Why it matters now

I recently watched John Savill’s video on quantum-safe cryptography. It’s one of the clearer explanations of why the topic is relevant today and not only once large quantum computers exist.

What quantum computers are good at

Quantum computers don’t make everything faster. They are good at a narrow set of problems:

  • Factoring large numbers
  • Solving discrete logarithms
  • Finding the periods of mathematical functions

Modern public-key cryptography is built on exactly these problems. RSA, ECC and Diffie-Hellman are broken once large fault-tolerant quantum computers exist.

Symmetric cryptography holds up better. Grover’s algorithm halves the effective key length, so AES-256 drops to 128-bit equivalent security, which is still strong. The urgent part is asymmetric cryptography: key exchange and digital signatures.

Harvest now, decrypt later

Attackers don’t need a quantum computer today. They can capture encrypted traffic now, store it, and decrypt it once quantum computers are available.

Data that has to stay confidential for many years (government, healthcare, personal identity data) is therefore already at risk.

The NIST standards

NIST finalised three post-quantum standards in 2024:

  • FIPS 203: ML-KEM (Kyber) for key encapsulation
  • FIPS 204: ML-DSA (Dilithium) for digital signatures
  • FIPS 205: SLH-DSA (SPHINCS+) for hash-based signatures, as a conservative backup to ML-DSA

These algorithms don’t rely on problems quantum computers solve well. ML-KEM and ML-DSA will show up first in TLS and certificate chains. SLH-DSA is slower but only depends on the security of hash functions, which makes it a fallback if lattice-based schemes are ever weakened.

Microsoft is integrating these into SymCrypt, Windows, Azure and M365.

What Azure handles for you

On Azure, you don’t have to run the migration for managed services yourself. App Service, Storage, Azure SQL Database and Key Vault are updated by Microsoft, and as post-quantum algorithms are standardised, these services will adopt them for the transport layer (TLS).

That has limits. Connections to managed services get PQC protection without any action on your side. But if your own applications pin cipher suites, hardcode certificate validation, or do their own cryptography (signing tokens, encrypting data at the application layer), nothing updates automatically. The automatic part covers transport, not your application code.

Practical steps

  1. Inventory your cryptography. Use Azure Policy and Microsoft Defender for Cloud to find where cryptography is configured.
  2. Review custom applications that implement cryptography directly.
  3. Enable TLS 1.3. It’s supported across Azure services and comes with more modern cipher suites. The Azure TLS checker shows your current state.
  4. Use Private Endpoints to keep traffic on the Azure backbone.
  5. Watch Defender for Cloud recommendations. It flags outdated cryptographic configurations.

Architecture still matters more

Cryptography has never compensated for bad architecture.

Quantum-safe algorithms don’t help if traffic is exposed publicly, if data leaves the device when it doesn’t need to, or if you share more sensitive information than necessary.

What I took from the video is to prepare now:

  • Reduce data exposure where possible.
  • Prefer private networking over public endpoints (Private Link, VNet integration; the subnet calculator helps plan the address space).
  • Know where and how cryptography is used in your systems, including dependencies in custom applications.
  • Use Azure Key Vault for key management, so Microsoft’s quantum-safe roadmap applies to your keys.
  • Enforce minimum TLS versions with Azure Policy across subscriptions. See the EPAC introduction for managing policies at scale, or the governance framework.

For managed services, the vendors will do most of the work. The remaining effort is in your own code and your cloud foundation. The basics stay the same: defense in depth, a small attack surface, and not relying on cryptography alone.

Sources

  1. John Savill, “What Quantum Safe Is and Why We Need It to Stay Secure,” YouTube, https://www.youtube.com/watch?v=5--yBhgDrXM

  2. Microsoft, “Azure Well-Architected Framework - Security,” Azure Documentation, https://learn.microsoft.com/en-us/azure/well-architected/security/

  3. NIST, “Post-Quantum Cryptography Standards,” NIST Computer Security Resource Center, https://csrc.nist.gov/projects/post-quantum-cryptography

  4. Microsoft, “Azure Key Vault Security Features,” Azure Documentation, https://learn.microsoft.com/en-us/azure/key-vault/general/security-features

  5. Microsoft, “Microsoft Defender for Cloud,” Azure Security Documentation, https://learn.microsoft.com/en-us/azure/defender-for-cloud/