The Quantum Countdown: Why Certificate Testing Starts Now

Elliot Volkman: Hello and welcome back to the "Microsoft Threat Intelligence Podcast." I am your sometimes host and hopefully might have a new host for you coming up here in a couple of months. But today, we are going to completely go off our typical approach, which is the world of threat hunting and threat research, and of course obviously the latest AI related threats, to talk about something that we feel you all need to be aware of. For that, I fortunately have a fantastic guest and expert who's going to be able to walk us through the world of post-quantum cryptography and everything that goes along with it, but very candidly, this is not my world. I have no idea what half of this means, so I apologize in advance, Karina. But for that, we have our guest who is Karina Goodley who is a senior security program manager here over at Microsoft. Karina, anything else you'd like to add, a little bit more into your background, and then we can kind of just jump right in?

Karina Sirota Goodley: Sure, yes, I'm Karina. Thank you so much for having me. I work on the Microsoft Trusted Root Program, so we distribute all of the third-party root certificates to every Windows machine on the planet and every Edge browser and everywhere else. And so, we do -- anytime you're on like an HTTPS connection, that's generally through one of our certificate authorities. Anytime you're touching a piece of code that's been signed, and right now, our biggest challenge is like we said, focusing on post-quantum cryptography.

Elliot Volkman: Perfect, and we'll kind of pull a few things apart but obviously, our listeners are primarily from a threat hunting practitioner perspective, some threat intel folks obviously in there as well. They're a little bit focused on the now which is not even necessarily the AI threats, but we're jumping into the future, and we'll get into that in a minute but maybe let me tee this up a little bit. So, right now, organizations are preparing for a future in which quantum computers could undermine wildly used -- or widely used cryptographic protections. But transitioning to post-quantum cryptography isn't really as simple as swapping algorithms or upgrading certificates. It requires coordination across certificate authorities, operating systems, browsers, applications, how hardware, and of course infrastructure. Microsoft Trusted Root Program, which obviously you are part of, has launched a post-quantum cryptography pilot to begin testing how these systems actually work together. And that is obviously why you're here to help explain exactly why testing needs to happen now, which you know we'll go into what makes a certificate ecosystem particularly complicated and what organizations realistically need to do to prepare. So, what I would like you all, our listeners or maybe a few of you viewers, is obviously not to panic about quantum computers tomorrow, but trying to get ahead of the curve and what you need to understand about the cryptographic dependencies that are coming up today. So, maybe we can just start there. But Karina, is there something that we need especially from like the security practitioner perspective folks to start to keep in the back of their mind because it's not an emergency tomorrow? Hopefully, you know, things change. But you know, is there like an immediate action that we want these folks to start to like read up on, start to become aware of, and start to take into account of how this is going to maybe change some of their functions?

Karina Sirota Goodley: Yes, I would say one of the most important things that all organizations could be doing right now is taking a cryptographic inventory. So, like what you said, we don't know when Q Day is going to happen. This is a little bit different than other events that we've seen like across the industry. A lot of people call it yes, Y2Q to compare it to Y2K, but Y2K we had like a specific date that we knew we were aiming against. We don't know when a cryptographically relevant quantum computer is going to arrive. No one really has a crystal ball. We know that cryptographic transitions always take a long time. It touches everything in everyone's ecosystems. And so, part of what we're trying to encourage everyone to do is to really take a look at your end-to-end cryptographic, where is anything touching cryptography, so that you're ready, you know, anywhere where something would be pinned, or just to have like a good awareness of what's going on, so that when time comes, as we're building out standards currently, as we're building out the technologies that's going to replace what we have right now, in a lot of different ways, everyone's ready to sort of do a faster transition.

Elliot Volkman: So, if I understand that correctly, we want to, you know, start with the inventory. That makes sense to me. But we want to start to incorporate changes so there is a appropriate transition. This is probably a dumb question or maybe the elephant in the room, but you know, how much of an early warning would we actually get when we need to make that transition land? Like this is -- it's not like an overnight kind of thing, I assume.

