Building a browser-based sandbox for quantum-safe migration

Speaker A: It's not just about changing an algorithm, um, a by B, but it's really about setting up cryptographic governance in place and put you in a place where you can adapt to any kind of threat.

Speaker B: Welcome to Shielded, the Last Line of Cyber Defense by PQ Shield, the podcast where we are moving the conversation around post Quantum Cryptography. From the why to the how. I'm Joe Linson, your host and I'm here to guide you through the challenges, innovations and solutions that will help your organization stay secure in the quantum era. Let's future proof your defenses together. Welcome to Shielded, the Last Line of Cyber Defense. I'm your host Joe Linson and today we're joined by Eric Amador, Product manager at Thales and the creator of pqctoday.com an open initiative focused on helping organizations navigate the complexity of quantum safe migration. Eric brings a unique perspective shaped by hands on product experience and exposure to multiple industries, with a strong focus on making applied cryptography more understandable and actionable across organizations. Eric, welcome to shieldit.

Speaker A: Thank you very much Joe for having me today.

Speaker B: Absolutely. So Eric, I feel like you've had an interesting journey that led you to even come up with the idea and the concept of pqctoday.com so I'm curious how this sort of evolved from an idea to really support your personal effort in educating yourself on quantum safe migration and then realizing that that might be a topic that could potentially be interesting for many others as well.

Speaker A: Well Joe, I mean just as an introduction is I uh, now have two jobs. So my day job I'm working for Thales as product manager. In that role I get to work with customer that working in all the industries all region and have a different world. So I um, can talk to executive, but I can also talk to very technical people and in that role have many questions around, I mean today cryptography and how it's going to be impacted with quantum threat and swear to the question, help our customer understand what's going to happen. That's what. And the second thing is, so I was trying a way to help those customers, uh, get access to the information they need, right to adapt to this new threat. And at the same time my two best friends have been working in the AI for the last three years and they were doing great things with this new technology. So at this point I'd say, hey, what if I'm using this new technology AI and to build a platform that would help all these users understand better this quantum threat and give them easy access to all the resources they need to prepare their transformation journey and be ready to protect themselves against this new threat. So this is really how it started. They say we have this huge problem and we have this fantastic technology. There are a way to combine both together to solve that problem. At least part of the problem.

Speaker B: Nice. So yeah, it sounds like working two jobs that is of course great the fact that you only have 24 hours in your day and I'm sure this is keeping you nice and busy. So maybe you can tell us a little bit about the starting point with uh vgctoday.com and how you've evolved over the past several months to a year. I think is already that this project has been going on.

Speaker A: Yeah, now it's more than six months. Yeah, not quite a year, but it's going there. And actually it started very small. I mean the two main feature I would say was about sharing the um, timeline because I mean this PQC migration is different for different countries. You have Australia for example that uh, suggests that you should be finish your migration by 2030. Most of the country say you have to finish by 2035 but be well when advancing 2030. And because I uh, have this global visibility I wanted to reorganize all of that and give uh, easy access to all those timelines. And the second part I wanted to let user try this new algorithm and understand okay, I mean what's the impact of using this new post quantum crypto algorithm without having any friction. So did came to embed the cryptographic library inside the browser. It's a new technology, it's called webassembly. It allows to deploy um, any kind of application into a browser and customer just open the page and can try it. So in a second someone open the page and can generate a MLChem key, MLDSA key, do a uh, signature, uh encapsulate operation and no friction at all. So that was really the core of the feature and then it evolved over time. So I say why not looking at different use case like I mean the world is changing right. Very rapidly. And as you can see the banks are going through this transformation. They're going from M traditional finance to decentralized finance with assets Bitcoin. And it's interesting because this transformation happened at the same time that the quantum threat happened.

Speaker B: Those two sort of overlap.

