Microsoft Warns Organizations to Prepare for Post-Quantum Cryptography

Microsoft is urging organizations to prepare for post-quantum cryptography (PQC) by identifying and addressing potential vulnerabilities in their systems. The company warns that as quantum computing advances, many cryptographic algorithms will become vulnerable, leading to costly disruptions during the transition.

Making matters more complex, cryptographic functions are often embedded in various components of an organization's system, including operating systems, third-party software, cloud services, hardware, and custom applications. To mitigate this risk, Microsoft recommends using threat modeling to discover undocumented cryptographic dependencies.

According to Microsoft, the first step for PQC migration involves examining the cryptographic environment in detail, which includes identifying algorithms, protocols, key sizes, and security configurations in use. Organizations should also assess whether sensitive data could be exposed to future 'harvest now, decrypt later' attacks.

Microsoft emphasizes that TLS 1.3 is a basic requirement for PQC adoption, as older versions of TLS don't support the hybrid post-quantum key establishment mechanism required for quantum-resilient connections. The company recommends adopting hybrid TLS 1.3 key exchange mechanisms and replacing RSA and elliptic curve-based key establishment methods with ML-KEM.

Organizations using Azure PaaS services can rely on Microsoft to manage the implementation of PQC-capable infrastructure, but customers are still responsible for understanding their dependencies and designing applications with crypto-agility.