PQC 101
Post-quantum cryptography explained like you're not a cryptographer
🪪 What's a Certificate?
Think of it like a digital ID card. When you visit a website, it shows you its certificate to prove "yes, I'm really who I say I am."
Your browser checks this ID. If it's legit, you see the little padlock 🔒. If not, scary warning page.
🏛️ What's a CA?
CA = Certificate Authority
Someone has to ISSUE those ID cards. That's a CA. It's like the DMV, but for websites. Except faster and online.
Issues driver's licenses
Issues digital certificates
🔑 What's Encryption?
Scrambling your data so only the right person can read it. Like writing a note in a secret code only your friend knows.
x7$kL9#mQ2...
🖥️ Regular Computers vs Quantum Computers
Regular computers are like really fast calculators. They try one answer at a time, super quickly.
Quantum computers are... weird. They can try many answers simultaneously using quantum physics magic. 🪄
Tries keys one by one
Billions of years to crack
Tries many at once
Hours to days to crack
⏰ When Will This Happen?
Nobody knows exactly. Maybe 5 years. Maybe 15. Maybe sooner. The point is: it's coming.
🎯 Who Should Care?
Medical records need to stay private for decades. Patient data from today must be safe in 2050.
Bank transactions, investment records, account data — all targets for harvest attacks.
Classified information, citizen data, infrastructure controls. High-value targets.
Your passwords, private messages, photos — anything encrypted is potentially at risk.
🧮 Post-Quantum Cryptography (PQC)
New math. Different math. Math that quantum computers CAN'T break easily.
Smart people spent years finding encryption methods that work against BOTH regular AND quantum computers.
📋 The New Standards
- ML-KEM — For scrambling data (key exchange). Used when two computers need to agree on a secret code.
- ML-DSA — For signing things (digital signatures). Proves a document/certificate is authentic and hasn't been tampered with.
- SLH-DSA — Backup signatures (different math). In case someone finds a weakness in ML-DSA, we have a Plan B.
🔄 The Transition
We can't flip a switch overnight. The internet is upgrading piece by piece:
Chrome, Firefox, Safari are adding PQC support. Some already have it in testing.
AWS, Google Cloud, Azure are rolling out quantum-safe options.
Signal already uses PQC. More apps following. Your phone will update automatically.
CAs (like us!) are issuing quantum-safe certificates. This is where Spork comes in.
🤔 What Should I Actually DO?
You're done! Now you know more about quantum computing threats than most people. Share what you learned.
Talk to whoever handles your certificates. Ask: "What's our post-quantum readiness plan?" If they look confused, send them here.
Start testing your apps with PQC libraries. Check if your dependencies have quantum-safe options. Future-you will be grateful.
Look at Spork. Seriously. It's what we built for exactly this situation. PQC certificates without the headache.
📅 Timeline Suggestions
2025-2026: Learn, test, experiment with PQC in non-production
2026-2027: Start hybrid deployments (old + new crypto together)
2028+: Transition production systems to PQC
🤷 Still confused?
That's totally fine. This stuff took cryptographers decades to figure out. You got the 5-minute version.
The important thing: quantum computers will break current encryption, new math fixes it, and the transition is happening now.
🥄 Spork
Spork is software for running your own Certificate Authority — the thing that issues digital certificates.
It supports the new quantum-safe algorithms (ML-DSA) alongside traditional ones (ECDSA, RSA).
📋 Key Points
- Post-quantum ready — Issues ML-DSA certificates that will remain secure.
- Single binary — One download, no complex setup.
- Complete toolkit — Includes OCSP, CRL, ACME, and more.
If you're building PKI infrastructure or just want to learn how certificates work, Spork is a good place to start.