Speaker A: Yeah. And it's scary at the same time because you see all these banks that start now to transfer all this money through this decentralized platform that based on blockchain and at the same time you see Google announcing hey, by the way, the elliptic curve, um, uh, are broken. It might be broken sooner than expected. And so what's going to happen with all this uh, transformation. So I started, oh, I'm going to show, okay. Exactly how this blockchain protocol works in the browser as well. And what's the impact of this quantum. And so that the next step, I did all this protocol 5G as well. I mean everybody has a cell phone today. Cell phone 5G has this challenge as well. So um, I started to add up to the use case.

Speaker B: So on the educational side you really focus on, you said it right. The different global initiatives, the different global timelines that are there that have some overlap because most of the countries are following the NIST standards with some deviations a little bit. But for the most part 2030 for critical national infrastructure and 203335 for everything else seems to be sort of what everyone agrees on. And then of course when we're talking about regional differences in the timelines, then we also need to look at the proliferation of the standards and how they evolve. And I know there's a section on your website as well that helps understand how all that links together. So I'm curious to hear your take on that as well. How different bodies like ietf, ISO and other standards bodies handle this question and how this information eventually ends up on your website and gets provided to the users, the visitors.

Speaker A: In fact, I mean, yeah, I want to thank all this group because they uh, are doing a uh, fantastic job. So in this transformation journey, I mean all these standardization body that are supported uh, by a volunteer, I mean maybe people don't know IETF that it's a group of volunteers that spend their free time to update the Internet standard, all the protocol standard to become quantum safe. And so the way I'm using their contribution is that I'm trying to facilitate access to their works. So for example, recently I built that page where you see all the protocol and the latest standard document. And so it gives you access, direct access to the level of maturity for every protocol of um, the signature of the cam, whether there are already standardized for pqc. But also the way I'm doing it, I'm using not just sharing their documentation but also providing a hands on experience. So with simulation embedded into the browser, same no installation setup, you can try TLS 1.3 with MLDSA and that kind of thing. So I'm using it to help access to the information, find the information. Obviously I direct the user is going to fetch document from the official website. But what I'm doing is that I'm using AI technology to read the document, to extract the key information about the document so everybody can as a summary and have access to all the key information directly and then open the source document. So that's what I'm doing.

Speaker B: Yeah. So in an educational viewpoint you not only provide the information but you also allow to test with specific use cases in my. So that's quite powerful. Of course it's one thing to read about those protocols and standards as they mature, but then being able to get the hands on experience and understanding how a certain algorithm behaves in their own environment, that's great, that's very helpful. I would assume so. Of course a lot of talk is around collaboration and I think you've already touched on that aspect a lot. Right. There's a lot of collaboration happening in those global working groups. Do you see any gaps as well? Do you feel like there needs to be even more collaboration to sort of bring us closer to that ideal state of being quantum safe and more resilient?

Speaker A: I mean to be fair I'm still very impressed on how the global community work together to solve that problem. I mean it started with I was lucky to be part of this NCCOE workgroup led by nist. They are fantastic people in NIST that uh, allowed to be basically to have everybody sit down together on the same platform and validate all the um, transformation and I mean I'm working with my DI competitor and we are helping each other to validate interoperability to test all this new algorithm and everybody's helping at this level and so that's fantastic. I was at CMC 2026 uh, a couple of weeks ago and same, I mean everybody was in the same room and helping each other to better understand the challenge and find solution. And I mean everybody is sharing his work. I mean the quality of uh, documentation and source code as well, I mean open source is simply incredible. I mean so I don't know if you can do better to be honest because I mean it's already very impressive the work that's happening and how is

Speaker B: it shared and of course with your platform you're also tapping into the open source community.

Speaker A: Yes, exactly. I mean and um, that platform would not be possible. I mean the building block of this platform are basically open source and I mean open source that two kind of open source open source for the cryptography itself. So in the cryptography it's incredible you can find um, crypto library written in all language rust C, Python and others and they are all available and also all the protocol I mentioned, IATF work, but you have all the um, free implementation of VPN protocol, ssh, PLS and all the protocol. And so it's a fantastic resources. So if you want to offer some, test those protocol and offer simulation, I mean I'm basically using this part and to build the site itself, I mean all the plumbing, I mean the technology, I would say the software bricks, it's also coming from the open source community and what AI can do is basically you have all the bricks and uh, AI is a fantastic technology to take those bricks and build a platform. So I mean AI is a fantastic tool to put things together, but it's not really good at creating new bricks. So the work that all these open source people are doing is it's necessary because you need to have the building block, right to build the building and AI is just good at making building out of those bricks. So without the work of these people that produce this open source, produce this standard, produce this great documentation, I mean it will not be possible.

