Everything you encrypt today
is protected by maths
that is hard right now.
Right now is the phrase
that matters.
An attacker does not have to break
your traffic this year.
They only have to keep it.
Storage is cheap.
Captured traffic is patient.
And there is a long-running effort,
backed by very large budgets,
to build machines
that would make some of today's
key exchange and signatures
easy to undo.
Nobody can honestly tell you
the year that arrives.
Maybe never.
Maybe well after
you have changed jobs twice.
That uncertainty
is not a reason to relax.
It is the whole calculation.
Ask how long
each thing you protect
needs to stay secret.
A session token matters for an hour.
A medical record matters
for the rest of a life.
A contract, a source tree,
a list of who talked to whom,
the negotiating position
in a deal that closes
three years from now.
If the secret has to last
longer than the maths might,
then it is already exposed
to whoever recorded it,
and nothing you do later
reaches back into their archive.
The replacement algorithms exist.
The first standards
were published in 2024,
and the large browsers and providers
have been quietly mixing them
into ordinary connections since.
The hard part is not the new algorithm.
It is finding every place
the old one is written down.
The library pinned
four major versions back.
The device in a warehouse
that can only speak
what it shipped with.
The certificate format
a partner insists on.
The algorithm name
typed as a string
into a config file
in forty repositories.
That inventory
is dull work,
and it is the actual work.
So start with two lists.
What must still be secret in ten years.
Where your cryptography
is chosen,
by whom,
and how hard it is to change.
Aim for the day
when switching an algorithm
is a configuration change
and a test run,
not a programme of work
with a budget and a steering group.
The code you write this year
will still be running
when this matters.
Build it so that changing the lock
does not mean
rebuilding the door.
– Serguey Asael Shinder
Top comments (0)