the mandate is clear: 👉 Move from sovereign infrastructure to sovereign control 👉 Design from day one for a post-quantum world 👉 Treat identity and trust as core strategic infrastructure, not as features Because the future won’t be defined by who owns the cloud. It will be defined by who controls the logic of trust across the entire digital stack.

Cardano Veridion KERI and the Quantum Future of Trust We often talk about AI ethics, explainability, and data provenance, but how do we ensure trust itself survives the quantum revolution? When quantum computing matures, most of today’s cryptography (RSA, ECDSA, Ed25519) will become vulnerable. Every digital signature, API call, and blockchain proof we rely on could be broken in seconds. That’s why I’ve been exploring how Cardano’s Veridian implementation of KERI (Key Event Receipt Infrastructure) is quietly building quantum-resilient trust and why this matters for the next generation of semantic and AI platforms. Here’s what makes it different 👇 🔁 Continuous Key Rotation - KERI never relies on static keys. It evolves cryptographically, allowing seamless migration to post-quantum algorithms. ⚙️ Crypto-Agnostic Design - PQC schemes like CRYSTALS-Dilithium or Falcon can be slotted in without breaking existing trust chains. 🌐 Ledger-Optional Verification - KERI keeps verifiable proofs off-chain, avoiding a single ledger filled with vulnerable signatures. 🧠 Decentralised Provenance - Every semantic transaction or AI event can be independently verified, even across organisations. 🔒 Future-Proof Trust Layer - Perfect for platforms like Semantics-as-a-Service, where every metadata link, ontology update, or AI answer must be verifiably authentic. In short, KERI is preparing digital trust for the post-quantum world and Cardano is one of the few ecosystems designing for that future today. As we move toward trusted AI and semantic interoperability, this kind of cryptographic agility isn’t a luxury - it’s a necessity. Would love to hear your thoughts: ➡️ How are you preparing your data and AI infrastructure for the quantum era? ➡️ Do you think decentralised identity will be key to preserving trust? #AI #Semantics #Cardano #Veridion #KERI #QuantumComputing #TrustedAI #DataGovernance #KnowledgeGraphs Cardano Foundation

🚨 NEW PEER-REVIEWED RESEARCH: PQC Migration Timelines Excited to share my latest paper published in MDPI Computers: "Enterprise Migration to Post-Quantum Cryptography: Timeline Analysis and Strategic Frameworks." The transition to Post-Quantum Cryptography (PQC) represents a watershed moment in the history of our digital civilization. Organizations planning for a 3-5 year "upgrade" will fail. The reality is a 10-15-year systemic transformation. Key Contributions: 📊 Realistic Timeline Estimates by Enterprise Size: Small (≤500 employees): 5-7 years Medium (500-5K): 8-12 years Large (>5K): 12-15+ years ⚠️ Critical Finding: With FTQC expected 2028-2033, large enterprises face a 3-5 year vulnerability window—migration may not complete before quantum computers break RSA/ECC. 🔬 Novel Framework Analysis: Causal dependency mapping (HSM certification, partner coordination as critical paths) "Zombie algorithm" maintenance overhead quantified (20-40%) Zero Trust Architecture implications for PQC 💡 Practical Guidance: Crypto-agility frameworks and phased migration strategies for immediate action. Strategic Recommendations for Leadership: 1. Prioritize by Data Value, Not System Criticality: Invert the traditional triage model. Systems protecting long-lived data (IP, PII, Secrets) must migrate first, regardless of their operational uptime criticality, to mitigate SNDL. 2. Fund the "Invisible" Infrastructure: Budget immediately for the expansion of PKI repositories, bandwidth upgrades, and HSM replacements. These are long-lead items that cannot be rushed. 