Speaker B: So with all that information being freely available to any visitor to your website, are you planning on putting consulting and vendors out of business with this or where is this eventually going?

Speaker A: Not at all. Uh, because uh, I mean on the contrary, I mean really the goal of the platform is to amplify the impact of the consultant and the vendor. And it's funny because I have this conversation with these people and tell me Eric, you know the problem we have today is awareness. People, they don't really understand the problem and the challenge and what to do about it. And so your platform is helping user to understand the challenge and the process and the solution and then when they come to us educated and we have a much better conversation and it really, the platform intent is really about awareness education. It's not a production platform. So for example, you know, you have some experience what is a C bom, right? You can do a cryptographic bill of material, you can do a crypto inventory, you can do a risk assessment, you can go through all the steps of the governance, but that's not going to scale for a uh, real size deployment. And everything is browser based, there is no backend. So it's not a production environment but it helps the user to understand, oh, what's the problem, what I'm going to do about it. And then when he understands, then he go to the vendor and picks his preferred platform.

Speaker B: Um, and for the education and awareness piece, I think it's key to that Whole dialogue really. And if I'm not mistaken, the way that you've structured the platform is that you can basically choose a Persona on the website and then your AI agents curate the content for you. So maybe you can share a little bit about that. Say, you know, I'm a risk person or I'm a ciso, I can have very different experiences on the platform. Is that right?

Speaker A: Yes. And I mean, I'm spending a lot of time around that because, I mean it's obviously the amount of information is huge. And so I really want to, uh, provide a customized experience depending on the role, the proficiency level, the geography, the industry. So the beginning of the experience is you define your Persona. And when you define your Persona, you see all the information, at least the intent is that you would see only the information that matters for you. And you write like an executive, want to focus on risk, uh, management and return on investment and how to go to his board and get, uh, funding for that transformation journey, build the team. And the developer, he wants to know how to write, uh, MLDSA signing operation. And with KS11 and the DevOps, he wants to understand how to configure, uh, TLS or VPN to uh, enable PQC. And so that's the idea. And the website is like that. It's not perfect. And honestly the main feedback that I get is that there's still too much information. So I'm working on the second version of user interface that makes it more, I mean, easier to navigate. So, uh, it's still in progress, but that's the intent and as well, as you mentioned is the idea is that it knows about you and also when you interact with it, it takes into account that Persona. So it provides you the right level of information in the right context.

Speaker B: Well, and I think you raised a really important point here in that I feel like the way that you envision the project to mature, it will likely never be finished. It will be, um, you know, constant changes. And I think you just used in one of the sentences you said the feedback that you receive. Right. So I think the feedback that is provided to you really is a big and important aspect of how to improve further on the content that you provide and how you provide it. I mean, I've experienced firsthand that you're quite responsive to feedback, so that's great. So maybe you want to talk a little bit about that aspect as well.

Speaker A: Yeah, I mean, feedback is really the most valuable part, uh, of that journey is actually I have different kind of feedback, so it's Interesting because since I started this project now I get in touch. I mean I have a lot of people, experts in the PQC feed that reach out to me and I can have that conversation with all the experts. So that's first feedback, direct feedback. With all this. And also in all the site I put a feedback loop like you have a flag to say something is not right. A stamp. Yes, it's good. And so it's set up with GitHub and so I have this electronic feedback as well. And I check regularly, I mean feedback from people and I answer to them. And I mean like for example the pqc, uh, protocol matrix, someone asking hey Rick, I mean I like to have that. So okay, I added it. And some people say you see that this platform has recently added PQC added or uh, if there is a mistake as well, they say this is wrong, so fix it. And I fix it. So that's the second kind of feedback. And also have a subject matter I spare. That's great. They say, I mean if you want I can help you validate the PKI part or the TPM part or I mean different parts. And that's super helpful for me to have this expert that can evaluate and help me fine tune the content actually because it is huge and having this feedback is very precious.