Karina Sirota Goodley: No, so that's why we're preparing earlier rather than later. We -- I don't know how much warning we'll get. I know the industry is generally aiming towards earlier days than we expected. So, originally we were saying, you know, something like 2035, maybe later. But recent advances in the number of qubits that are being built out faster, as well as the number of qubits -- some research is being done on like how many qubits it takes to break certain algorithms that we do have, both of which are slowly narrowing the field towards less qubits needed to break things, and we have more qubits available, that should be working on a level. So, that's why we're just trying to speed it up, before any sort of date. Same with what we would recommend for any customers or listeners to be doing.

Elliot Volkman: Perfect. So, yes, of course, people definitely are very proactive in our world and are super on top of things, which brings me to a more realistic question here which is obviously encrypted data is a key area of focus and importance, but why should we also be taking into account authentication and certificates?

Karina Sirota Goodley: Yes, authentication and encryption solve totally different problems. So, encryption is keeping information confidential, but authentication really answers questions like, "Is this the website that I wanted to connect to? Does this software come from the publisher that it claims to be?" Can I really like the question is, "Is who is on the other side? Can we trust it?" And that comes with like levels of knowledge on who the other side is. But at a minimum, with like a TLS connection, am I actually connecting to the machine on the other side that I think I am? And there's no one like in the middle here trying to take some data? So, certificates and digital signatures specifically, they're foundational for establishing that trust. And quantum readiness, it can't just be about protecting your secrets. We're also trying to protect the mechanisms that tell our systems who to trust and what to trust.

Elliot Volkman: That's a great point to highlight there. That makes me wonder, is there maybe a key misconception that comes along with this entire situation?

Karina Sirota Goodley: Yes, I think a lot of people think that this is just an algorithm replacement like we've had before. So, you just -- we're going to pull out something, the -- like ECC algorithm and put something else in. And then they'll be done. The algorithm is almost the easiest part. NIST has been making an algorithm change for a long time. We've been settling and things are almost set. The hard part is not the algorithm swap, it's the ecosystem. So, understanding where the cryptography is being used, understanding whether those systems will support the new algorithms, the new certificates, and new technologies. How are we going to transition them? And especially like the different speed and the different parts that are moving. We've learned it's very complex. There's like ten different stakeholders at any given moment on a specific technology, and everyone moves at a different speed, and how do we align that moving forward? So, it's really a lot more than just let's swap out our certs real quick for new algorithms.

Elliot Volkman: Cool. Okay, that makes a lot of sense to me. So, maybe we can pull apart the certificate side of the equation just a little bit more, which is when we are talking about moving to post quantum certificates, why isn't this really as simple as issuing new certificates? And you know, just call it a day from there. Does that magically solve it or obviously that doesn't.

Karina Sirota Goodley: Yes, I mean, I wish. I mean, a certificate doesn't exist in isolation. So, someone has to issue it. Something has to issue it. Both of those parts. Something has to distribute it. Operating systems and applications have to understand it. Libraries have to parse it. Hardware needs to support it. Hardware needs to issue it. You know, and ultimately, like systems just really need to work with it overall. So, like the certificate itself, again, it's one part of the larger equation. So, you could issue a perfectly valid post-quantum certificate, you know, like an MLDSA certificate with the new algorithms, and you would still discover right now, as we're doing these testing, you know, there's something somewhere in the chain that can't use it, and it's not really working very well. And that's really the interoperability that we're trying to solve before these certificates actually -- we like need to rely on them in the future.

Elliot Volkman: So, just to be clear, if there is one area that becomes sort of a choke point, weak point that is not up to the standards that are being built to, I guess, remediate or address these situations, it's just going to be a glaring hole? So, like, again, we can't just replace certificates, but one weak link in this chain is going to take everything else down, I assume.