3. Establish a Crypto-Competency Center: Do not rely solely on generalist security staff. Invest in specialized training or retain dedicated PQC counsel to navigate the mathematical and implementation nuances. The talent shortage will only worsen. 4. Demand Vendor Roadmaps: Contractual language must shift. Procurement should require vendors to provide binding roadmaps for PQC support. "We are working on it" is no longer an acceptable answer for critical supply chain partners. 5. Embrace Hybridity: Accept that the future is hybrid. Design architectures that can support dual-stack cryptography indefinitely, viewing it not as a temporary bridge but as a long-term operational state. 6. Implement Automated Discovery: You cannot migrate what you cannot see. Deploy automated cryptographic discovery tools to continuously map the cryptographic posture of the estate, identifying shadow IT and legacy instances that manual surveys miss. The quantum clock is ticking. Start planning NOW. https://lnkd.in/eHZBD-5Y 📄 DOI: https://lnkd.in/ejA9YpsG #PostQuantumCryptography #Cybersecurity #QuantumComputing #PQC #InfoSec #NIST #CryptoAgility

📌The financial sector has now moved from quantum awareness to quantum execution. Europol , FS-ISAC , and the Quantum Safe Financial Forum (QSFF), together with major financial institutions, published: “Prioritising Post-Quantum Cryptography Migration Activities in Financial Services” ; a practical migration framework designed specifically for financial institutions. What makes this report particularly relevant for #boards, #regulators, and #CISOs? It introduces a structured prioritisation methodology based on two measurable dimensions: 1️⃣ Quantum Risk Score Derived from: • Shelf life of protected data • Exposure • Severity of compromise 2️⃣ Migration Time Score Derived from: • Solution availability • Execution cost and time • External dependencies Migration Priority is determined by combining both scores into a risk–time matrix (see pages 8–10) of the Report below ⬇️ . ♨️ This shifts the conversation from “When will Q-Day happen?” to “Which business use cases require action now, and which require long-term orchestration?” Two examples in the report illustrate this distinction: 🔹 Points of Sale (#PoS) Medium quantum risk but high migration complexity due to hardware lifecycles, ecosystem coordination, and standardisation uncertainty (pages 12–15) . ⛔️Early planning is essential to avoid costly out-of-cycle replacements. 🔹 Public Websites (#TLS_confidentiality) Medium quantum risk but low migration time due to hybrid schemes such as X25519MLKEM768 already supported by major browsers and CDNs (pages 16–19) . ⛔️This is one of the earliest practical deployment opportunities for quantum-safe protection in production environments. Another important contribution of the report is its focus on cryptographic antipatterns (pages 21–24) . Before large-scale PQC migration, institutions can implement no-regret actions: • Automate TLS certificate lifecycle management • Standardise TLS configurations (TLS 1.3 baseline) • Eliminate legacy cipher dependencies • Remove hard-coded credentials • Strengthen key