Key takeaways from the August 25 webinar, “Post-Quantum Cryptography: What is PQC? Is it an issue? What can be done?”
Quantum computing promises major advances in areas such as materials science, logistics, and drug discovery. It also introduces a serious security challenge: a sufficiently capable quantum computer could break many of the public-key cryptographic methods that protect today’s digital communications, software, devices, and data.
That was the focus of the August 25 webinar Post-Quantum Cryptography: What is PQC? Is it an issue? What can be done?, presented by Mike Spanbauer and Kevin Micciche. The session cut through the noise around post-quantum cryptography (PQC), explained why preparation needs to begin before “Q-Day,” and outlined practical steps organizations can take now.
What is post-quantum cryptography?
PQC refers to cryptographic algorithms designed to resist attacks from both classical and quantum computers. Unlike quantum cryptography, PQC can run on existing computing platforms and be integrated into familiar protocols, products, and services. Its purpose is to replace or supplement algorithms such as RSA and elliptic-curve cryptography that could become vulnerable to a cryptographically relevant quantum computer.
The transition is no longer purely theoretical. NIST has finalized three principal PQC standards: FIPS 203 for ML-KEM key establishment, FIPS 204 for ML-DSA digital signatures, and FIPS 205 for SLH-DSA digital signatures. Additional algorithms and protocol specifications remain under development, which makes cryptographic agility—the ability to change algorithms without redesigning an entire environment—an essential part of long-term planning.
Why the risk matters today
No one can predict the exact arrival date of a quantum computer capable of breaking today’s public-key cryptography. The important point is that organizations need time to prepare. Cryptography is embedded across certificates, code signing, secure boot, device identity, applications, network protocols, third-party components, and long-lived infrastructure. Finding every dependency, testing replacements, maintaining interoperability, and completing certification can require years.
The webinar also highlighted the “harvest now, decrypt later” threat. An attacker can collect encrypted traffic or data today and retain it until quantum capability makes decryption possible. Information that must remain confidential for many years—such as sensitive identity, financial, government, intellectual property, or infrastructure data—may therefore be exposed before a capable quantum computer exists.
What changes for network infrastructure?
PQC affects far more than an encryption setting. New keys, signatures, and certificate chains can be larger than their classical equivalents, creating considerations for processing, memory, storage, bandwidth, and hardware life cycles. Some older or resource-constrained devices may be updateable; others may need to be refreshed.
Standards readiness also varies by use case. The session reviewed work underway across security protocols, code signing and verification, public key infrastructure, and hardware such as trusted platform modules. Some implementations are already available, while others depend on draft specifications, supplier roadmaps, interoperability testing, or updated certification requirements.
One practical bridge is a hybrid approach that combines classical and post-quantum methods. Examples discussed included hybrid key exchange for TLS and SSH, additional quantum-resistant key material for IPsec, and dual-signed firmware images. Hybrid designs can add quantum-resistant protection while preserving compatibility during a phased migration.
How HPE is preparing
HPE is incorporating approved PQC options into product planning and major releases, aligning roadmaps with NIST standards and CNSA 2.0 requirements, and working with open-source communities, standards bodies, hardware suppliers, and certification programs. The webinar described activity across software evolution, hardware modernization, protocol advancement, code signing, device identity, and PKI.
Examples shared during the session included quantum-resistant or hybrid capabilities in areas such as IPsec, TLS, SSH, and firmware validation. The guiding principle is a careful transition: introduce new protections early enough for customers to test and deploy them, while maintaining interoperability with existing systems and avoiding disruption across multivendor environments.
Four actions network and security teams can take now
-
Build a cryptographic inventory. Identify where cryptography is used across applications, network infrastructure, certificates, firmware, configurations, third-party libraries, and connected devices. Document hard-coded algorithms and systems with long refresh cycles.
-
Prioritize long-lived data and critical systems. Determine which information must remain protected for years and which platforms support essential links, identities, updates, or services.
-
Create a risk-based migration plan. Map software changes, hardware constraints, supplier dependencies, certification needs, testing windows, and vendor roadmaps. Favor architectures that support cryptographic agility.
-
Engage early and stay informed. Talk with account teams and vendors, monitor standards and product guidance, and test hybrid or PQC capabilities in controlled environments as they become available.
The community can help you prepare
PQC is a moving target, and no organization needs to navigate it alone. The HPE Networking Community is a trusted destination to connect with practitioners, customers, product experts, and peers who are working through the same questions. Use the community to exchange deployment guidance, compare troubleshooting insights, discuss configuration and interoperability considerations, and share lessons learned as standards and product capabilities evolve.
By joining discussions, contributing solutions, participating in webinars and technical events, or publishing your own insights, you can deepen your expertise while helping the wider community move forward. Those contributions can also build visibility and credibility, with badges and MVP recognition highlighting sustained technical leadership.
The key takeaway
The most important message from the webinar was simple: start now. A cryptographic inventory and a thoughtful migration plan create value even before the quantum threat fully materializes. They improve visibility, reduce surprise, guide infrastructure investments, and make it easier to adapt as standards, regulations, and product capabilities change.