Karina Sirota Goodley: Yes, it's like an end-to-end system. And it all like, I mean, certificates themselves are built on chaining. At least we'll call like a modern X509 certificate is built on like a very pure concept of chaining. So, we trust certificate authority. Certificate authority trusts you. Therefore, we as Microsoft trust you as the end certificate holder. But like, even in a whole like cryptography is an end-to-end system, so if like one component is quantum ready but something else there doesn't work, it just -- it won't understand it. So, yes. We're really trying to focus on like the whole ecosystem, not just like a collection of quantum ready products that aren't in that ecosystem.

Elliot Volkman: Yes, that makes sense to me. So, I'm curious, is there -- and maybe I'm going to throw an answer out there and hopefully that's not the area we're going to, but we have a lot of legacy infrastructure that lives out in the world, but is there anything in particular that worries you that might not be able to address these challenges in the time that we have left?

Karina Sirota Goodley: I don't know if there's anything in particular where we've got a very bright team of people who are working very hard at solving these issues. It's really just I think focusing like the -- against time is really what my biggest concern is, is like if we had enough time or we knew what deadlines we were facing, that's a different story than you know, where like specific legacy technologies. But as an industry, I'm very proud of where we're going. And we just really have to focus on making sure that we're reading anyone who might possibly have a cryptographically relevant quantum computer.

Elliot Volkman: All right. This might have been the most optimistic piece of the threat landscape that we have addressed in some time. So, I love hearing that. The fact that we also have time is also beneficial because usually we are fighting against something that already occurred. So, very cool. So, maybe we can pull into the pilot that your team, organization is working through, which is if I understand correctly, the pilot involves seven certificate authorities and controlled testing of MLDSA 87 certificate hierarchies. I have no idea what that means. Maybe you can help myself and our listeners.

Karina Sirota Goodley: So, it's the new algorithms. They replace what people would know. Like currently, we have RSA and ECC --

Elliot Volkman: Right.

Karina Sirota Goodley: -- for the two types. MLDSA is a lattice-based algorithm. And it's what -- it won the NIST competition, and that's what's been standardized. So, that's what we've been working on implementing. Our pilot is focusing on testing. We have seven certificate authorities that are participating. We have space for more to participate. Those who are already currently in our program. And really our goal ultimately was, to find out, yes, if we're issuing these types of certs. These are the biggest types of certs that you could possibly have, right now, on this algorithm, I'll say. I'm sure someone can make an even bigger cert, and I'll say this, and then there'll be someone in the audience who will say, "No, no, I can make something bigger." But, like, as far as standards go, this is like one of the biggest, slowest types of like TLS certificates, and that's one of the biggest issues that we found with TLS is that like a traditional X509 certificate, it just balloons so much in terms of trying to like make it more quantum resistant. And so, we wanted to put into and allow CAs to test what it would look like to issue these types of certificates, and for our systems to make sure that we're able to deploy these on the off chance that something happens much sooner than we're expecting, just to make sure that we're also you know, end-to-end wherever we can, ready to push these certificates out. We're looking at interoperability, compatibility, operational processes, issuance and validations. And really all of this only becomes visible when all of these organizations like try to work together to make these work well. So, we're trying to do this in a controlled pilot. CAs have their -- the routes are only available for a year. They're only scoped to systems we've asked anything that's not public that it won't be publicly trusted, not to like put this into a production system. And to do that.

Elliot Volkman: Is there plans to test in a production environment just to, I mean, I assume there's like a future state where you're trying to break it in a more tabletop realistic scenario.

Karina Sirota Goodley: Yes, so it's kind of interesting in that the pilot is we -- we've put them into production. They are in the operating system. They are technically shipped to every machine on the planet. And we do in, you know, encourage CAs to go out and test -- issue these certs to just systems that I guess we wouldn't want them necessarily to go into someone, you know, like let's not start issuing websites here and hoping that things don't break or that the ecosystem doesn't slow down. But it is fully in a production environment. It's fully in every Windows operating system. The -- I think the newer ones technically that support MLDSA, so I think -- it's on the blog post written out, but I think it's just client 25 and server 25. So, but yes, so they technically are in prod. Yes.