management governance This approach aligns closely with supervisory expectations: #quantum_readiness must integrate into existing risk frameworks, asset lifecycle planning, and vendor coordination. For financial institutions, the message is clear: ❌Quantum safety is not a single migration event. ❌It is a prioritised, staged governance programme that integrates cryptography, procurement, architecture, and regulatory alignment. Full publication: Europol (2026), Prioritising Post-Quantum Cryptography Migration Activities in Financial Services Available via Europol Publications Office: https://lnkd.in/d2bgsVKm #PostQuantumCryptography #PQC #QuantumRisk #FinancialServices #CybersecurityGovernance #DigitalResilience #CryptoAgility #QuantumTransition #FinancialStability

𝗪𝗵𝘆 𝗧𝗿𝗮𝗻𝘀𝗽𝗼𝗿𝘁 𝗘𝗻𝗰𝗿𝘆𝗽𝘁𝗶𝗼𝗻 𝗔𝗹𝗼𝗻𝗲 𝗜𝘀 𝗡𝗼 𝗟𝗼𝗻𝗴𝗲𝗿 𝗘𝗻𝗼𝘂𝗴𝗵 𝗳𝗼𝗿 𝗠𝗙𝗧 For years, Managed File Transfer security has been judged at the edges: Is the connection encrypted? Are files encrypted in transit? That view is no longer sufficient. Most MFT platforms rely on transport (TLS/SFTP) and payload (PGP) encryption to protect data entering and leaving the system, but this only covers part of the data lifecycle. Once files are inside the platform, they are parsed, queued, logged, stored, and routed across internal components. In many legacy MFT architectures, those internal paths rely on implicit trust and classical cryptographic assumptions that were never designed for long-term resilience. 𝗧𝗵𝗮𝘁’𝘀 𝘄𝗵𝗲𝗿𝗲 𝗿𝗶𝘀𝗸 𝗮𝗰𝗰𝘂𝗺𝘂𝗹𝗮𝘁𝗲𝘀. Even with strong edge encryption, many MFT systems:  • Trust internal components by default  • Encrypt data only at ingress and egress  • Rely on classical cryptography internally  • Lack crypto agility and granular enforcement This becomes a real governance issue and not a theoretical one. 𝗣𝗼𝘀𝘁-𝗤𝘂𝗮𝗻𝘁𝘂𝗺 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗥𝗲𝗾𝘂𝗶𝗿𝗲𝘀 𝗠𝗼𝗿𝗲 𝗧𝗵𝗮𝗻 𝗮 𝗖𝗶𝗽𝗵𝗲𝗿 𝗦𝘄𝗮𝗽 Post-quantum cryptography (PQC) isn’t just a future TLS upgrade. It exposes whether a platform was designed for end-to-end protection. 𝗔 𝗽𝗼𝘀𝘁-𝗾𝘂𝗮𝗻𝘁𝘂𝗺 𝗿𝗲𝗮𝗱𝘆 𝗠𝗙𝗧 𝗺𝘂𝘀𝘁 𝗮𝗽𝗽𝗹𝘆 𝘀𝘁𝗿𝗼𝗻𝗴 𝗰𝗿𝘆𝗽𝘁𝗼𝗴𝗿𝗮𝗽𝗵𝘆 𝗰𝗼𝗻𝘀𝗶𝘀𝘁𝗲𝗻𝘁𝗹𝘆:  • To data in transit  • To data at rest  • To internal service-to-service communication Anything less leaves gaps that time will eventually exploit. 𝗭𝗲𝗿𝗼 𝗧𝗿𝘂𝘀𝘁 𝗠𝘂𝘀𝘁 𝗘𝘅𝗶𝘀𝘁 𝗜𝗻𝘀𝗶𝗱𝗲 𝘁𝗵𝗲 𝗣𝗹𝗮𝘁𝗳𝗼𝗿𝗺 PQC alone isn’t enough. A modern MFT platform must also enforce zero trust internally, not just at the perimeter. That means no implicit trust, explicit authentication everywhere, encrypted internal communication, flow-level policy enforcement, and full auditability. For CISOs, this is the difference between assuming security and being able to prove it. 𝗧𝗵𝗶𝘀 𝗶𝘀 𝗲𝘅𝗮𝗰𝘁𝗹𝘆 𝘄𝗵𝘆 𝘄𝗲 𝗿𝗲𝗱𝗲𝘀𝗶𝗴𝗻𝗲𝗱 𝗧𝗗𝗫𝗰𝗵𝗮𝗻𝗴𝗲 𝘃𝟱. TDXchange v5 was architected to move beyond edge-only security by:  • Supporting TLS, PGP or NIST-approved post-quantum cryptographic (PQC) encryption  • Encrypting data in transit and at rest, including internal datastores  • Enforcing zero-trust principles between internal components  • Eliminating implicit trust assumptions inside the platform The goal wasn’t another feature, it was an architecture that can defend sensitive data throughout its entire lifecycle, even as cryptographic threats evolve. 𝗘𝘅𝗲𝗰𝘂𝘁𝗶𝘃𝗲 𝗧𝗮𝗸𝗲𝗮𝘄𝗮𝘆 Transport and payload encryption are table stakes. In the post-quantum era, they are no longer enough on their own. Does your MFT protect data everywhere, or only at the edge? That distinction will increasingly determine which platforms remain defensible as post-quantum risk becomes operational reality.