Speaker B: It's a good call for action really to take a look and see if there's anything missing or uh, can be added, can be promoted as well. So I think when you. We've been talking a lot about awareness, so I'm curious to hear your take on. Given that you have these two jobs, right, your day job and then your project as well, I mean awareness is really rising. A lot of organizations by now are aware of. But the switch over to you know, actually doing something, actually starting a meaningful action, starting a migration project and really executing on it. Do you see a bit of a momentum shift in that regard?

Speaker A: Yeah, I mean we definitely see an acceleration. I mean to be fair, three years ago the only people I was talking to about PQC were like satellite manufacturer was basically because the people there were hard to fly uh, in the space some M item and no way to bring them back. I mean you cannot just bring back a satellite to Earth. But recently, I mean it grew quite a bit. And I would say that Google announcement, recent announcement with uh, optimization of both the hardware and the algorithm to break is definitively um, giving a boost of acceleration. So the awareness itself, I mean people still have to learn a lot. And I think one thing That, I mean we need to go past, oh, you need to upgrade uh, crypto algorithm. Right. I think whether you need to do some work in terms of awareness, you need to really tell the people it's not just about changing an algorithm A by B, but it's really about setting up cryptographic governance in place and put you in a place where you can adapt to any kind of threat. Because threat is not just a quantum M computer, it can be a side channel attack, it can be a new mandate, it can be anything. I mean we see that there are some attacks on old algorithm. Right. And has nothing to do with uh, quantum today.

Speaker B: Yeah. And I mean you were speaking about the advancements in AI as well. Right. It's great to see this positive picture painted where you basically say well without AI none of this would really be possible. But then of course AI is also an accelerating factor for a lot of, you know, things like error correction and, and those type of building blocks for that future. Now for anybody who's not really started their journey yet and is sort of hesitant to take that first step, what is your typical recommendation? What is a first concrete step organizations should take that they won't regret and that gets them started on that journey.

Speaker A: On the pkc, I created a new role, it's called Curious Wall. So I mean if you visit for the first time, I recommend you, you open the site and you pick a uh, curious role and then you have a curated experience that really gives you the basics. That's one, I think one thing as well, I think one of the most, I mean the best, I would say encompassing documentation I know about that topic is NIST CSWP 39 which is really like a governance. I mean it's a great document because it gives you a holistic view of what it means to become ah, crypto agile. So if I were to start somewhere I would start there because it's really give you the big picture and give you an understanding of what really matters. And if you read that document you understand. Yeah, again that's not just about uh, algorithm, it's really about governance, putting in place the right organization, the right risk assessment, the right control. So I would say uh, I would start there. And if you're a geek in algorithm, um, I would go to your site because in my opinion PQ Shield website is the best resources to understand about post quantum cryptography itself for all the

Speaker B: mathematicians and cryptographers out there. Yeah, yeah.

Speaker A: If you are a mathematician go to pqshield.

Speaker B: Fantastic. Well thank you so much Eric for joining the conversation today and for giving me insights in the work you do. And certainly I'm going to go check out that curious role on pqc2t.com that sounds like fun. Thank you for joining.

Speaker A: Thank you very much Joe for having me and have a great day.

Speaker B: Absolutely. And to our listeners, as always, thanks for tuning in. Don't forget to like, share and subscribe so you won't miss a future episode. In the meantime, stay safe, stay vigilant and stay shielded. Thank you. The Quantum Era is already here. With the right tools, the right knowledge and the right mindset together we can face it head on. To find out more about PQ Shield and how how our cutting edge solutions can help you secure your data against the Quantum threat, visit pqshield.com make sure to search for shielded, the last line of cyber defense in Apple podcasts, Spotify or anywhere else you get your podcasts. Don't forget to click subscribe so you never miss an episode. On behalf of the team here at PQ Shield, thanks for listening.