Elliot Volkman: Cool. Okay. Thank you for clarifying that. And maybe we can look at some of the testing impacts as well? Because obviously, I think a lot of the world is mostly worried about like performance compatibility and all that other fun stuff that comes along with it. We don't want people knocking on our doors about slow machines and something implicated tied to that. But what specifically are you all looking at as far as like testing scenarios to ensure that we sort of remain status quo, I guess?

Karina Sirota Goodley: Yes, we're interested in like compatibility and performance. For this particular pilot, we were really interested in the operational issues. So, issuing of these certificates, making sure that our tooling specifically is able to handle these types of certificates, end to end from all of the different parts of release, and the certificate lifecycle management assumptions that are built into the systems and any needs that we need from an industry requirements perspective, so that we're able to get ahead of those. And so, there's -- one of the reasons why we're calling it a pilot is because we just want to find the things we haven't thought of yet. So, we did have as CAs were issuing and working through this, there is some you know, areas where our policies aren't open to issuing certain types of certificates. There's some areas where like technology isn't caught up yet with what can be issued where MLDSA can be issued. There is spots where certain like clients can't take it yet and things like that.

Elliot Volkman: Was there an -- without obviously poking at anything that we're not supposed -- you're not supposed to go into, but was there anything in particular that was surprising through this testing or that really just stood out that helped you maybe rethink through how to address these challenges?

Karina Sirota Goodley: I think just on a very minor note, like I was surprised with even the PEM file. So, like when you have a certificate and you have like -- the PEM is like the -- one of the ways that it's represented and you can take it, like the dot cert file. For like an MLDSA certificate, it is like three times as long as a traditional like X509 file. So, we had to just -- in certain spots, it was like built in like you know, make sure that it's not over a certain number of characters to just take in the PEM. Like we just had to fix like very minor things like that. That to me, it was like "Oh, I didn't consider that you know, we would have such like small spots," and then obviously, there's like bigger ones. But, like, yes. They are getting issued and things like that, so.

Elliot Volkman: Cool. Okay, interesting. Yes, that is completely above my head on exactly what that means. So, hopefully some of our folks do, but file size obviously, a thing that impacts other performance and how other people might -- can articulate that. So, that makes sense to me at least that piece. So, maybe we can change gears just a tiny bit. So, one of the interesting things that I love about advances in technology is that organizations who have -- and I'm going to be overly candid here, have the most to lose because there's just so much riding on potential challenges that come along with this, is they are keenly aware that they cannot function as silos. So, you're mentioning in testing that there's seven parties involved in it, but I'm curious. Maybe you can kind of pull that apart even further that obviously no single vendor owns every piece of this equation either especially in end-to-end transaction. So, you know, what complications come along with that because -- and ignoring the fact that like public companies and you know, competitive intel and all that other crazy stuff that comes along with it. But, yes, I'm curious.

Karina Sirota Goodley: That's one of the defining characteristics of PKI. We operate the relying party platforms, but certificate authorities, they issue the certificates. applications consume them. Some of those are from Microsoft, most of them are not. You know, hardware secures keys, standards organizations require define the requirements, and then customers deploy all of it in environments that we absolutely don't control. All of these independent pieces need to work together, and that's the only way that we could do this is by testing like this, by allowing people to issue certs on, you know, production windows and see where things break. And then, you know, if you're a customer trying to test out where things are breaking, going to a certificate authority that's issuing one of these test certs and testing it out yourself and seeing where things are coming in. So, it's -- it definitely complicates the matter, but it's -- that's the way it's always been. So, I would say it's almost built into the process of here's that we make smaller changes in the past. We interact with industry. We interact with all of our CAs. We're just making bigger changes much faster than we ever have before, I think.