EY’s perspective on securing against #quantum #risks emphasizes that quantum #computing is rapidly evolving from a theoretical concern into a material cybersecurity threat that requires immediate strategic action. The core issue lies in the vulnerability of widely used cryptographic algorithms, such as RSA and elliptic curve cryptography, which could be broken by sufficiently advanced quantum computers. This creates a systemic risk to sensitive data, including financial information, intellectual property, and personal records. A central concept highlighted is the “harvest now, decrypt later” threat model, in which adversaries collect encrypted data today with the intention of decrypting it in the future as quantum capabilities mature. This makes quantum risk a present-day problem, particularly for data requiring long-term confidentiality. EY stresses that organizations must adopt a proactive and structured approach to quantum readiness. A foundational step is to conduct a comprehensive cryptographic inventory, identify sensitive #data, and map existing #encryption methods. This enables organizations to assess which systems are most exposed and prioritize remediation efforts. Transitioning to post-quantum cryptography (PQC) is a complex, multi-year transformation that requires careful planning, integration into existing #technology roadmaps, and alignment with emerging standards. Organizations are encouraged to build crypto-agility, allowing them to adapt encryption methods as technologies and standards evolve. EY also highlights the importance of #governance, #compliance, and #workforce readiness. Quantum resilience requires enterprise-wide coordination, including policy development, regulatory alignment, continuous monitoring, and personnel training. EY frames quantum cybersecurity not just as a technical upgrade but as a strategic #transformation initiative. Organizations that act early can strengthen resilience, improve cyber maturity, and gain a competitive advantage, while those that delay risk long-term exposure to data breaches, regulatory challenges, and erosion of #digital #trust.

𝗗𝗮𝘆 𝟴: 𝗗𝗮𝘁𝗮 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗮𝗻𝗱 𝗣𝗼𝘀𝘁 𝗤𝘂𝗮𝗻𝘁𝘂𝗺 𝗥𝗲𝗮𝗱𝗶𝗻𝗲𝘀𝘀 In today’s hyper-connected world, data is the new currency and the perimeter, and it is essential to safeguard them from Cyber criminals. The average cost of a data breach reached an all-time high of $4.88 million in 2024, a 10% increase from 2023. Advances in 𝗾𝘂𝗮𝗻𝘁𝘂𝗺 𝗰𝗼𝗺𝗽𝘂𝘁𝗶𝗻𝗴 further threaten traditional cryptographic systems by potentially rendering widely used algorithms like public key cryptography insecure. Even before large-scale quantum computers become practical, adversaries can harvest encrypted data today and store it for future decryption. Sensitive data encrypted with traditional algorithms may be vulnerable to retrospective attacks once quantum computers are available. As quantum technology evolves, the need for stronger data protection grows. Google Quantum AI recently demonstrated advancements with its Willow processors, which 𝗲𝗻𝗵𝗮𝗻𝗰𝗲𝘀 𝗲𝗿𝗿𝗼𝗿 𝗰𝗼𝗿𝗿𝗲𝗰𝘁𝗶𝗼𝗻 𝘂𝘀𝗶𝗻𝗴 𝘁𝗵𝗲 𝘀𝘂𝗿𝗳𝗮𝗰𝗲 𝗰𝗼𝗱𝗲. These breakthroughs underscore the growing efficiency and scalability of quantum computers. To address these threats, Enterprises are turning to 𝗮𝗴𝗶𝗹𝗲 𝗰𝗿𝘆𝗽𝘁𝗼𝗴𝗿𝗮𝗽𝗵𝘆 to prepare for Post Quantum era. Proactive Measures for Agile Cryptography and Quantum Resistance: 1. 𝗔𝗱𝗼𝗽𝘁 𝗣𝗼𝘀𝘁-𝗤𝘂𝗮𝗻𝘁𝘂𝗺 𝗔𝗹𝗴𝗼𝗿𝗶𝘁𝗵𝗺𝘀 Transition to NIST-approved PQC standards like CRYSTALS-Kyber, CRYSTALS-Dilithium, Sphincs+. Use hybrid cryptography that combines classical and quantum-resistant methods for a smoother transition. 2. 