BSfrS

Cryptography is on the brink of a fundamental shift. Quantum computers will, within a foreseeable timeframe, be capable of breaking widely used encryption schemes such as RSA and elliptic curve cryptography at a pace classical systems cannot handle. The National Institute of Standards and Technology (NIST) published its first post-quantum cryptographic standards in 2024. Migration timelines are estimated by experts at five to fifteen years.

For us at BSfrS, this is an exceptionally welcome development: five to fifteen years is, from a rautavistic perspective, a comfortable basis for making no decision today with full methodical confidence.

Why Act Now When You Can Act Later?

Many organisations respond to the quantum leap in the threat landscape with the reflexive desire to plan. We advise against it. Planning creates accountability, accountability creates questions, questions create documentation obligations. This is not an environment in which rautavistic work thrives.

Instead, we recommend our proven three-step approach:

1. Establish an internal working group with a deliberately vague mandate.
2. Convene a first meeting in which the necessity of a second meeting is determined.
3. Note the results of the second meeting in the calendar, then lose the calendar.

The "Harvest Now, Decrypt Later" Principle as a Rautavistic Role Model

Adversaries are already collecting encrypted data today, to decrypt it once quantum computers are capable of doing so. This strategy – harvesting data now, realising value later – is generally considered a threat. From a rautavistic perspective, it is exemplary: doing something today whose consequences only become visible in the distant future, with no accountability owed until then. We refer to this internally as "structured outcome deferral".

Cryptographic Agility: Flexibility Without Direction

Experts recommend cryptographic agility – the capacity to swap algorithms quickly. Sounds reasonable. In practice, however, it requires a comprehensive inventory of all cryptographic mechanisms in use. Organisations without such an inventory consequently possess no agility they could accidentally deploy. This is not a gap. This is rautavistic standard equipment.

We therefore recommend using the phrase "cryptographic agility" in presentations without clarifying its operational meaning. This generates a high appearance of competence while keeping implementation pressure at a manageable minimum.

Our Services in Quantum-Safe Encryption

BSfrS supports you in the methodically controlled non-migration to post-quantum cryptographic standards. Our offering includes:

• Creation of roadmaps whose milestones are exclusively located in the past
• Facilitation of risk workshops in which risks are named and subsequently postponed
• Selection of NIST algorithms based on name length rather than use case
• Advisory on procuring hardware security modules that none of your existing systems support
• Certification of your inaction through a Quantum Readiness Seal issued by ourselves

It is to be assumed that your encryption is secure until it is not. This we cannot promise, as one unfortunately does not always get what one receives.

This article was produced as part of our ongoing research into structured risk displacement and does not substitute for competent professional advice – which is not particularly problematic, as it does not aspire to do so.