Elliot Volkman: Maybe this is a dumb question, because obviously there are working groups, industry working groups for opportunities like this. Like the competitive nature of things tend to go somewhat out of the window within the realm that we -- you know, regulations allow, but I'm curious. Is there also a potential where as we pursue post-quantum readiness, are we building something that might end up being completely different in nature to someone else? So, like DVDs, VHS players, like we obviously have a history in technology where we have different formats, different approaches, but if we aren't creating maybe a uniform system policies and guidance, are we just creating more fractures? Or how are we, you know, how are organizations and teams like yours trying to reduce the siloization and fragmentation that could happen?

Karina Sirota Goodley: Yes, I mean we're actively trying to avoid like breaking things and keeping like a fragmented ecosystem. We're really focusing -- so we across Microsoft, especially like across all of the various crypto teams at Microsoft, we work very heavily in the industry bodies that are making these standards. We try to participate as early as possible. Things like IETF, the CAB Forum, the CCADB, these are all like certificate authority crypto areas where we're able to work with other companies, push and pull on standards, you know, as it makes sense for our platforms. And so, you know, that's why like really working, you know, standards and implementation and interoperability, like it's all a part of it. Just because there are some standards somewhere doesn't mean that everything's going to work everywhere. So, we're trying -- there's a -- it's an industry-wide. We're all working together I think constantly trying to represent our customers well, but still, you know, what often represents well is this interoperability.

Elliot Volkman: Cool. Okay, that is again, I think we're just adding to the optimism here, but obviously there's always worries about fragmentation, and you know, there's going to be some. You know, I recently heard from one of our -- I don't know -- let's call him a SME on all things crypto. It's just interesting to hear the perspectives of how Microsoft's addressing the quantum computing side versus like Amazon and some of the other organizations that are building behind it, but the fact that there's sort of this underlying system that'll help us navigate the challenges that come out of it is always nice to hear. So, one thing that I think I, if I understand it correctly from the blog that you had published in late August, was approaches like the Merkle Tree certificate, if I'm articulating that correctly, what kind of work is that telling us and how does that show where things in our ecosystem might change?

Karina Sirota Goodley: The Merkle Tree certificates, they're -- it's just something that's come up in the industry as it's come down as an alternative to like a traditional X509 certificate. And it's supposed to be much faster in terms of just making sure that there is -- it reduces some of the speed toil that we have from like a -- an MLDSA traditional X509 certificate for TLS specifically, is what we're looking at right now. And so, like a couple of the other platforms, Google, now Apple have announced that they're supporting it. Edge will be supporting it as well. And on the browser side specifically, we're still looking at the rest of the operating system. But it's like a really good example of why it's not just replacing one algorithm with another. TLS, we're just not going to be able to fully allow these MLDSA certificates to go through for websites in order, unless you want to be waiting like several seconds or longer, to get to every website, every connection, and every part of it. So, as we're looking towards a post-quantum ecosystem, we're asking whether the assumptions of like the certificate ecosystem that we have now needs to evolve. So, like MTCs aren't the answer to every certificate problem. But it is interesting that they like force us to think more broadly and how trust could be represented and distributed in different ways, rather than assuming that the way that we've always done PKI.

Elliot Volkman: Cool. Okay. Yes, that absolutely makes sense to me. I would imagine that there's going to be, not just this new underlying concept and technology, but there'll obviously be different concepts on how we're tracking things, proving things, doing our handshakes and all that good stuff. But I do want to shift over to the action part, which is obviously our audience is primarily practitioners, you know, threat hunters, researchers, threat intel folks. Some folks maybe in the SOC and in between and maybe security executives. But what do we want them to do like tomorrow? What should they start to think about? What is the most important factor that they need to wrap their head around and understand of how this is going to change their world?

Karina Sirota Goodley: Yes, I would say start with discovery before building like even trying to consider building a post-quantum migration plan. The first thing everyone needs to know is where their cryptography is being used. Like what certificates do you have? What libraries and algorithms are your systems relying on? What systems are difficult to update? What dependencies are being controlled and by which vendors? Once you understand that landscape, it's easier to start prioritizing what needs to move first.

Elliot Volkman: Okay, cool. So, inventory and understanding where our certificates are, that sounds like a pretty straightforward point of view. Maybe I'm a smaller team and I have no idea where my certificates are. How would a organization go about understanding their certificate dependencies?