𝗗𝗲𝘀𝗶𝗴𝗻 𝗳𝗼𝗿 𝗔𝗴𝗶𝗹𝗶𝘁𝘆 Avoid hardcoding cryptographic algorithms. Implement abstraction layers and modular cryptographic libraries to enable easy updates, algorithm swaps, and seamless key rotation. 3. 𝗔𝘂𝘁𝗼𝗺𝗮𝘁𝗲 𝗞𝗲𝘆 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 Use Hardware Security Modules (HSMs) and Key Management Systems (KMS) to automate secure key lifecycle management, including zero-downtime rotation. 4. 𝗣𝗿𝗼𝘁𝗲𝗰𝘁 𝗗𝗮𝘁𝗮 𝗘𝘃𝗲𝗿𝘆𝘄𝗵𝗲𝗿𝗲 Encrypt data at rest, in transit, and in use with quantum resistant standards and protocols. For unstructured data, use format-preserving encryption and deploy data-loss prevention (DLP) tools to detect and secure unprotected files. Replace sensitive information with unique tokens that have no exploitable value outside a secure tokenization system. 5. 𝗣𝗹𝗮𝗻 𝗔𝗵𝗲𝗮𝗱 Develop a quantum-readiness strategy, audit systems, prioritize sensitive data, and train teams on agile cryptography and PQC best practices. Agile cryptography and advanced data devaluation techniques are essential for protecting sensitive data as cyber threats evolve. Planning ahead for the post-quantum era can reduce migration costs to PQC algorithms and strengthen cryptographic resilience. Embrace agile cryptography. Devalue sensitive data. Secure your future. #VISA #PaymentSecurity #Cybersecurity #12DaysofCyberSecurityChristmas #PostQuantumCrypto

🔐Europol PRIORITISING POST-QUANTUM CRYPTOGRAPHY MIGRATION ACTIVITIES IN FINANCIAL SERVICES ⚛️As post-quantum cryptography (PQC) becomes integrated into mainstream information technology (IT) products and services, financial services institutions must begin to execute their transition strategies. This document provides actionable guidelines to incorporate quantum safety into existing risk management frameworks by assessing the ‘Migration Priority’ based on the ‘Quantum Risk’ and ‘Migration Time’ of business use cases and highlighting opportunities for immediate execution. ⚛️A critical first step is to inventory all business use cases that rely on public key cryptography. This inventory enables the creation of a prioritised transition roadmap by assessing the Quantum Risk of each use case based on three parameters: 🟣 Shelf Life of Protected Data: How long the data remains sensitive. 🟣 Exposure: The extent to which data is accessible to potential attackers. 🟣 Severity: The business impact of a potential compromise. ⚛️When the Quantum Risk is assessed, organisations can prioritise actions based on each use case’s Migration Time, i.e., the complexity and timeline required to achieve Quantum Safety for a use case. As part of this activity, organisations will identify, for instance, actions that can be launched immediately and the use cases that require coordination with long-term asset lifecycles. 🟣 Solution Availability: Maturity of PQC standards, and their general availability in products and services. 🟣Execution Cost: The effort, cost, and complexity of implementing the quantum-safe solutions within the organisation. 🟣 External Dependencies: Execution complexity due to coordination required with third parties and their transition roadmaps (standardisation bodies, vendors, peers, regulators, and customers). ⚛️Examples of use cases that financial organisations can begin implementing today include: 🟣 Integration of post-quantum requirements into the long-term roadmap for hardware-intensive use cases aligned with financial asset lifecycles. 🟣 Enhancement of confidentiality protection for transactional websites. 🟣Identification and elimination of cryptographic antipatterns to reduce future technical debt. ⚛️These are examples of how financial institutions can take timely, structured steps toward an efficient and forward-looking transition to post-quantum cryptography. https://lnkd.in/d4qiS6X9