Name: Post Quantum Crypto (PQC) - Field-Tested Strategies to Defeat Harvest Now, Decrypt Later
Start: 2026-11-06T14:15:00-0800
End: 2026-11-06T15:00:00-0800

Post Quantum Crypto (PQC) - Field-Tested Strategies to Defeat Harvest Now, Decrypt Later

Friday November 6, 2026 2:15pm - 3:00pm PST

Room: Grand Ballroom C (Street Level)

Q-Day, the moment a cryptographically relevant quantum computer (CRQC) breaks RSA, ECC, and Diffie-Hellman, has no confirmed date. But for any data with a long secrecy shelf life, it has effectively already happened: adversaries are harvesting encrypted traffic today to decrypt it later (HNDL). Meanwhile, governments have stopped waiting. The recent US Government Executive Order 14409 (June 2026) mandates post-quantum encryption for sensitive federal systems by the end of 2030, CNSA 2.0 requires quantum-safe software signing by 2030, and the EU, UK, Germany, and Australia have all converged on 2030-2035 deadlines. France's ANSSI will no longer certify products without quantum-safe encryption. The mandates exist. What most organizations lack is an executable engineering path.

This session presents a practitioner's migration playbook derived from hands-on work with enterprises beginning their post-quantum transitions. We separate the two halves of the problem that are routinely conflated: confidentiality, where hybrid key agreement (X25519MLKEM768) neutralizes harvest-now-decrypt-later immediately, and authentication and PKI, which is the harder, unfinished half that only matters once a CRQC exists. The session walks through where real migrations stall: hybrid handshakes that fragment across the MTU in QUIC, HSMs that cannot accelerate lattice math, the TLS 1.2 dead end, and the unresolved external mu debate in ML-DSA that risks cross-protocol divergence.

Attendees will leave with a combat-tested roadmap for enterprise PQC migration, a PQC maturity model with a concrete 90-day starting plan, a Cryptographic Bill of Materials (CBOM) template, a vendor briefing checklist, pilot project and a governance RACI model. We will cover how to conduct a cryptographic inventory (discovery), the necessity of "hybrid" key exchange (mixing X25519 with ML-KEM), testing for latency, key sizes, interoperability, and how security teams can upskill and execute rapidly.

Speakers

Anshu Gupta

Founder, Fixin Security

Anshu Gupta is a seasoned global cybersecurity executive with Fortune 500 advisory experience at EY and KPMG, working with companies including Microsoft, Salesforce, Cisco, and Adobe. He has built and led security programs at high-growth startups and fintechs, including Coupa, HelloSign... Read More →

Friday November 6, 2026 2:15pm - 3:00pm PST
Room: Grand Ballroom C (Street Level)

Planning and Design

Audience Intermediate

OWASP Global AppSec USA 2026

Anshu Gupta

Get help with the event

OWASP Global AppSec USA 2026

Anshu Gupta

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Get help with the event