Karina Sirota Goodley: Yes, if you can't answer where your certificates are or your keys or your cryptographic dependencies, it's probably exposing a larger cryptographic management problem. So, I would still say just, you know, start slowly trying to build that inventory, identifying the owners, trying to understand like where are their certificates being issued from. Because you know, if you're using them, they're definitely somewhere. Trying to understand certificate lifetimes, especially if you don't know where your keys are or your certs are, that's a time bomb for sure waiting to happen when it expires and your service goes down and then you'll know exactly where it is. So, but yes, understanding like lifetimes and how the renewal works and mapping dependencies, I think just start small, and maybe you don't need to focus on, in those cases, quantum. You could focus on just, "Hey, what does our certificate landscape look like for our, you know, prior to quantum?"

Elliot Volkman: Yes, that makes sense. So, there's maybe another piece of this equation. So obviously, inventory makes sense, but this is a whole end-to-end shift that we're getting organizations to think through, which for me comes to mind is third-party risk management. Obviously, understanding where your certificates are makes sense and just taking inventory of everything that's being impacted. But this mostly aimed at probably security leaders and those who are evaluating other technology. That helps secure everyone's environment and their threat model. But I'm curious, what kind of questions should they start to be asking of their vendors and people that they rely on for you know, other third-party technology? Because we already have supply chain attacks. That's all -- that's always a fun one. But how should they start to be poking and prodding at the folks they rely on from other technology?

Karina Sirota Goodley: Yes, probably like focusing on practical questions. Like, "Where are you using like quantum vulnerable cryptography right now? What's your roadmap for post-quantum standards? Can your implementation support algorithm changes? Are you testing interoperability?" and, you know, also checking on their dependencies in the supply chain? You know, what dependencies do you have on other people's technologies that make your PQC story work or your cryptography story work? And I think that those kinds of just you know, the very basic questions on how are you doing cryptographic management, how are you considering this, it really shows how ready the ecosystem is and where you might have pitfalls.

Elliot Volkman: Cool. Okay. So, one final question. So, let's say I've done my inventory. I now know where my certificates are and where they are coming from. That definitely happened in a month and not six months from now or probably in three years, but in a perfect world, what would a good trajectory look like if you know, I was a year out from right now and I started to do those things? Like maybe not like the next steps, but how do we -- how do we keep that momentum? How do we keep building progress towards that migration and transition?

Karina Sirota Goodley: Yes, I mean, I would say like given the technologies, you know, speed of coming out, like I wouldn't even measure progress necessarily based on you know, whether you've replaced every certificate with a PQC certificate, or that every like secret has been you know hidden with something that's quantum resistant yet. Really, I would say like meaningful progress is truly having you know, a handle on your cryptographic ecosystem, making sure that you have a good knowledge of where your cryptographic dependencies are, what systems are hardest to migrate, you know having to all of your vendors, started testing. And if you've had, yes, the opportunity to have root certificates from like the pilot to test, you know, testing with those, testing with some of the other things that the ecosystem is providing, all of that I think would make good progress. A year of good discovery and testing is much more valuable than rushing into a deployment, and then still having to do fixes as you know, standards are changing, technologies are changing, or things like that. So.

Elliot Volkman: Excellent. All right. That sounds like you've laid out a pretty reasonable roadmap for organizations. Hopefully, they are starting to think through resourcing and bringing people in to start investing and understanding how this is going to impact their world. And that is where we'll leave you all because that's for you to take forward. Karina, thank you so much for joining and giving us a little bit of insight into the world of post-quantum cryptography. And some of the challenges that are going to be coming along with it. I think as maybe we explore new challenges and new elements that come into the -- this equation, maybe I'll knock on your door again. You can help us reevaluate where things are. Maybe determine if we have to light some fires under people to pay more attention as we get closer. But thank you so much for providing your perspective and some insight.

Karina Sirota Goodley: Yes, thank you so much for having me.